The majority of IT and security professionals believe that Anonymous and hacktivists are among the groups that are most likely to attack their organizations during the next six months, according to the results of a survey sponsored by security vendor Bit9.
Sixty-four percent of the nearly 2,000 IT professionals who participated in Bit9's 2012 cyber Security Survey believe that their companies will suffer a cyber attack during the next six months and sixty-one percent of them chose hacktivists as the likely attackers.
[ Learn how to greatly reduce the threat of malicious attacks with InfoWorld's Insider Threat Deep Dive PDF special report. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
Respondents had the option to select up to three groups of attackers who they believe are most likely to target their organizations. The choices were Anonymous/hacktivists, cyber criminals, nation states, corporate competitors and disgruntled employees.
Anonymous was chosen by the largest number of IT professionals overall, but there were some differences based on the type of organization. For example, nation states was the top choice for people working in the government sector, while those working in retail selected cyber criminals as the top threat.
According to Verizon's 2012 Data Breach Investigations Report, hacktivists stole the largest quantity of data in 2011, but they were responsible for only 3 percent of the total number of breaches.
Respondents choosing hacktivists as a more likely source of cyber attacks than cyber criminals is similar to how most people fear flying more than driving, even though, statistically speaking, it's far more likely for someone to be involved in a car accident than in a plane crash, said Bit9 chief technology officer Harry Sverdlove.
The truth is that you are less likely to be attacked by Anonymous or hacktivists -- depending on what public statements you make -- than to be attacked by a cyber criminal enterprise or a nation state, he said.
Despite considering Anonymous the top threat, when selecting the method of attack they are most worried about, 45 percent of respondents chose malware, which is generally associated with cyber crime rather than hacktivism.
Distributed denial-of-service (DDoS) and SQL injection, two attack types most commonly favored by hacktivists, worried only 11 percent and 6 percent of respondents, respectively.
Sverdlove believes that the reason why most IT professionals fear attacks from Anonymous is the bad publicity such attacks generate. If you're attacked by Anonymous the world is going to know because the announcement will be on Pastebin in 24 hours, whereas if you're attacked by cyber criminals, people might never find out, he said.
Despite this, almost 95 percent of respondents feel that data breaches should be disclosed to customers and the public. Forty-eight percent believe that companies should disclose the breach occurrence as well as what was stolen, while an additional 29 percent believe that companies should also disclose how the breach occurred.
Over half of those surveyed, 54 percent, believe that the most important machines in their business environment are the infrastructure servers. Forty-eight percent selected file and database servers, 46 percent selected Web and application servers and 45 percent chose email servers. Multiple choices were allowed.