Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Federal IT Top Worries: Complex Attacks, Inside Threats

Government IT professionals also say that long waits for approvals are hindering their ability to secure networks, according to a new study.

What's worrying federal IT professionals most? The increased sophistication of cyber attacks and insider threats top the list of cyber security concerns, according to a new study. Federal IT teams also continue to struggle with budget cuts and long waits for supervisor approval in their attempts to secure their networks, the study finds.

71% of those who responded to a new federal cyber security study listed the increased sophistication of attacks as the top security risk that they expect to face in the next 12 months. Negligent use of information by internal personnel was a risk cited by 63% of respondents. Cisco System sponsored the study, which was conducted by Market Connections and surveyed 200 federal IT decision makers.

Increased use of social media also is troubling more than a majority of respondents, with 63% citing it as a top concern for the next year. Federal agencies increasingly are using social media to engage with the public, even though they have worries about security and privacy risks.

One surprising result of the survey: Cloud computing ranked relatively low on the list of federal cyber security concerns, with only 35% of survey respondents citing it as a top risk for the next 12 months.

[ Pacific Northwest National Laboratory CIO Jerry Johnson takes you inside the cyber attack that he faced down--and shares his security lessons learned, in Anatomy of a Zero-Day Attack.]

Like social media, cloud computing's use among the feds is on the rise as part of efforts to increase efficiencies and reduce costs. Security has been a chief worry that in the past has impeded its use. However, other research also has found that federal IT officials slowly are warming to the security of the cloud, so signs seem to indicate that concerns about its risks are slackening.

While cybersecurity concerns vary, phishing continues to be the top threat federal agencies face, according to the survey, with nearly half of those surveyed saying that their department or agency has faced a phishing attack in the last 12 months.

This finding is in line with reports from the government’s own United States Computer Emergency Readiness Team (US-CERT), which logs reports of cyber attacks on federal networks. In its analysis of 2010 attacks, phishing remained the top threat.

Even as they take preventative measures to secure against these and other cybersecurity risks, federal IT professionals continue to face limitations to doing so. More than half (55%) said it takes too long to get approval from supervisors to put solutions in place to protect networks. Federal budget cuts also negatively affect cyber security goals, 53% reported. Adapting quickly to the evolving nature of threats also is a problem for federal agencies, 46% of respondents said.

Agencies also lack an effective process to respond to a cyber attack, according to 51% of those surveyed, while half of respondents said that they lack a clear picture of all of the activity on networks.

Join us for GovCloud 2011, a day-long event where IT professionals in federal, state, and local government will develop a deeper understanding of cloud options. Register now.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3700
PUBLISHED: 2020-01-24
yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger defa...
CVE-2019-3699
PUBLISHED: 2020-01-24
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version 3...
CVE-2019-3697
PUBLISHED: 2020-01-24
UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of gnump3d in openSUSE Leap 15.1 allows local attackers to escalate from user gnump3d to root. This issue affects: openSUSE Leap 15.1 gnump3d version 3.0-lp151.2.1 and prior versions.
CVE-2019-3694
PUBLISHED: 2020-01-24
A Symbolic Link (Symlink) Following vulnerability in the packaging of munin in openSUSE Factory, Leap 15.1 allows local attackers to escalate from user munin to root. This issue affects: openSUSE Factory munin version 2.0.49-4.2 and prior versions. openSUSE Leap 15.1 munin version 2.0.40-lp151.1.1 a...
CVE-2019-3693
PUBLISHED: 2020-01-24
A symlink following vulnerability in the packaging of mailman in SUSE SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. Th...