May 23, 2018 By Shane Schick 2 min read

Eighty-five percent of security professionals believe cybersecurity threats will lead to an attack on major critical infrastructure over the next five years, according to a recent survey. The annual Pwnie Express study, The Internet of Evil Things, polled approximately 500 security professionals about a range of cybersecurity threats, including malware and devices connected as part of the Internet of Things (IoT).

Cybersecurity vs. Online Evil

The research looked at the variety of industry sectors that might be least prepared for an attack. Health care topped the list at 51 percent — but was followed closely by the waste and wastewater sectors (47 percent) and the energy sector (43 percent).

Security professionals may be predicting major attacks on critical infrastructure because they’re already dealing with so many issues in their own organizations. Malware attacks affected 59 percent of those polled, for example. Additionally, 32 percent were impacted by ransomware. More serious cybersecurity threats — specifically distributed denial of service (DDoS) attacks — struck 30 percent.

Security Professionals Still Lack the Right Tools

Perhaps more worryingly, security professionals suggested they aren’t necessarily strengthening their defenses — even after grappling directly with some of the most serious cybersecurity threats. While WannaCry affected 21 percent of those surveyed, for instance, approximately 18 percent said they still lack the tools to deal with the ransomware cryptoworm. Fourteen percent weren’t sure one way or the other. There were similar findings about other well-known malware and ransomware strains, including NotPetya, Locky and Mirai.

The gaps between the risks and the capability to deal with them weren’t limited to specific malware — it spread to entire areas of data protection. While a majority of 80 percent said they are concerned about cybersecurity threats as a result of bring-your-own-device (BYOD) policies in the workplace, less than half said they had real-time monitoring tools for personal devices.

About the same percentage said they were worried about the risk inherent in IoT-connected smart devices, but only 23 percent claimed to be keeping track of such devices effectively. Overall, while 64 percent said they are more concerned about the security of connected devices than they were last year, the authors said there was no improvement in the frequency at which they’re checking them.

More from

FYSA – Adobe Cold Fusion Path Traversal Vulnerability

2 min read - Summary Adobe has released a security bulletin (APSB24-107) addressing an arbitrary file system read vulnerability in ColdFusion, a web application server. The vulnerability, identified as CVE-2024-53961, can be exploited to read arbitrary files on the system, potentially leading to unauthorized access and data exposure. Threat Topography Threat Type: Arbitrary File System Read Industries Impacted: Technology, Software, and Web Development Geolocation: Global Environment Impact: Web servers running ColdFusion 2021 and 2023 are vulnerable Overview X-Force Incident Command is monitoring the disclosure…

2024 trends: Were they accurate?

4 min read - The new year always kicks off with a flood of prediction articles; then, 12 months later, our newsfeed is filled with wrap-up articles. But we are often left to wonder if experts got it right in January about how the year would unfold. As we close out 2024, let’s take a moment to go back and see if the crystal balls were working about how the year would play out in cybersecurity.Here are five trends that were often predicted for…

Ransomware attack on Rhode Island health system exposes data of hundreds of thousands

3 min read - Rhode Island is grappling with the fallout of a significant ransomware attack that has compromised the personal information of hundreds of thousands of residents enrolled in the state’s health and social services programs. Officials confirmed the attack on the RIBridges system—the state’s central platform for benefits like Medicaid and SNAP—after hackers infiltrated the system on December 5, planting malicious software and threatening to release sensitive data unless a ransom is paid. Governor Dan McKee, addressing the media, called the attack…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today