KPMG New Zealand
Media Release
Global Organisations Unaware Of Their Online Risk Exposure
Philip Whitmore – KPMG head of Security Advisory Services
Many global organisations can do a lot more to protect their private data and reduce exposure to attacks by hackers,
according to KPMG. Calling on organisations to arm themselves better so they can withstand online threats, KPMG’s
observation comes as they publish their ‘Cyber Vulnerability Index’ – a first-of-its-kind report assessing how
businesses are leaking data that exposes them to cyber attacks.
As part of the research, over a six month period KPMG’s Security Advisory Services team simulated the initial steps
would-be cyber attackers might undertake against the Forbes 2000 list of global companies. All the research was
conducted using public domain data without breaching security.
Among the key headlines coming from the Cyber Vulnerability Index is the news that websites of over three-quarters (78
per cent) of organisations in the Forbes 2000 are leaking data, potentially creating opportunities for cyber attackers.
Other key findings include:
• 71% of the Forbes 2000 companies may be using potentially vulnerable and out-dated versions of Microsoft and Adobe
software
• Technology and software sectors are most likely to disclose information in metadata in posts to online forums and
newsgroups
• 16 per cent of companies may be vulnerable to attack due to poor patching or the use of out-of-date server software on
their websites.
Reduce your company’s exposure
Based on the research it is clear that companies should do more to cleanse the amount of data they leak on the Internet
and should spring clean their public facing documents of metadata. Philip Whitmore, KPMG New Zealand’s Security Advisory Services Director comments: “The profile of attackers has been changing over the last couple of years. Today’s cyber attacker is more likely to be
a social activist with an axe to grind, rather than financially motivated. More troubling still has been the perceived
rise of state-sponsored hackers who enjoy the luxury of time and seemingly unlimited resources.”
“Attackers are aiming to gain better access to greater intellectual property. While it’s difficult to stop these types
of people, companies can, at the very least, deny them open access to their secrets which unwittingly, they may have
laid bare.”
“Our findings send out a clear message to business – while the Internet may be your window to the world – it can also
create a substantial security risk as well.”
Tech and software sectors: at risk
It is the technology and software sectors which are most likely to leave their information exposed in relation to
metadata (information about a document or information on its properties) in documents they post to online forums and
newsgroups – more than all the other sectors combined. For example, within these sectors, the research uncovered 419,430
possible usernames spread across the 2,000 sites.
Heat map of the world: countries most at risk
The research found that information disclosure was not confined to just one country or region of the world. Switzerland
(40 per cent), Japan (22 per cent) and Spain (9 per cent) were the top three countries who were most open to attack via
vulnerable web server software. In Japan, the banking sector was found to expose the most information that could be
useful to cyber attackers. While emerging markets, such as Brazil, China, Thailand and Saudi Arabia, are also at risk.
Patching is still an issue
The research team also found that 16 per cent of companies may be vulnerable to attack due to poor patching or the use
of out of date server software. Indeed, the utilities sector was identified as being the most vulnerable sector affected
by issues with out of date software on their web servers. As a result, a successful attack on the website could lead to
the attacker gaining control of the web server and its content.
ENDS