IT pros are hacking their own enterprises to keep intruders out

A survey of IT security professionals has discovered that 83% consider commercial applications, the ones you buy off the shelf, to be riddled with code flaws and vulnerabilities.

Fortify Software found that 56% believe these flaws could allow hackers to exploit these software vulnerabilities. As a result, security professionals are making heavy investments in penetration and code testing, combined with application scanning, to try and build security into the software.

Half of the IT security professionals also admitted to hacking, with 73% of these respondents doing so to test the strength of their own network’s defenses, 13% for fun or out of curiosity, and 3% targeting their efforts at the competition.

Compiled at Infosecurity Europe, the survey also unearthed that, amongst the 300 IT security professionals interviewed (with the majority taken from companies employing 1,000 plus employees), 31% admitted to being victims of hacking. More interestingly, with 29% replying “don’t know’, this figure could be substantially higher! The majority of respondents cited the application layer to be the hackers’ main target.

57% of the IT security profession also confer that the best way to check that their software applications are free of vulnerabilities and secure is to combine all available techniques and solutions, including code and static analysis, web application firewalls, application scanners and pen testing. Only 5% of the survey respondents we spoke to said their organizations didn’t employ technology for software security.

Of those in this survey that admitted to previous hacking knowledge and experience, 42% learnt in their twenties and 14% in their teens. Most people learnt to hack at work — 29%; on the Internet, 26%; at University, 13%; and 8% gained their hacking skills whilst still at school and 8% used friends to help them hone their talent.