33% of companies expose unsafe network services to the internet

The findings of a new report validate the correlation between poor network hygiene and the prevalence of wider security issues in the digital supply chain.

Internet and online network security system. Laptop computer with lock icon on screen and application programming interface icons

Image: Getty Images/iStockphoto

A new report finds that 33% of companies within the digital supply chain expose common network services such as data storage, remote access, and network administration to the internet. As such, admins should either eliminate direct internet access or deploy compensating controls for when/if such services are required, according to the report by RiskRecon, a Mastercard company, and the cybersecurity research services firm Cyentia Institute.

The research is based on RiskRecon's assessment of millions of internet-facing systems across approximately 40,000 commercial and public institutions, the company said. Cyentia and RiskRecon analyzed the data in two ways: The direct proportion of internet-facing hosts running unsafe services, as well as the percentage of companies that expose unsafe services somewhere across their infrastructure.

The findings validate the correlation between unsafe network services and the prevalence of wider security issues in the digital supply chain, RiskRecon said.

SEE: IoT safety: Logging devices on trucks are not always secure (TechRepublic)

The research concludes that the impact is further heightened when vendors and business partners run unsafe, exposed services used by their digital supply chain customers, the company said.

"Blocking internet access to unsafe network services is one of the most basic security hygiene practices," said Kelly White, CEO and co-founder of RiskRecon, in a statement. "The fact that one-third of companies in the digital supply chain are failing at one of the most basic cybersecurity practices should serve as a wake-up call to executives and third-party risk management teams."

White added that IT and security teams "have a long way to go in hardening the infrastructure that we all depend on to safely operate our businesses and protect consumer data. Risk managers will be well served to leverage objective data to better understand and act on their third-party risk."

Further research findings include:

Direct internet access to database services should be prohibited or secured. Within the top three unsafe network services, data stores, such as S3 buckets and MySQL databases are the most commonly exposed.

Digital transformation and the shift to remote work needs to be considered. Remote access is the second most commonly exposed service; admins should consider restricting the accessibility of these services only to authorized and internal users.

Universities are woefully exposed. With a culture that boasts open access to information and collaboration, the education sector has the greatest tendency to expose unsafe network services on non-student systems, with nearly 52% of universities running unsafe services.

Global regions lack proper security posture. Countries such as Ukraine, Indonesia, Bulgaria, Mexico, and Poland confirm the highest rate of domestically hosted systems running unsafe services.

Beware of ElasticSearch and MongoDB. Firms that expose these services to the internet have a 4x to 5x higher rate of severe security findings than those who do not run on internet-facing hosts.

 • Unsafe services uncover other security issues. Failing to patch software and implement web encryption are two of the most prevalent security findings associated with unsafe services.

Following education, the sectors exposing unsafe services include agriculture (nearly 46%), hospitality (nearly 44%), and manufacturing (43%).

This research should help organizations struggling under pressure to conduct exhaustive and time-consuming security assessments of their external business partners, noted Jay Jacobs, partner and co-founder of Cyentia Institute.

"Similar to how medical doctors diagnose illnesses through various outward signs exhibited by their patients, third-party risk programs can perform quick, reliable diagnostics to identify underlying cybersecurity ailments,'' Jacobs said in a statement. "Not only is the presence of unsafe network services a problem in itself, but the data we examined in this report also shows that they're a symptom of broader problems."

Also see