internet security tHreAt rePOrt GOVernMent 2013

p. 153
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
GOVERNMENT ThREAT ACTIVITy TRENDS
Malicious Activity by Critical Infrastructure Sector
Background
This metric indicates the level to which government and critical
infrastructure organizations may have been compromised and
are being used by attackers as launching pads for malicious
activity. These attacks could potentially expose sensitive and
confidential information, which could have serious ramifications
for government and critical infrastructure organizations. Such
information could be used for strategic purposes in the case of
state- or group-sponsored attacks, especially since attackers who
use compromised computers for malicious activity can mask
their actual location.
Methodology
This metric evaluates the amount of malicious activity
originating from computers and networks that are known to
belong to government and critical infrastructure sectors. To
measure this, Symantec cross-references the IP addresses
of known malicious computers with standard industrial
classification (SIC 1 ) codes that are assigned to each industry and
provided by a third-party service. 2 Symantec has compiled data
on numerous malicious activities that were detected originating
from the IP address space of these organizations. These
activities include bot-infected computers, phishing hosts,
spam zombies, and network attack origins.
Data
Figure e.1 Malicious Activity by Critical Infrastructure Sector
Source: Symantec
Industry Sector
% of CIP Source
Activity
Financial services 72.2% 9.6%
Manufacturing 16.0% 71.5%
Biotech / Pharmaceutical 4.7% 6.0%
Government 2.2% 1.7%
Aerospace 1.9% 7.3%
Government - national 1.2% 0.8%
Government - state 0.9% 0.8%
utilities/energy 0.3% 0.3%
internet service Provider 0.3% 1.7%
telecommunications 0.1% 0.1%
Government - Local