6th European Conference - Academic Conferences

Muhammad Naveed
Pakistan Computer Emergency Response Team’s list of only reported hacked Pakistani websites
from 1999 to 2005 is available on (PakCert 2005). Statistics of hacked Pakistani websites is shown in
Figure 1. (PakCert 2008) Recently, many important websites of Pakistan were hacked including
website of Supreme Court of Pakistan, Pakistan Navy and lot of others websites of extremely
important organizations. (PakCert, 2005; PakCert, 2008; The Express Tribune, 2010; Jahanzaib,
2010; GEO Pakistan, 2010; DawnNews, 2010)
Figure 1: Statistics of hacked Pakistani websites (only .PK TLD) (PakCert (2008), ‘Defacement
Statistics (January 1999 - August 2008)'’, Pakistan Computer Emergency Response
Team)
Paper is organized as: Section 2 gives the related work, section 3 shows the experimental setup used
for the study, section 4 explains different port states shown by Nmap, section 5 sets the benchmarks
for comparison, section 6 shows the actual analysis of web servers in Pakistan, and section 7
concludes the paper and gives the simple solution to rectify the security problems.
2. Related work
There is very little work done on analyzing information security of Pakistani organizations. To the best
of my knowledge the first study to address the concern about the need of information security in
Pakistan is (Syed 1998) which proposes that it is very important for Pakistan to have both offensive
and defensive Information Warfare capabilities.(Syed 1998)
Vorakulpipat, C. et. al have explored information security practices in Thailand and have emphasized
the need for information security benchmarking of an organization with best security practices.
(Vorakulpipat, C 2010) Ahmad A. Abu-Musa has conducted a survey to evaluate Computerized
Accounting Information Systems security controls in Saudi organizations. (Ahmad 2006) Rafael et. al
have performed a survey to analyze Canadian IT security practices. Three hundred IT security
specialists were the subject of the survey to evaluate the Canadian IT security practices. (Rafael
2009) Australian Taxation Office conducted a review of information security practices at the Australian
Tax Office, to prevent any potential breach of data. (Australian Taxation Office 2008) US
Environmental Protection Agency have conducted an audit to determine whether the Office of
Administration’s (OARM’s) Integrated Contract Management System (ICMS) is complying with
Federal and Agency information system security requirements. (United States Environmental
Protection Agency 2006)
The related work shows that where other people are concerned about their already secure
information systems and is working to avoid any potential attack, Pakistani organizations are not
189