Attacks/Breaches
12/24/2009
12:06 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Top 10 Security Challenges For 2010

Cloud-hosted malware, bot blasts, compromised smartphones, and privacy-busting malvertising are a few of the security pitfalls we can expect this year.

6. Bots, Bots, And More Bots

Why bother with cloud-hosted malware when botnets offer the same service for less? Even better for cybercriminals, botnets offer a source of income. For security vendors, that suggests bots will continue to become more sophisticated. Botnets have become the foundation of cybercrime, Symantec claims.

Dan Hubbard, CTO of Websense, said that there has been some good news about bots -- better communication in the security community and with law enforcement, resulting in more arrests and botnet takedowns than in the past.

But because botnets generate cash for criminals, he expects more criminal gangs will choose a path to wealth that's easier than building a botnet: hijacking a botnet operated by a different gang.

That kind of conflict could actually limit botnet growth or at least attract the attention of security experts and law enforcement. Contrarian view: Botnets not only have to defend against security researchers, but against other botnet operators. Websense sees botnet gangs fighting turf wars, similar to the way that the Bredolab botnet shut down the Zeus/Zbot on infected computers.

7. Piracy Gets Riskier

In early December, Microsoft launched a broad effort to reduce software piracy, noting that it has received a rising number of complaints from users who purchased or otherwise obtained pirated versions of Windows.

It seems that counterfeit software is increasingly infected software. IBM Internet Security Systems' X-Force researchers expect that use of pirated software will increasingly lead to malware infection and that users of such software will become the "Typhoid Marys" of the global computing community.

Contrarian view: Will the last user of desktop software please turn out the lights? We're all moving into the cloud where we don't have to worry about a counterfeit, infectious version of Google Apps, at least until someone alters our DNS host file.

8. Mobile Security Becomes Real Issue

"Smartphones such as the iPhone and Android-based handsets, which are used increasingly for business purposes, are essentially miniature personal computers, and in 2010 will face the same types of attacks that target traditional computing," predicts Websense. And the company is not alone in that belief. Practically every security vendor has or is developing a mobile security product or service. As with Macs, the security industry would welcome a new market.

Websense's Hubbard says it will be interesting to see how Apple's closed App Store and Google's more open Android Market compare in terms of mobile malware in 2010.

Contrarian view: The researchers at IBM ISS X-Force believe that attacks on mobile phones will remain scarce. But while network-based attacks on mobile phones may remain relatively rare, physical attacks will rise: Snatch-and-grab attacks are considerably easier than cyberattacks and produce both data and a physical item that can be sold. With unemployment over 10%, unsolicited phone collection could become a growth industry.

Previous
3 of 4
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8896
Published: 2014-12-22
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify ...

CVE-2014-8897
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

CVE-2014-8898
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.