Tech Insight: Six Security Threats You Need To Know About

Security professionals were inundated with new attacks -- and even some old ones were given new life -- in 2010. We saw Adobe Acrobat and Flash became the No. 1 target of malware and penetration testers as new zero-day vulnerabilities were discovered and left unpatched for weeks, even months in some organizations.

On top of the everyday problems that security pros face, there was a huge uptick in malware that seemed to be coming at us from all directions. According to a report from Panda Security, 2010 was responsible for more than one-third of all known malware.

Many of the attacks that were discovered, as well as those that resurfaced, are likely to be around for a while as we move into 2011. Whether they will be a concern for your organization is something best left to a proper risk assessment; some might not be applicable. For example, if your computers are not connected to the Internet and USB flash drives are not allowed, then it's highly unlikely malware looking to steal online banking credentials will be an issue.

Following is a list of issues security pros should expect to face this year. The material comes from my recent presentation at "Bad Guys, Governance, And Other Things That Keep You Awake At Night," an InformationWeek and Dark Reading event in Washington, D.C., and New York.

1. Governance
Governance is a threat to both the sanity and effectiveness of nearly every security professional. It can be a silent killer to the best-planned security program when C-level executives do not back up the security efforts because they don't understand where their data is and what needs to be done to secure it. Effective communication of business risks and how to reduce that risk without impacting the bottom line too much is key.

2. Malware
We all know that malware, in general, is a problem. Targeted malware, however, has been on the rise for a couple of years, and Stuxnet finally brought that reality home for many. Unfortunately, malware can infiltrate a network in many different ways; it requires diligence and understanding on the part of the security pro to fight it at every level and handle the politics of putting protections in place that limit what employees can do.

3. Social Networks
Social networks are a double-edged sword that allow security pros to stay up on the latest information through sites like Twitter, yet provide an avenue of easy attack to users who are willing to click on every link they receive. In addition to malware, there's the problem with accidental disclosure of important details, like we've seen with the military through Facebook and politicians using Twitter. Having a current and well-defined policy is key, but so is regular awareness to users on what issues social networks can pose to both themselves and their employer.

Next: The return of DLL hijacking.