Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

3/28/2012
07:27 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Information Security Forum Launches Threat Horizon 2014

Report challenges the traditional approach to managing security risks

NEW YORK – March 28, 2012 –– The range and complexity of information security threats is set to rise significantly over the next two years and organizations that fail to prepare now will struggle to handle the challenges later. This forecast is according to Threat Horizon 2014: Managing Risks When Threats Collide, the latest in a series of Threat Horizon reports from the Information Security Forum (ISF), a global, independent information security body considered the world's leading authority on cyber security and information risk management.

The report challenges the traditional approach to managing security risks, which has typically fallen to the information security function, and recommends that organizations take a much more strategic and business-based approach to risk management. To take advantage of both technology and cyberspace, organizations must manage new risks beyond those traditionally covered by the information security function, including attacks on reputation and all manner of technology.

“While individual threats will continue to pose a risk, there is even more danger when they combine, such as when organized criminals adopt techniques developed by online activists,” said Steve Durbin, Global Vice President, ISF. “Traditional risk management is insufficiently agile to deal with the potential impacts from activity in cyberspace. While executives recognize the benefits and opportunities cyberspace offers, their organizations must extend risk management to become more resilient, based on a foundation of preparedness. We are advising our members that this is the year of resilience and to be prepared to move at the speed of a Tweet!”

Threat Horizon 2014 provides a practical place for organizations to start by providing a forward-looking view of the increasing threats in today’s interconnected, always-on world. This in turn enables a better prepared, strategic approach to managing and mitigating security risks.

The report identifies three main drivers and provides organizations with practical guidance on how to deal with increasingly complex threats including:

· External threats that come from the increasing sophistication of cybercrime, state-sponsored espionage, activism moving online, and attacks on systems that have a physical impact in the real world, for example industrial control systems

· Regulatory threats that come as regulators call for greater transparency about incidents and security preparedness, while increasing requirements for data privacy

· Internal threats that come as technology introduces new benefits at a relentless pace and the business adopts them without fully understanding the risks.

The report also highlights 10 predictions under each of the three threat groups, along with the potential business impacts, and provides recommended actions at the end of each one:

External Threats

· Cyber criminality increases as Malspace matures

· The cyber arms race leads to a cyber cold war

· More causes come online; activists get more active

· Cyberspace gets physical

Regulatory Threats

· New requirements shine a light in dark corners exposing weaknesses

· A focus on privacy distracts from other security efforts

Internal Threats

· Cost pressures stifle critical investment

· A clouded understanding leads to an outsourced mess

· New technologies overwhelm

· The supply chain springs a leak as the insider threat comes from outside

ISF’s Durbin adds: “From cyber to insider, organizations have varying degrees of control over evolving security threats. With the speed and complexity of the threat landscape changing on an almost daily basis, we are seeing businesses being left behind, sometimes in the wake of reputational and financial damage – they need to take stock now to ensure they are fully prepared and engaged.”

Threat Horizon 2014

The ISF Threat Horizon series of reports is aimed at both senior business audiences and information security professionals. These annual reports are designed to help organizations take a proactive stance to security risks by highlighting challenges in the threat landscape and identifying how the confidentiality, integrity and availability of information may be compromised in the future.

Threat Horizon 2014 contains detailed predictions along with trends and other factors that can increase or decrease the probability of the predictions coming true. An executive summary of the report is available from ISF’s website www.securityforum.org. The full report will be available to non-Members for purchase from the ISF’s online store beginning on May 1 and can be pre-ordered now at: https://store.securityforum.org/shop/.

Information Security Forum (ISF)

Founded in 1989, the Information Security Forum (ISF) is an independent, not-for-profit association of leading organisations from around the world. It is dedicated to investigating, clarifying and resolving key issues in cyber, information security and risk management and developing best practice methodologies, processes and solutions that meet the business needs of its Members.

ISF Members benefit from harnessing and sharing in-depth knowledge and practical experience drawn from within their organisations and developed through an extensive research and work program. The ISF provides a confidential forum and framework, which ensures that Members adopt leading-edge information security strategies and solutions. And by working together, Members avoid the major expenditure required to reach the same goals on their own.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27132
PUBLISHED: 2021-02-27
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header.
CVE-2021-25284
PUBLISHED: 2021-02-27
An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.
CVE-2021-3144
PUBLISHED: 2021-02-27
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
CVE-2021-3148
PUBLISHED: 2021-02-27
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
CVE-2021-3151
PUBLISHED: 2021-02-27
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS) issues that could allow remote authenticated attackers to inject arbitrary web script or HTML via C__MONITORING__CONFIG__TITLE, SM2__C__MONITORING__CONFIG__TITLE, C__MONITORING__CONFIG__PATH, SM2__C__MONITORING__CONFIG__PATH, C__M...