Information security continues to grow more complex, and 2013 will be no exception. Security personnel must evaluate their current security measures and develop action plans to tighten defenses and prepare them for the coming threats, or become victim to the payload.
Security officers educating those who are less aware of security issues around emerging technologies, such as mobile devices, will help raise awareness for those who have misinterpreted the lack of “I Love You” or other global viral events in recent years to indicate a declining risk of cyberattack. Assumptions of being amply secured will come back to bite you…it always has. Companies must continue to be proactive. Network security is 24×7 because those are the hours that hackers work.
In the end, additional threat techniques will be added to the cybercriminal’s arsenal. Some represent new ways of conducting an attack, while most will be used as one part of a multi-stage, blended attack.
For a more comprehensive review of your current security posture and your state of preparedness for future attacks, we recommend performing a security threat assessment. You’ll find that an attack can be stopped at any stage, and a comprehensive defense plan will ensure measures are in place to address an attack at every stage. We can help, so please reach out to us.
2012 began with a report from IDC stating “Signature based tools (anti-virus, firewalls and intrusion prevention) are only effective against 30-50 percent of current security threats. Customers expect the effectiveness of signature-based security to continue to decline rapidly.” Much of this can be attributed to how attacks have evolved to specifically counter those defenses. To address this exposure, IDC recommended that organizations consider “a shift in security posture toward being more proactive.”
As 2012 comes to a close, IDC’s recommendation still holds true. A more proactive security posture requires advanced planning for the threats to come in the new year. After careful analysis of technology, security intelligence and threat trends, they produced the following seven predictions you can use to review current defenses, identify security gaps and prepare new safeguards.
1 – Attacks will continue to exploit legitimate web platforms. This includes hundreds of new content management systems and service platforms, in addition to the IIS and Apache exploits of the past.
2 – More cross-platform threats will involve mobile devices. More than mobile-threat hype, there are specific emerging desktop, cloud and other technologies that will add to this growth.
3 – Legitimate mobile app stores will host more malware. The success of mobile devices, the mobile app sales model and the pure volume of apps are creating a new area of risk.
4 – Successful “hacktivism” incidents will decrease. Increased awareness, and the resulting improvements in defensive measures, will result in fewer successful hacktivism incidents, although attacks will increase in sophistication.
5 – Government-sponsored attacks will increase. In the wake of several public cyberwarfare events, a number of contributing factors will drive more countries toward cyberwarfare strategies and tactics.
6 – Threats will become more “virtual aware.” As network and security vendors apply virtual machines for applications, servers and sandboxing, cybercriminals will customize their threats accordingly.
7 – Email threats will evolve to new levels. Domain generation algorithms and other emerging techniques bypass current security, and professionals are becoming the preferred targets. And malicious email attachments are making a comeback.
Overall, the sheer volume of attacks will continue to increase even while the average incident size declines.
We have our work cut out for us in 2013.
