Security 2012 Outlook: Brace For New Types Of Attacks

Each time enterprises manage to thwart one type of cyber attack, the criminals develop a new strategy. A recently released security forecast from Cisco Systems identifies the new threats to watch out for in 2012. Meanwhile, a security industry education group predicts that salaries for security experts will grow by 4.5% next year as demand for their services grows with the threats.

The Cisco 2011 Annual Security Report, released Dec. 14, identifies both some of the emerging and some of the fading tactics cyber criminals use to hack into enterprise networks to sabotage them or to steal customer and corporate data to make money off of it. Going forward, Cisco sees the rise of what it calls the "mass account compromise," in which phishing attacks are used to compromise some corporate email accounts. Even if the target account is of little value, access to it can be used as a stepping stone to find more high-value targets, said Scott Olechowski, a Cisco security and threat research manager, in discussing the study with reporters. Another emerging threat in 2012 is that of "cloud infrastructure hacking," which Olechowski said should be a concern in both private and public cloud environments.

"We are looking at criminals recognizing that with a single hack the return can be so much greater," Olechowski said. "If you can insert there through a back door and can stay stealthy, the dividends are amazing."

On the decline as threats are botnets, he said, because the biggest of them have been taken down by law enforcement agencies and/or security teams, and first-generation phishing attacks have declined because more people have gotten wise to them. Still, of growing concern are second-generation phishing attacks, also known as spearfishing, in which attackers glean personal information about a target, often from social media sites, and create a personalized email. Victims may be more likely to open such an email and and click on a link in the email, releasing a download of malware onto their computer.

While Cisco says conventional dedicated denial of service (DDoS) attacks are on the wane, networks should still be on guard for application-level DDoS threats, said Marc Gaffan, co-founder of Incapsula, which provides a cloud-based service to shield client websites from cyber attacks through a browser. Gaffan sees malware attacks moving downstream from big high-profile sites such as banks and defense contractors to more mainstream sites.

"At any given point, there are thousands of simultaneous attacks on thousands of websites," he said. "They don’t care if it’s a big or small website; if they can get in, they’ll get in because the cost is so low and the risk is so low." Other security threats continuing in 2012 will be more advanced persistent threats (APTs), malicious internal attacks by employees, and employee misuse and abuse of network assets, according to a report from the security company Lancope.

All of this is the equivalent of an IT Security Professionals Full Employment Act, according to Hord Lipton, executive director of the International Information System Security Certification Consortium, or ISC², a global education and certification organization for IT security professionals. A survey conducted by the staffing firm Robert Half Technology and released by ISC², forecasts that IT security salaries will rise by 4.5% in 2012 to reflect greater demand for their work.

The demand for such professionals will more than double, from 2.2 million people globally today to 4.45 million by 2015, meaning that "candidates looking to enter this field will be a part of one of the most fast-growing and lucrative sectors in today's workforce," Lipton said.

See more on this topic by subscribing to Network Computing Pro Reports Strategy: Security via Compliance (free, registration required).