The door is closing on 2012, and it's time to look ahead to next year. As you round out your 2013 business and IT plans, cybercriminals are resolving to implement increasingly sophisticated threats targeting specific computer systems and organizations both big and small.

In the past year, businesses have seen several serious hacks and breaches. And as the arms race between attackers and businesses continues to evolve in 2013, IT departments and security professionals will need to stay on top of the changing tactics and approaches used by criminal hackers in order to protect their organizations. Here's our take on what security threats and trends we expect to see in the coming year:

Threat #1: Social engineering

Before the computer age, this meant sneaking one's way past a company's defenses with the gift of talk, as opposed to a cleverly-worded email. Now social engineering has moved onto social networks, including Facebook and LinkedIn.

Attackers are increasing their use of social engineering, which goes beyond calling targeted employees and trying to trick them into giving up information. In years past, they might call a receptionist and ask to be transferred to a targeted employee so that the call appears to be coming from within the enterprise if caller ID is being used.


However, such tactics aren't needed if the details the cybercriminal is looking for are already posted on social networks. After all, social networks are about connecting people, and a convincing-looking profile of a company or person followed by a friend or connection request can be enough to get a social engineering scam rolling.

Threat #2: APTs

Being aware of social engineering is important, of course, because it can be the precursor for a sophisticated attack meant to breach the wall of your organization. This year saw a number of high-profile attacks (think: Gauss and Flame) targeting both corporations and governments. The intention behind these APT attacks is to gain access to a network and steal information quietly. They take a low-and-slow approach that often makes them difficult to detect, giving them a high likelihood of success.

Additionally, APTs need not always target well-known programs, such as Microsoft Word; they may also target other vectors, such as embedded systems. In a world where a growing number of devices have Internet protocol addresses, building security into these systems has never been more important.

APTs will continue as governments and other well-funded organizations look to cyber-space to conduct their espionage. In fact, APT attacks are running as we speak so look out for those anomalies in your network traffic.