Threat #5: Cloud security
BYOD is not the only thing changing the walls corporations must build around critical data however. There is also this little trend called cloud computing. With more companies putting more information in public cloud services, those services become juicy targets, and can represent a single point of failure for the enterprise. For businesses, this means that security must continue to be an important part of the conversation they have with cloud providers, and the needs of the business should be made clear.
Threat #6: HTML5
Just as the adoption of cloud computing has changed the vulnerability surface, so will the adoption of HTML5. Earlier this year, it was noted at the Black Hat conference, a place where security pros can get a sign of attacks to come, that HTML5's cross-platform support and integration of various technologies opens up new possibilities for attack, such as abusing Web Worker functionality.
Even with an increasing amount of attention being paid to HTML5 security, the newness of it means that developers are bound to make mistakes as they use it, and attackers will look to take advantage. Expect to see a surge in HTML 5 oriented attacks next year, hopefully followed by a gradual decline as security improves over time.
Threat #7: Botnets
But even though the arms race between researchers and attackers favors innovation, expect cybercriminals to spend a lot of time perfecting what they know best, such as making sure their botnets have high availability and are distributed. While the legal takedowns being launched by companies such as Microsoft succeeded in temporarily disrupting spam and malware operations, it is naïve to assume attackers aren’t taking what they have learned from those takedowns and using it to shore up their operations. Botnets are here to stay.
Threat #8: Precision targeted malware
Attackers are also learning from the steps researchers are taking to analyze their malware, and techniques were recently demonstrated that can help render analysis ineffective by designing malware that will fail to execute correctly on any environment other than the one originally targeted. Examples of these attacks include Flashback and Gauss. Both have been successful, especially Gauss, at stopping researchers from automated malware analysis. In the coming year, attackers will continue to improve and implement these techniques and make their malware more dedicated so that it only attacks computers with a specific configuration.
One thing is for certain – 2013 is sure to bring an army of exploits and malware through vectors ranging from social networks to mobile devices to employees themselves. As computer and operating system security continues to improve so will cybercriminals’ new techniques to bypass these defenses. Security is definitely one New Year’s resolution to try and keep.