Skip to content

March 27, 2012

Spam on the Decline, Social Phishing on the Rise

By Marie Lingblom

There are encouraging improvements in several areas of Internet security. At the same time, cyber thieves are adapting tactics and targeting more niche loopholes and emerging technologies such as cloud computing, social networks and mobile devices.

These attackers are behind a rise in emerging trends such as mobile exploits, automated password guessing and a surge in phishing attacks, according to IBM’s X-Force 2011 Trend and Risk Report, released this week.

The good news includes a reduction in application security vulnerabilities, exploit code and spam. For instance, the report revealed a 50 percent decline in spam e-mail compared to 2010. It also shows more diligent patching of security vulnerabilities by software vendors, with only 36 percent of software vulnerabilities remaining unpatched in 2011 compared to 43 percent in 2010.

There’s also a higher quality of software application code, as seen in web-application vulnerabilities called cross site scripting half as likely to exist in clients’ software as they were four years ago. An increase in automated shell command injection attacks against web servers, meanwhile, may be a response to successful efforts to close off other kinds of web application vulnerabilities.

When it comes to newer technologies such as social networks and cloud computing, as well as the increasing use of mobile devices in the enterprise, however, there’s still work to be done.

Cloud computing is moving quickly from emerging to mainstream technology, with rapid growth anticipated through the end of 2013. In 2011, there were many high profile cloud breaches affecting well-known organizations and large populations of their customers.

IT security staff must carefully consider which workloads are sent to third-party cloud providers, and what should be kept in-house due to the sensitivity of data. Cloud security requires foresight on the part of the customer as well as flexibility and skills on the part of the cloud provider.

The IBM X-Force report notes the most effective means for managing security in the cloud may be through Service Level Agreements (SLAs) because of the limited impact an organization can realistically exercise over the cloud computing service. Careful consideration should be given to ownership, access management, governance and termination when crafting SLAs. Cloud customers are encouraged to take a lifecycle view of the cloud deployment, and fully consider the impact to their overall information security posture.

Another rapidly growing target area is social media. IBM X-Force observed a surge particularly in phishing e-mails impersonating social media sites. More sophisticated attackers have also taken notice. The amount of information people are offering in social networks about their personal and professional lives has begun to play a role in pre-attack intelligence gathering for the infiltration of public and private sector computing networks.

Publicly released mobile exploits, meanwhile, rose 19 percent in 2011, according to the IBM report. There are many mobile devices in consumers’ hands that have unpatched vulnerabilities to publicly released exploits, and that creates an opportunity for attackers. IT managers should be prepared to address this risk by way of managing the growing trend of using personal devices in the enterprise.

Among IBM’s recommendations are performing regular security assessments; segmenting sensitive systems and information; training end users about phishing and secure computing principals, as well as examining the policies of business partners.

“As long as attackers profit from cybercrime, organizations should remain diligent in prioritizing and addressing their vulnerabilities,” said Tom Cross, manager of Threat Intelligence Strategy for IBM X-Force.

Comments are closed.