Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 10/06/08 issue

Clear and present dangers

Four key categories of cyberthreats will likely dominate the security landscape during the next year

By William Jackson

Identifying the most serious cybersecurity threats is an inexact science. How do you measure just how bad something potentially is, and how can you be sure it will still be important tomorrow?

Lists of top threats change almost daily as vulnerabilities and exploits come and go, and others turn out to be surprisingly resilient. Who would have guessed when the Storm worm first appeared in early 2007 that it would be so persistent? And you might have thought that we learned our lesson a decade ago about e-mail messages with “I love you” in the subject line, but this social-engineering trick still works today.

However, there are a handful of techniques — with a lot of overlap and interrelationships — for exploiting systemic weaknesses in the information technology environment that can broadly define the threat landscape. They include:

BOTNETS AND ORGANIZED EXPLOITS. The phenomenon of organizing compromised computers into a network that can be used for nefarious purposes has been around for years, but it is becoming an increasingly powerful platform responsible for a growing variety of attacks. “Botnets are very much the Swiss Army knife of online miscreants,” said Zulfikar Ramzan, technical director at Symantec Security Technology and Response.

WEB SITE AND WEB APPLICATION EXPLOITS. According to one recent study, as many as 82 percent of Web sites have at least one security weakness. This is linked to the botnet phenomenon. Some experts blame the augmentation of Structured Query Language injection vulnerabilities for the apparent rapid growth in botnets in recent months. SQL injection is a form of attack on a database-driven Web site in which the attacker executes unauthorized SQL commands by taking advantage of insecure code on a system connected to the Internet, bypassing the firewall. One out of every three vulnerabilities reported in the second quarter of 2008 was a SQL injection, said Tom Stracener, senior security analyst at the Cenzic Intelligent Analysis Lab. “There is a tremendous focus on it in the research community,” he said.

More news on related topics: Communications / Networks, IT Security, IT Management