McAfee Avert Labs recently published its Top Ten Security Threat Predictions for 2007.  Six of these predictions–and my comments–follow in no particular order.

  • The underground vulnerabilities market will continue to drive an increase in the number of vulnerabilities discovered.  This financially driven increase cooincides with the growing number of criminals who have switched from “just playing around” to seeing their system cracking activities as a business opportunity.
  • The volume of spam, led by image spam, will continue to grow.  This is coupled with anti-spam vendors scrambling to figure out how to deal with this type of message.  Even multiple layers of spam protection can’t seem to stop messages hidden in graphics.
  • The use of bots to create armies of attack platforms is expected to increase.  The lure of financial gain realized by “leasing” criminal services is encourging malicious hackers to turn to bots.  Once a large bot cluster, or army, is created the army controller can use the compromised systems to send spam, launch attacks, or simply gather information from the networks to which the systems are attached.
  • The use of rootkits will increase.  In the past, malicious hackers wated to be noticed.  They were playing a game that required peer recognition.  Today the rules have changed.  With financial gain as the primary objective, attackers do not want the owners of compromised systems to know they have gained a foothold.  So rootkits have become the preferred method of dropping malware in unsuspecting enterprises.  On a positive note, the ability of anti-malware applications to detect rootkits is also expected to improve.
  • Phishing through the use of password-stealing web sites will increase.  Falsely representing financial institutions continues to be the primary attack vector, with the United States having the lead in the number of attacks orginating in a specific country. (http://antiphishing.org/)
  • Identity theft and data loss will continue to be an issue.  Organizations must take steps to protect information on portable storage devices, including laptops, iPods, PDA’s, and smartphones.

I chose these six predictions because they all have something in common–profit motive.  The trend toward creating business modes around malicious hacking continues.  As we move through the next few years, I believe the amount of money to be made by compromising networks, individual systems, and personal identity will attact an ever increasing number or cyber-criminals.

How is this change in criminal hacker focus affecting your business security roadmap?