Security: Fast and Furious

Computerworld - Most information technology managers have already devoted long hours to shoring up their companies' security -- and they can expect more of the same in 2006. Attacks will likely come faster and with less warning, and experts predict that there will be attempts against a new range of applications and devices.

"You've got to be prepared for attacks coming from any direction," particularly because of the emergence of spyware, says Patrick Spampinato, IT director at a manufacturer of medical equipment in North Carolina that he asked not be named. "I think there are so many more ways that [intrusions] can affect you."

Bolstering security will clearly be a top job for CIOs and business executives. In fact, in an exclusive Computerworld survey of more than 300 IT executives, security initiatives ranked above all other project priorities for 2006.

Some experts predict that security threats will multiply in the coming year, as more hackers become proficient at breaking into systems and networks, and as viruses and worms spread more rapidly over the Internet.

In the past, security managers had three or four weeks from the time a vulnerability was first discovered until the first attacks exploiting that vulnerability would occur. But with more sophisticated hacking and virus writing, the time has shrunk to less than a week, Spampinato says.

The increasing threat isn't going unnoticed. A survey of 133 North American organizations conducted in 2005 by research firm Gartner Inc. showed that organizations are more concerned about viruses and worms than they are about any other security threat.

Next on the list of concerns was outside hacking or cracking, followed by identity theft and phishing. Half of the survey participants said they increased IT security spending for 2005 and expected to do so again in 2006.

The New Breed
Paul Stamp, an analyst at Forrester Research Inc. in Cambridge, Mass., says he expects to see the emergence of viruses aimed at instant messaging applications and mobile devices, as well as "cross-platform" viruses that can affect a wide range of systems. He also predicts that there will be more attacks aimed at service-oriented architectures as they become more commonplace.

Some attacks will involve a complex combination of social engineering, a breakdown in processes, technical vulnerabilities and insider abuse, Stamp says. The best bets for thwarting those attacks include efforts to better monitor employees' activity and enforce security policies more stringently.

"Users aren't always aware of the threats they are subject to," Stamp says, so education will still be the most effective defense. Spampinato agrees, noting that education at the user level is a huge deterrent to security breaches.