2009 security predictions: Deja vu all over again

The security industry is fueled largely by FUD (fear, uncertainty, doubt.) So it's not unusual for most forecasts in the industry to be full of grim prognostications of imminent chaos and calamities.

By that measure, the predictions contained in several recent security forecasts for 2009 will probably be somewhat of a relief for security managers.

[ Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Most of the security vendors' forecasts predict dramatic spikes in volumes of spam, phishing, botnet activity, and malware targeted at companies. The reports also highlight sharp increases in attacks directed against Web and mobile applications. But the concerns largely deal with issues that security managers are already familiar with, and there are few, if any, really nasty new threats in store around the corner, according to the forecasts.

Like with years past, forecasts are colored by the vendor's specific view of their places in the market. For example, VeriSign, a provider of Internet infrastructure services, predicted increased attacks against critical targets including SCADA (Supervisory Control and Data Acquisition ) systems, which deliver power. Desktop security software vendor Sophos, meanwhile, warned about dramatic increases in malicious e-mail attachments, and huge spikes in spam volume. And Web application security product vendors predicted an increase in Web attacks.

Together the forecasts paint a picture of a threat environment, while not pretty, looks largely like the one this year -- except that it will have more of everything. Among the forecasts were the following:

-- In 2009, more than 80 percent of all malicious content will be hosted on sites with "good" reputations, according to Web app security vendor Websense. Continuing a new trend, attackers will also move to a distributed model for controlling botnets and for hosting malicious code. Such "fast flux" networks allow malicious Web sites to be moved around quickly to make it harder, if not impossible, to locate and shut them down.

-- Phishing attacks against users of social networking sites will become more sophisticated, predicted MessageLabs, which is owned by Symantec. The goal of phishing attacks is to collect as much personal information as possible to allow the sending of highly targeted and sophisticated spam messages. Expect also to see an increase in attacks targeting smartphones, MessageLabs said. Attacks, delivered via free application downloads and games, surfaced this year and will become more malicious.