The document discusses top IT security trends from 2011-2012, including the Flame and Gauss malware attacks, issues with the Conficker worm, and hacks on US water systems and Google's Android market. It covers how bring your own device (BYOD) policies will impact security and the growing challenges around identity, privacy and hyper-connectivity. The document also discusses how security risks will need to be properly assessed and managed for public and private clouds, and the role of IPv6 and next generation border gateway protocol and DNS. It emphasizes that security budgets need to be spent wisely and the importance of security partners going forward.
8. Šta se dešavalo u 2012 - Flame worm
Flame malware - The biggest? The baddest? Costs over 100 M$
Once a system is infected, Flame begins a
complex set of operations, including sniffing the
network traffic, taking screenshots, recording
audio conversations, intercepting the keyboard,
and so on. All this data is available to the
operators through the link to Flame’s
command-and-control servers. 20 MB Maj 2012
10. Šta se dešavalo u 2012 – Gauss Trojan
State-sponsored Trojan 'Gauss' targets Lebanese banks and user details
Named ‘Gauss', it claimed that
this is a complex, nation-state
sponsored cyber espionage
toolkit and its online banking
Trojan functionality has not been
found in any previously known
cyber weapons. Avg 2012
11. Šta se dešavalo u 2012 – Mini Flame
MiniFlame is different from Flame
and Gauss in that the number of
infections is significantly smaller.
While we estimate the total number
of Flame/Gauss victims at no less
than 10,000 systems, MiniFlame has
been detected in just a few dozen
systems in Western Asia. 16.
October
13. Did Chinese hackers access the White House's
nuclear secrets?
Failure of the Obama administration to press China on its
persistent cyber attacks.
The official said: “In this instance the attack was identified,
the system was isolated, and there is no indication
whatsoever that any exfiltration of data took place.”
14. Šta se dešavalo u 2012
SCADA-based water system hacked in USA
• 21.11.2011 Reports emerged at the end of last
week that a SCADA-based water system in the
US had been hacked.
• Blog posts confirm that "there was damage – the
SCADA system was powered on and off, burning
out a water pump".
• Location - in Springfield, Illinois
15. Šta se dešavalo u 2012 - Conficker worm is still
actively infecting users
Microsoft announced a $250,000 reward for information that
resulted in the arrest and conviction of those responsible for the
Conficker malware in 2009
Conficker worm first appeared on 21st November 2008
16. Šta se dešavalo u 2012
More malware found hosted in Google's official Android
market
Android.Dropdialer, a trojan that racks up costly charges from
forced calls made to premium phone numbers
17. ŠTA ĆE BITI OBAVEZA IT MENADŽERA U
NAREDNOM PERIODU
20. BYOD definitions
BYOD is short for bring your own device.
Bring Your Own Device (BYOD) describes the recent trend of
employees bringing personally‐owned mobile devices, such
as smartphones, laptops and PDAs, to their place of work,
and using those devices to access privileged company
resources such as email, file servers, and database
21. Bring Your Own Device - BYOD
always‐on, always‐connected gives way to "hyperconneted„
Mobile malware is on the rise ‐ Malware targeting mobile
devices will continue to increase, and enterprises will wrestle
with how to protect users. Obvious targets will be
smartphones and tablets.
By 2018, 70% of mobile professionals will conduct all of their
work on personal smart devices.
22.
23. Hyper-connectivity leads to growing identity and
privacy challenges
In today’s business
environment, more users
need to legitimately access
more data from more places.
The IAM Market Evolution to
Cloud Computing ‐ By the
end of 2014, IDaaS will
account for 25% of all new
IAM sales, compared with less
than 5% in 2012.
24. New concerns will surface about IPv6
In future, many operations
will start migrating to these
newer versions, generating a
new round of vulnerabilities
and exploits.
In addition, the other two
fundamental mechanisms of
the Internet ‐‐ border
gateway protocol and domain
name system (DNS) ‐‐ also
now offer a next‐generation
version.
25. Information Security Risk Assessment
This risk management will
explore each phase of the IT
security risk management
lifecycle, focusing on techniques
that should be used to properly
identify, articulate, assess,
mitigate, and report on
information risk.
26. Big Data will get bigger, and so will security needs
