By Jill Knesek, Chief Security Officer, BT Global Services

In the last few weeks, a number of security companies have released their year-end security intelligence threat reports that highlight the biggest vulnerabilities of 2009 and, in some cases, offering signposts for what are likely to be the top threats in 2010.

Based on what I’ve read in these reports, as well as what I see as head of BT’s global security team, these are my thoughts on what will give us headaches in the coming year:

1. Security Breaches – Social Media – This is clearly the hot topic for this year.  Now that it’s clear that social media can be monetized, and businesses are joining Facebook and Twitter in droves, it was only a matter of time before the opportunists, social engineers and hackers began to work out exploits from which they could profit – including shortened URL scams.  However, just because social media is ripe for exploitation doesn’t mean your company should abandon the space.  Instead, focus on at-work user education policies on how to spot fake URLs, as well as review policy on permissions.  Does everyone really need access to Facebook and YouTube at work — or should access be limited by job description or role?  With your IT team, make sure to review patching protocols to ensure your network is robust enough to survive common worms, such as Koobface.
2. Botnets – A perennial favorite, botnets continue to make the top vulnerability lists because they continue to proliferate at an alarming rate due to the potential for economic gain.  With organized criminals firmly in control of a number of significant botnets, IT security professionals need to become more savvy — not just about detection, but also about knowing where their sensitive data is housed.  As we saw in the Heartland case, not knowing where your data is nor if it has been compromised can make the difference between a minor internal breach and a public relations nightmare. 
3. Mobile Device Security – It doesn’t matter how smart phones are, people still leave them in a New York City cab, and hackers find ways to access data stored or exchanged on devices.  So, as phones become smarter, they introduce increasing risk into the IT equation.  The more capable these devices are to help employees access and manipulate data, the more capable they are to be used by hackers to do the same.  Unfortunately, far too many organizations fail to manage their mobile security risks, or the devices, for that matter.  The first step organizations need to make is to take control over the devices by providing staff with a uniform device or set of devices.  Just keep in mind that some devices are created for general consumers, while others have been developed for enterprises with security controls, such as requiring authorization and limiting apps.  
4. Remote Access – It also doesn’t matter if employees are traveling to Cleveland or China, or working from home — remote access to networks and data is challenging and must be addressed.
5. The Absent-Minded Employee – With the economy beginning to pick up, there is less likelihood that your company is dealing with a deliberately malicious employee bent on stealing data or disabling your network as he’s being given his pink slip.  However, with most companies still facing hiring and resource freezes, there’s ample opportunity for very costly mistakes to occur due to under-investments in user education and overburdened employees — from the improperly trained employees to the ones who have one too many tasks on their plates and forget to change a password — or worse still, writes the password down next to their computer.  Now is the time to refresh or startup a Security Awareness and Training program with mandatory training requirements as well as communication of security messages that educate the employee-base on current threats they are likely to encounter.  In addition, it is also a good time to review policy and procedures with all employees and to review core responsibilities with your IT Security team.
6. Data Loss Prevention – As BT’s Ben Rothke has previously stated, the sound of confidential data escaping from enterprises can be deafening.  DLP is imperative for today’s mobile work environment, and of course, it is the very mobility of the workforce which has increased data leakage risk beyond imagination.  Organizations must educate employees on how to use mobile devices safely and securely as well as pay serious attention to how many communication channels the IT and security teams are able to fully support. 

So, will 2010 be filled with more surprises than 2009?  I’m confident that if you prepare for 2010 with a renewed focus on strategic security solutions and on employee education, year you’ll have a successful and safe year.