It’s December 2010, which means it’s now open season for making 2011 predictions related to information security trends, risks and dynamics. My thoughts on 2011 are tied to the areas I’ve been digging into lately: social engineering, social networking and cloud computing:

• Attackers will increasingly employ social-engineering tactics to bypass defenses by exploiting natural human predispositions. We’ve seen such approaches persuade victims into clicking on questionable links, opening exploit-laden attachments and installing malicious software. Attackers will continue to take advantage of psychological factors, such as our desire to pay attention personally-relevant messaging, the need to comply with social norms and reliance on security tools. These tactics will merge the line between external and internal threats, because social engineering will allow external attackers to quickly gain an internal vantage point.
• The need to secure social networking interactions will increase, as more organizations  adopt social media as a core aspect of their marketing strategy. They’ll struggle with the need to be active in on-line social communities while balancing compliance and litigation risks associated with such activities. Similarly, organizations will have a hard time controlling on-line social networking activities of their users. Attackers will continue to take advantage of the weak understanding of on-line social networking safety practices to defraud people and organizations. Security vendors will position their products as solving all these problems; some of them will stand out by allowing organizations to granularly control and monitor on-line social networking activities, while being mindful of users’ privacy expectations.
• Many security professionals will come to terms with cloud security risks. They will do so under pressure from the businesses they support, as companies will continue to migrate to cloud platforms. The infosec community will better understand cloud environments, while the technologies implementing cloud platforms will reach an acceptable level of maturity. Security professionals will continue to apply extra scrutiny to scenarios that involve processing sensitive or regulated data in shared cloud environments.

Nothing ground-breaking, I guess. But there’s only so much that can happen in one year.

For more 2011 and 2012 security predictions, take a look at the page maintained by SANS Institute.

— Lenny Zeltser