Newsletters
Customer Relationship Management News NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home CRM Systems Customer Service Contact Centers Business Intelligence More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Tech Trends
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
IBM X-Force Trend and Risk Report Offers More Good Security News than Bad

IBM X-Force Trend and Risk Report Offers More Good Security News than Bad
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

"Computer Security is getting better. We're seeing less exploit code getting released on the Internet. We're seeing the quality of software improve. We're seeing software vendors get more diligent about patching security vulnerabilities," said Tom Cross on IBM's X-Force 2011 Trends and Risk Report.
 


IBM on Thursday released the results of its X-Force 2011 Trend and Risk Report -- and there is some good news and some bad news.

First the good news. The X-Force 2011 Trend and Risk Report revealed a 50 percent decline in spam e-mail compared with 2010, more diligent patching of security vulnerabilities by software vendors, and higher quality of software application code. However, attackers have countered with an increase in automated shell command injection attacks against Web servers.

"The most surprising result to me has been the two- to three-fold increase in shell command injection attacks. I would not have predicted that particular attack vector would grow so much in popularity at this stage of the game," said Tom Cross, manager of Threat Intelligence and Strategy for IBM X-Force.

"X-Force believes that this activity may be an adaptation to the fact that Web site operators are working to fix SQL Injection vulnerabilities and may be missing shell command issues that are also lurking within their Web applications."

A Mixed Bag of News

For years, SQL injection attacks against Web applications have been a popular vector for attackers of all types, IBM said. SQL injection vulnerabilities allow an attacker to manipulate the database behind a Web site.

As progress has been made to close those vulnerabilities, IBM reports some attackers have now started to target shell command injection vulnerabilities instead. These vulnerabilities allow the attacker to execute commands directly on a Web server. IBM said Web application developers should pay close attention to this increasingly popular attack vector.

Back to the good news. There was a 39 percent decline in the availability of exploit code. And although some security vulnerabilities are never patched, in 2011 this number was down to 36 percent from 43 percent in 2010. IBM also witnessed a 50 percent reduction in cross-site scripting (XSS) vulnerabilities due to improvements in software quality.

"Computer Security is getting better. We're seeing less exploit code getting released on the Internet. We're seeing the quality of software improve. We're seeing software vendors get more diligent about patching security vulnerabilities," Cross said.

"We've still got a lot of work to do. There are still many vulnerabilities out there and attackers are taking advantage of them, but our statistics show that progress is being made -- all of the work that is going on to make software more resilient is making a difference."

Cloud Computing Challenges

The IBM X-Force team also looked at new challenges associated with cloud computing. Cloud computing is moving rapidly from emerging to mainstream technology, and rapid growth is expected through the end of 2013, according to IBM.

X-Force pointed to the many high-profile cloud breaches affecting well-known organizations and large populations of their customers in 2011 and said IT security staff should carefully consider which workloads are sent to third-party cloud providers and what should be kept in-house due to the sensitivity of data.

"Many cloud customers using a service worry about the security of the technology. Depending upon the type of cloud deployment, most, if not all, of the technology is outside of the customer's control," said Ryan Berg, an IBM security cloud strategist. "They should focus on information security requirements of the data destined for the cloud, and through due diligence, make certain their cloud provider has the capability to adequately secure the workload."

To view the full X-Force 2011 Trend and Risk Report and watch a highlight video, visit www.ibm.com/security/xforce.
 

Tell Us What You Think
Comment:

Name:

Al:

Posted: 2012-04-05 @ 11:15am PT
It sure would be nice to have a LINK TO THE REPORT.



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Tech Trends
1.   Best Buy Leaks Moto 360 Watch Info
2.   Google IPO Began Decade of Big Bets
3.   Samsung Buys SmartThings
4.   Lenovo Profit Up on Mobile Growth
5.   Apple Diversity: A Long Way To Go


advertisement
Online Retailers Ponder Actual Stores
'Click-and-mortar' shops popping up.
Average Rating:
Google IPO Began Decade of Big Bets
And Larry Page wants to push further.
Average Rating:
Samsung Buys SmartThings
To allow people, appliances to interact.
Average Rating:


advertisement
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
UPS Stores in 24 States Hit by Data Breach
Big Brown has been breached. UPS said that about 105,000 customer transactions at 51 of its UPS Store locations in 24 states could have been compromised between January and August.
 
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 

Enterprise Hardware Spotlight
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 
Compression, Deduplication Come to Violin Concerto 2200
Violin Memory has announced that data deduplication and compression capabilities are now available on its Concerto 2200 solution. Typically, users will experience deduplication rates between 6:1 and 10:1.
 

Mobile Technology Spotlight
Apple Stock Soars Ahead of iPhone 6 Launch
The imminent release of the iPhone 6 -- and maybe even an iWatch -- has sent Apple's stock soaring to new heights. Considering what else the firm could have up its sleeve -- the stratosphere may be the limit.
 
HTC Debuts Windows Phone Version of One M8 Smartphone
HTC is bringing the Windows Phone mobile OS to its flagship One M8 device -- the first time any mainstream flagship smartphone has been offered with a choice of operating systems.
 
Verizon Earns Top Rating in Mobile Network Comparison
A new report says Verizon Wireless was the top-performing U.S. cellphone service provider in the first half of 2014, on a nationwide and state-by-state basis, as well as in metro areas.
 

Navigation
CRM Daily
Home/Top News | CRM Systems | Customer Service | Contact Centers | Business Intelligence | Sales & Marketing | Customer Data | CRM Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.