2008 X-Force Trend and Risk report

February 02, 2009 IBM announced the results of its 2008 X-Force Trend and Risk report, which found corporations put their own customers at risk for "cybercriminal activities" by failing to properly defend their servers against identified exploits.

Two main trends were reported in the X-Force report. First, today's websites are the "Achilles' heel" for IT security. This is the culmination of the attacker's desire to infiltrate the website's software to allow their applications to infect end-user machines coupled to the corporations using standard, off-the-shelf applications which have known exploits. According to their report. 74% of the web applications deployed have had no patches applied. And trends show the volume of attacks seen at the end of 2008 were 30x greater than the number of attacks seen early in the summer months.

The second major trend is a switch away from primarily browser defect and ActiveX script attacks to those involving Flash and PDFs. The research recorded a 50% increase in Q4'2008 in the number of URLs that were hosting exploits compared to the sum total from all of 2007. Spammers are also switching to these compromised web-site tactics for an expanded reach.

The X-Force report also records that the number of disclosed critical vulnerabilities did not see widespread exploitation. IBM believes the Common Vulnerability Scoring System (CVSS) used today as an industry-standard rating system for virus threats needs to be overhauled.

Attention to ID Theft?

Two days ago, a 23-year-old Oregon man was sentenced this week to four years in federal prison for using computer viruses to steal financial data from dozens of consumers in U.S. Investigators say the man used the information to set up multiple eBay and PayPal accounts, which helped him sell more than $1 million worth of pirated software. From this news you can see that Keylogger is still a critical threat. According to Javelin Strategy & Research latest Survey, however, the number of US adult victims of identity fraud decreased from 10.1 million in 2003 and 9.3 million in 2005 to 8.4 million in 2007. Total one year fraud amount decreased from $55.7 billion in 2006 to $49.3 billion in 2007. The mean fraud amount per fraud victim decreased from $6,278 in 2006 to $5,720 in 2007. The mean resolution time was at a high of 40 hours per victim in 2006 and was reduced in 2007 to 25 hours per victim. The median resolution time has remained the same for each Survey year at 5 hours per victim.