I’ve been really enjoying darkreading as of the last couple of months and their recent article on Security’s Top Five Priorities is no exception. It’s also good that they mention that their recent findings are different from similar research they performed not more than five months ago. This is a clear sign of how volatile this industry is, and I guess why I find it so interesting.

In short their top 5 priorities are as follows:

1. Portable Devices leading to unauthorised information disclosure OR malware introduction
2. Web application security, especially as these are becoming ubiquitous and often slip through firewalls and IDS without too many problems
3. Security leaks and insider attacks, good examples of how the old “egg-shell” paradigm just does not cut it these days, you can’t just install firewalls to block the Internet when you give your 100+ inside employees access to sensitive information without controls. This problem also steps outside the boundaries of technology which is quite nice.
4. Endpoint security. This can mean so many different things but this article is talking directly about Network Admission/Access Control
5. Botnets

Personally I’m surprised that Botnets made it into the list over something like compliance or security awareness training (read social engineering), but their sample base is probably quite varied and I guess a lot of ISP/Marketing type companies might rate Botnet threats quite high compared to other issues.

I also find it interesting how some of the items are so closely related, in particular portable devices, endpoint security and insider threats. These three threats, in many cases, would not exist without the other. A good example is software which may be used to place controls around authorised USB memory stick access, directly related to portable device security but also acting as an end-point control usually trying to minimise the likelihood of an insider taking away sensitive information. This is of course referring to end point security which is not directly network access based.

Another interesting point is how their results differ slightly from the most critical issues that were highlighted in the 2006 CSI/FBI Computer Security Survey, being:

1. Data Protection, including classification, identification, protection and application software vulnerability security
2. Policy and regulatory compliance
3. Identity theft and leakage of private information
4. Viruses and worms
5. Management involvement, risk management, or supportive resources such as HR