The SANS Institute, which operates the GIAC security certification program, released updates to its Top 20 Internet Security Vulnerabilities last week. Although there were a couple of fairly predictable threats—such as continued discoveries of zero-day vulnerabilities in Internet Explorer—there were a few major surprises on the list as well.
One of these revelations included a spike on attacks on database technologies such as access systems, warehouses and back-up. Notably, these include Oracle, Veritas and SQL Injection. “The most interesting of those is the back-up attacks, because you only back up your most sensitive information,” said Alan Paller, the SANS Institute’s director of research. “If you have a back-up system where you haven’t encrypted the data and the back-up system is vulnerable, you’re basically posting all of your most sensitive data on the Internet, where everybody can get to it.”
All of this points to a new trend of attacking the data instead of the system, he added. “None of those alone would have been a pattern, but all of these together show that they’re going after the data. Most of the attacks you saw for a long time were system attacks or user attacks—viruses that were downloaded through a user opening an attachment. The new ones have three different dimensions to them. It looks like it’s just an efficiency thing on the part of the attackers because ultimately there’s high value in the data.”
Another disconcerting trend was the rise of so-called spear-phishing, or highly…
Please log in or subscribe to read this article