SANS today released their latest Top 20 Internet Security Risks.  The launch was held today in London and the report highlights the continuing trend of increasing criminal involvement in cyber attacks and the focus of attacks moving away from networks and operating systems.  Instead the main points of attack are application vulnerabilities, especially in custom built applications, and users that are not security aware.

These two main points of attacks are also increasingly difficult to defend against.  Educating all users in your organisation to be aware of the many different threats will always be a challenge.  And in the end it only takes a small percentage of your user population to go against all the security training and policies that you provide to compromise your network.

Ensuring security is built into custom applications is also a challenge.  Most applications are well into the delivery phase by the time the information security team is asked for their input, which is usually too late to ensure the application is properly secured.  Add on top of that commercial pressures to get systems live and running and you have a challenging environment for even the most seasoned information security pro.

However, we should not give up hope.  Yes the above vectors may be difficult to defend against but it is not impossible.  Ensuring additional layers of protection are deployed, such as firewalls, IDS systems, accurate and up to date anti-virus software and timely patch management will help.  But you should also look into training the end users, your network admins and developers in good security practises.  Finally ensure that you have effective log and network monitoring solutions in place to detect suspicious behaviour backed up by a comprehensive incident response plan.