In the last week both Symantec and IBM have released their annual security surveys which provide rich insight into the volume and range of security attacks circling the Internet.

As expected, Symantec Corp in their ‘Internet Security Threat Report’ highlighted a massive increase in threat volume (286 million new threats last year), accompanied by several new ‘megatrends’ in the threat landscape. The report highlights increases in both the frequency and sophistication of targeted attacks on enterprises; the continued growth of social networking sites as an attack distribution platform; and a change in attackers’ infection tactics. In addition, the report explores how attackers are exhibiting a notable shift in focus toward mobile devices.

Specifically, Symantec identified attacks such as Hydraq and Stuxnet as posing a growing threat to enterprises in 2010. To increase the likelihood of successful, undetected infiltration into the enterprise, an increasing number of these targeted attacks are leveraging zero-day vulnerabilities to break into computer systems. As one example, Stuxnet alone exploited four different zero-day vulnerabilities to attack its targets. While the high-profile targeted attacks of 2010 attempted to steal intellectual property or cause physical damage, many targeted attacks preyed on individuals for their personal information. For example, the report found that data breaches caused by hacking resulted in an average of more than 260,000 identities exposed per breach in 2010, nearly quadruple that of any other cause. At Endace, we see the prevention of data loss as being a key driver of technology investment over the next 12 months as organisations start to really understand the reputational damage caused when private customer data goes public.