1. Mobile Malware Is on the Rise. Malware targeting mobile devices will continue to increase, and enterprises will wrestle with how to protect users. Obvious targets will be smartphones and tablets, with the hardest hit likely to be Android-based devices, given that operating system’s large market share and open innovation platform. All mobile platforms will experience an increase in mobile attacks.
2. Criminals Target and Infect App Stores. Infected applications, rather than browser-based downloads, will be the main sources of attack. Because they are not policed well, unauthorized application stores will be the predominant source of mobile malware. Cybercriminals will post their infected applications here to attempt to lure trusting users into downloading rogue applications. Cybercriminals also will find ways to get their applications posted into authorized application stores. And infections can easily spread beyond the smartphone and into a corporate network, upping the ante on risk.
3. Application Scoring Systems Will be Developed and Implemented. To reassure users, organizations will want to have their application source code reviewed by third parties. Similarly, organizations will want to be sure that the applications approved for use on workers’ devices meet a certain standard. It is anticipated that the industry will develop a scoring system that helps ensure that users only download appropriate, corporate-sanctioned applications to business devices.
4. Emergence of Bank-Friendly Applications with Built-in Security. Mobile devices will increasingly be used to view banking information, transfer money, donate to charities and make payments for goods and services, presenting an opportunity for cybercriminals, who will find ways to circumvent protections. To help ensure the security of online banking, the banking industry is likely to begin to offer applications that have strong, built-in security layers.
5. Hyper-connectivity Leads to Growing Identity and Privacy Challenges. In today’s business environment, more users need to legitimately access more data from more places. This requires the protection of data at every access point by using stronger credentials, deploying more secure, partner-accessible systems, and improving log management and analysis. Compounding the issue are a new age of cross-platform malicious code, aimed at sabotage, and mounting concerns about privacy. Enterprises will no longer be able to ignore this problem in 2012, and will have to make some hard choices.
6. New Risks Accompany Move to Digitized Health Records. In the U.S., health care reform and stimulus funding will continue to accelerate the adoption of electronic health records and related technologies throughout the industry. The American Recovery and Reinvestment Act calls for all medical records to be electronic by 2014, meaning that much work must be done in 2012 and 2013 to prepare.) New devices will be introduced that send sensitive information beyond the traditional boundaries of health care providers, and more and more health care providers are using mobile devices. Along with the need to secure newly implemented EHR systems, securing mobile devices and managing mobile clinical applications will continue to be an ever-increasing focus in the health care industry.
7. Mobile and Medical Devices Will Begin to Merge. Mobile devices and health care apps will proliferate, making it easier, for example, to transform a smartphone, into a heart monitor or diabetes tester. As a result, some experts believe that industry health care groups will declare mobile devices to be medical devices in order to control and regulate them. As interoperability standards mature, more mobile devices and traditional medical devices will become nodes on an organization’s network. These devices also will share data with other devices and users and, as a result, be susceptible to the same threats and vulnerabilities that computers and other network-attached peripherals, such as printers and faxes, are susceptible to today.
8. Smart Grid Security Standards Will Keep Evolving. In the U.S., public utility commissions, along with the National Institute of Standards and Technology, will continue to develop smart-grid standards. State PUCs will begin to agree on a standard in the coming year. The government will increasingly require utilities to demonstrate that their smart grid and advanced metering infrastructure solutions protect not only the privacy of consumers and consumer usage data but also the security of the AMI infrastructure. At some point, a single federal framework will supersede state regulations and requirements.
9. New Concerns Will Surface About IPv6. The federal government is still struggling with the rollout of IPv6-enabled devices as organizations migrate from IPv4. This will be an ongoing concern and IPv6 specific vulnerabilities and threats will continue to cause trouble during 2012. In addition, the other two fundamental mechanisms of the Internet — Border Gateway Protocol and Domain Name System – also now offer a next-generation version. In 2012, many will start migrating to these newer versions, generating a new round of vulnerabilities and exploits.
10. Social-Engineering Threats Resurface. More targeted spear-phishing — an e-mail-fraud attempt that targets a specific organization, seeking unauthorized access to confidential data – will be the major social-engineering threat of 2012. Efforts to educate user communities about safe computing practices, will continue to be a challenge as the user base of smart devices increases dramatically. Social networking sites will continue to implement protection for users from malware, spam and phishing, but sophisticated threats will continue to seduce users to visit a rogue Website or reveal personally identifiable information online.
11. Security Certification Programs Will Increase in Popularity. Certifications will continue to increase, especially as the government accelerates IT mandates for its agencies in the areas of cloud and identity; and in turn, the private sector will follow suit. Internet threats will continue to affect business, government and user confidence and wreak havoc on computing devices in the office and at home. The challenge for all testing bodies will be to stay ahead of the ever-changing threat landscape and to evolve testing accordingly. Some testing bodies may suggest certifying the security of companies as a whole, not just their products or services, as a way to build trust online.
12. ‘Big Data’ Will Get Bigger, and so Will Security Needs. ”Big data” — large data sets that can now be managed with the right tools — will be popular in 2012 as more companies derive greater value through analytics. Companies will use the data to create new business opportunities while empowering evidence-based decision making for greater success. However, companies will need to secure this data in order to achieve the gains they seek.
13. Safeguarding Online Identities Will no Longer be Optional. With the rampant growth of online identity theft, consumers, businesses and government agencies are seeking ways to better protect their identities. These groups will look to the private sector to provide a cost-effective solution that helps to safeguard their identities and create greater online trust.

“The proliferation of Internet connectivity, mobile devices and Web applications are helping to enrich lives and advance global business opportunity in new meaningful ways,” said Roger Thompson, emerging threats researcher, ICSA Labs. “But in this new era of hyper-connectivity, which is compounded by the blurring of lines between our professional and personal lives, it’s everyone’s responsibility — whether as a business user or a consumer — to safeguard our online activities and interact with technology responsibly to protect our assets, identity and privacy.”

With Tuesday’s changes to Google’s search engine, photos and posts from Google+ will increasingly appear within the search results.

The changes effectively create customized search results for people who are logged in to Google. A person who searches for the term “Hawaii,” for example, might find private photos that their friends have shared on Google+ as well as public information about the islands.

Twitter’s general counsel, Alex Macgillivray, a former Google attorney, said in a Tweet on Tuesday that Google’s changes “warped” Web searches and represented a “bad day for the Internet.”

Source Twitter lashes out at Google search changes

The India government has proposed a legal provision that puts the onus uniformly on companies such as Skype Technologies SA and Google Inc​. to locate part of their information technology (IT) infrastructure within the country to enable investigative agencies ready access to encrypted data on their servers.

Further, to guarantee privacy, this legal provision will also require that data of Indian citizens, government organizations and firms hosted on the servers of these companies not be moved out of the country, three government officials confirmed separately.

At present, the servers of all service providers are located outside the country and whatever data is generated or exchanged travels to the respective country. If servers or similar facilities are located in India, then data exchanges within the country would stay there.

Source  India Govt plans rule for encrypted data access

 Source: http://www.wallstreetandtech.com/2012-outlook/data-security

GoSecure Enterprise Version is under development for customization for selected partners. Its underlying core technology is flexible, scalable and adaptable to support a broad portfolio of innovative products and solutions. GoSecure is committed to seamless end-point security solutions with zero incremental investment in infrastructure.

GoSecure is based on a simple principle: robust, innovative products that are easy to use will lead to mass adoption when they are reasonably priced. GoSecure will serve companies, government agencies, service organizations to the mass market. It can be customized for companies, countries and languages requirements.

• IT needs to make data secure. That’s accomplished by easy to use software that encrypts and obfuscates for the user.
• IT needs to make infrastructure efficient. That’s accomplished by standardization, virtualization, and automation.
• IT needs to make organizations effective. That’s accomplished, by converting resources into value for greater than it costs to do so.

The company’s top five predictions for the coming year are:

• Mobile Devices and Social Media: New products and services will emerge that deal with issues regarding employer-owned versus employee-owned data on mobile devices. These products will go beyond anti-virus and malware software. For social media threats, the capabilities of security tools will be extended to tackle increased social media cyberwarfare.
• Cloud Computing Security: There will be an acceleration of efforts to create standards around cloud security, and independent, continuous monitoring of cloud-service providers’ security controls will become a standard part of service-level agreements.
• Legislative Initiatives: In the second half of 2012, a government mandate will be passed that will circulate the implementation of a proactive Information Security Risk Management system and related best practices to tackle cybersecurity threats.
• Anti-Cybercrime Collaboration: Sharing of sensitive threat information will become vital to prevent widespread cyberattacks across different verticals and industries. The increase in cybersecurity attacks and data breaches will lead to the introduction of a formal information-sharing database.
• Risk is Security’s New Compliance: There will be a further increase in demand for software tools that provide both advanced reporting capabilities and interconnectivity to ensure that remediation actions can be triggered and followed through easily. To better describe the capabilities of these tools, analysts will create a new software category called Security Risk Management.

Source Security Will Top IT Concerns for 2012

• The EU’s on deck Data Protection Regulation promises – or threatens depending on your viewpoint – to significantly revamp the EU’s data protection regimes, adding additional potential uncertainty to the EU arena.  The leaked DPR indicated a new broad extraterritorial reach, stronger protections for children under 18, embracing privacy by design and the right to be forgotten, a requirement to designate a privacy officer, and increased enforcement powers and penalties.  We’ll see what happens when the rubber meets the road.
• Will the final version of the HIPAA breach notification rule make a long-awaited appearance in 2012, along with guidelines per Stage 2 of the electronic record incentive program within the HITECH Act ?  The smart money says yes, especially since Congress recently admonished DHS to hurry up already given that the “interim” rule has been around since 2009.
• The FTC plans to issue in early 2012 its finalized Privacy Report, formally titled “Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework for Businesses and Policymakers,” which I believe will have a significant impact on the 2012 privacy/infosec landscape.  The draft version, issued a year ago in December 2010, immediately sparked wide-ranging conversations on Do-Not-Track, Privacy by Design, Fair Information Practice Principles, Geolocation and other privacy-related issues, many of which quickly found their way into 2011’s proposed bills.  I expect the finalized report to be heavily influential on 2012’s infosec and privacy debates.
• Information security and data protection issues surrounding contracting for cloud services will begin the road to maturity in 2012 as the federal government continues its push of fed agency IT needs into the cloud.  The result will help provide guidance on cloud contracting issues addressing audit assurances, cloud security and accreditation, e-discovery issues, security controls and allocation of liability and responsibility for data security, to name but a few.
• Finally, 2012 will unfortunately see no end in sight to advanced attacks resulting in data breaches, with attacks on mobile devices to ramp up significantly.  In response the move to Big Data and data hoarding may reverse as companies in specific sectoral areas begin paring back on how much data they retain.

For additional 2012 infosec and privacy predictions, pop over to Christine Marciano of Cyber Data Risk Managers’ collection, which includes the author’s  views of 2012, at  http://www.dataprivacyinsurance.com/wp-content/uploads/2012/01/2012-DATA-PRIVACY-AND-INFORMATION-SECURITY-PREDICTIONS.pdf