Cyber Security risks

Cyber criminals are increasingly attacking applications, this is the findings of a study published by SANS this week. The top cyber security risks report combines intelligence from TippingPoint, Qualys and SANS themselves. The two main risk areas are listed below.
"Waves of targeted email attacks, often called spear phishing, are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office. This is currently the primary initial infection vector used to compromise computers that have Internet access."

"Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet. These vulnerabilities are being exploited widely to convert trusted web sites into malicious websites serving content that contains client-side exploits."

As you can see the two areas that cyber criminals look for are client side application vulnerabilities where there have been many 0-days and traditionally patch releases have been slow. The example they have shown is very real and something that we see on a daily basis, the latest example being the New York Times incident

If you combine this with the Verizon report, we can assume that client side applications and web application vulnerabilities are being increasingly used as entry points but cyber criminal's main target is getting sensitive information from organization's critical databases.

The SANS report also lists some of the mitigation steps