This year, the IT security world had its share of good stats tempered by a hefty dose of stark reality.
Let's start with the good news: Most computing devices and software became more secure in 2009. Increasingly, more vendors are starting to take computer security and patching seriously. Companies are making critical security patches available faster than in past years (across all platforms). More end-users are using auto-updating mechanisms to patch their OS and applications. The number of computers being applied with critical security patches is up. Responsible disclosure is up. Irresponsible, full disclosure is down. (See Figure 27 in the Microsoft Security Intelligence Report for the company's stats).
The bad news on patching? Well, the fact that it's still so frequently and desperately needed across all OSs, all browsers, across nearly every very popular program. No one is expecting perfect code with zero vulnerabilities found over time, but it would be nice for patching to become a less regular event.
The average end-user still has 12 unpatched programs on his or her machine, according to my security vulnerability-finder fav Secunia. The average end-user patches his or her OS and doesn't patch his or her browser add-ins, which are the ones most likely to allow malware onto a system.
Good browser news: Most browser developers started implementing (or strengthening) anti-phishing and anti-malware detectors. None of the implementations are perfect, but at least it gives another free defence-in-depth tool. All the popular browsers improved their cross-site scripting (XSS) defences, along with a myriad other browser defenses. Kudos to Firefox for looking for and warning users about older, unpatched popular add-ons.
Spam is a mixed bag. Spam, as a percentage of global e-mail, is as high as ever, at over 80 per cent. However, most users are receiving less than a handful of spam messages in their inbox each day. If you're getting more than a handful, you don't have the right anti-spam tools implemented.
In a welcome relief, we didn't have any huge rapid, mega-outbreaks in 2009. Conficker was a widely spreading malware program, infecting over 10 million machines. It was nothing to sneeze at, but it was not the rapid-spreading, everyone-is-infected-in-a-day type of worm such as MS-Blaster or SQL-Slammer. Although like all the previous types of very popular worms, patches were already available before the malware program's release, but often not applied.
As expected, malicious hackers started to target social networking sites in a big way. Some of the biggest attacks were against MySpace, Facebook, and Twitter users. This trend will probably only grown. Hackers attack what is popular.
On the positive side, for the tenth year in the row the expected besiegement of mobile phone malware didn't happen. Sure, there were mobile phone worms and Trojans, but we read more stories about them than actual infections.
Sign up for Computerworld eNewsletters.