syssec_red_book

22. ENISA Threat LandscapeSocial Technology is increasingly being leveraged for stealing informationand, primarily, identities. This is predicted to grow into a “fake trust”effect that may one day be leveraged to build so-called social bots.Critical Infrastructures are concerning because they integrate different systemsfrom very diverse domains, each with peculiar security policies,practices and threats. On top of this, external factors such as politicalinstability and financial crisis impact negatively by creating, respectively,motivation for attackers and vulnerabilities (e.g., cheap equipment). Theincreasing BYOD practice, along with its security issues, constitute anadditional weak spot in the future critical infrastructures ecosystem.Trust Infrastructure. Operators of trust infrastructures are likely to becometargeted by offenders, whose goal is to compromise the chain of trust ofthe systems that rely on such infrastructures (e.g., social networks, webservices). In this regard, the ENISA report highlights a need for morepervasive education and training to increase the users’ awareness.Cloud Computing and Big Data Cloud services such as remote backup andapplication services have become a consumer product. This, togetherwith the massive use of social networks, yielded vast amounts of data,which are now an attractive target for attackers. Furthermore, the tightintegration of cloud services in mobile devices will lead to a larger cloudattack surface, which could be exploited to compromise data privacy andto collect intelligence to prepare targeted attacks.22.3 RecommendationsThe ENISA report gives a series of recommendations that highlight the importanceand usefulness of future threat landscapes in information securitymanagement. More precisely, rather than the typical list of recommendationfor authorities and decision or policy makers, the report points out a list of“open issues” that need to be addressed by future threat landscapes. As thisaspect is purely methodological, we present it in Section A.222.4 A Look at Industrial Threat Reports22.4.1 SummaryAt the beginning of each year, it is common for several security-related companiesto publish reports or blog entries in which they try to summarize thetrends they observed in the past and propose some threat predictions for theupcoming year. These are usually short term forecasts with a focus on technologyand practical issues more than on long term research directions. However,these reports are compiled by the best experts in the area, and therefore they134