Where do you see the next big security threats coming from?

Your question hints at what we are seeing today: the maturation of criminal and politically-backed organizations operating in the cybersphere. Kevin's point of starting with the motive is key, as the bulk of security exploits follow a strict cost/benefit curve.

Those exploits that reap the greatest reward for the least risk and expenditure of resources will be the most prevalent. Certainly, there will always be the occassional penetration that amounts to climbing Everest. There is a shock value in such rare hacks that remind the emperor that his new clothes leave him naked and exposed. Such attacks tend to favor the chaos motive.

All of the motivations he lists do have one thing in common. They all benefit from exploiting the most ubiquitous technology employed in any given target market. To predict where the next threats will be, one simply needs to look at what tech is emerging in a given area.

Mobile computing is expanding and provides an easy vector into corporate spaces. Virtualization is another avenue. With the growing sophistication of these nefarious organizations, the hypervisors, which are the foundations of both host and network infrastructure, are under increasing scrutiny.

The one constant, however, is social engineering. No matter how well you harden your tech, the same deadly sins that have plagued civilization since time in memoriam will continue to have the greatest ROI.

Before we get to the technology behind future attacks it is important to remember that the first concern is the motivation for the attack.

We have to acknowledge the motivation and purpose of the attack to begin to have any understanding of how and why and what methodology the attacker(s) would use to carry out the attack process.

Each organization has specific target value and overall web wide attacks result in various "reward" factors for a hackers who just love chaos and recognition of being able to impact the www in general.

In the motive categories that we see currently and increasing are financial, revenge/retaliation, and chaos acknowledgement.

The last two are tied to sociologic factors which are morphing at a record pace. We have many many people who truly believe that the entire world is suppose to care about their personal opinion or viewpoint on any and all issues. Unfortunately, when they get into the work place and find out that many of their co-workers do not care nor endorese their viewpoints they strike out to make their point or to somehow make everyone listen.

These types of individuals inside of the workplace can lead to tremendous damage and security breach problems as well as creating web based attacks against institutions and society in general. Some of these attacker are motivated to cause loss and damage via their actions and some are just getting their thrills by showing the world they can detour daily operations and expectations - a bit of a personal power surge if you will from the knowledge and expertise, even if it is applied in an unacceptable ranging to criminal fashion.

We believe the new threats will come from insiders, already within the net. It would appear that the USDOD agrees as they are not working on solutions to create their new CINDER programic solution (cyber insider).

I also agree that the mobile units will cause more problems down the road as they are already creating havoc in many circles. Most commonly in hacking personal information and identity theft to the sublime intallation of various software programs that allow you to use the victims smart phone as a remote listening post without ever activating the phone with audio or visual alerts. During high level meetings we now have to either a) scan the software on all executive telephones or b) take out the batteries, or c) confiscate phones and hand them back after the meetings. With the financial motivation involved, mobile application attacks will increase and they will be propagated by professionals, in some case by highly trained professional intelligence officers.

I'd say we have not seen the top of the web attacks yet. Before mobile phones become #1 risk (if they ever do), I think we' d see more fun threats from / thru the web.

I expect the next stream of significant threats to come from two sources:

1) Highly motivated, skilled, and well-funded cyber-terrorists, probably sponsored by Islamic fundamentalists. The degree of economic and social disruption they could cause is extreme. The ideal targets are social networks and devices used to access them, e.g., smartphones.

2) User ignorance. We already see a lot of this, with people acquiring malware when simple basic precautions would prevent it. The growth of the use of technology is faster than the education of those users on its proper and cautious use.