According to Mary Landesman, technical editor for Microsoft Security Research and Response, “A significant evolution has occurred in the malware landscape over the past five years – a change of intent from amateur virus writers seeking attention to professional criminals seeking profit.”

I heard essentially the same thing from Dave Cole, director of Symantec Security Response. He told me that in the Internet Security Threat Report, Symantec’s semi-annual review of the threat landscape, “Symantec has observed a change in Internet attack activity away from status-oriented attacks and towards criminal activities motivated by profit. The current threat environment is characterized by an increase in data theft, data leakage, and the creation of malicious code that targets specific organizations for information that can be used for financial gain.”

<aside> While the conclusions are remarkably similar, both companies arrived at them by looking at data they collected independently, as part of on-going threat analysis projects.</aside>

Increasingly, according to both Microsoft and Symantec, criminals are targeting individuals within enterprises as the entry point to corporate data rather than the now old-fashioned worms and viruses. Phishing attacks, keyloggers and Trojan horse programs are becoming the preferred methods for malware purveyors.

So how can you protect your organization’s assets?

Microsoft has a white paper available, “Responding to IT Security Incidents,” that can help you prepare for the time when you will need to respond to an attack. And it isn’t “if,” but “when” that attack will come.

The first suggestion is, of course, to “Minimiz[e] the Number and Severity of Security Incidents.” You’ll note that there’s no thought of eliminating or preventing them outright. The paper does offer a set of what might be called “best practices” that can ensure that you aren’t actually easing the way for the attacks to occur, though.

Next, you’ll learn about forming a Computer Security Incident Response Team (CSIRT). This is the core of the paper, and could be very instrumental in limiting losses when a security incident occurs. All organizations, no matter their size, should have a CSIRT. It might be that in very small companies the CSIRT lead is also the head of IT but the real work (after a security incident) is handled by the associate members of the team.