The report shows that in the past year, 52% of data-stealing attacks were conducted over the Web, 9% of data stealing attacks happened over e-mail, and 90% of all unwanted e-mails contained links to spam sites or malicious websites, up 4% on 2009.
The 2010 evidence and metrics suggest that cybercriminals and their blended attacks are having a field-day taking advantage of security gaps left open by legacy technologies like firewalls, anti-virus software, and simple URL blockers, the report said.
According to researchers, legacy defences like anti-virus products, firewalls and proxies are no longer enough in the face of script-based attacks that are often embedded in rich media like Flash and threats spread through social networking sites and legitimate websites, bypassing filters based on reputation.
Most of today's blended attacks are considered 'zero-day', in that they have not been previously identified. They are ever-evolving and pre-tested by cybercriminals on common anti-virus products before they are released, the report said.
"The continued rise of organised cybercriminal gangs and the emergence of targetted advanced malware threats are the most concerning trend we've seen", said Dan Hubbard, chief technology officer, Websense.
"Security needs to move ahead of the attackers and focus on contextual classification in order to thwart them. Simple binary access controls and 'castle and moat' security will not solve the complex attacks we see today", he said.
In 2010, cybercriminals adapted their strategies to address the social websites and sites with dynamic user-generated content so that attacks are now more blended, sophisticated, and targetted, the report said.
Most attacks in 2010 focused on stealing data, and according to Websense indications are that focused, targetted attacks are on the rise.
The number of malicious websites has increased 111% in the past year, 80% of websites with malicious code were legitimate sites that had been compromised, and 34% of malicious web/HTTP attacks included data-stealing code.
This story was first published by Computer Weekly