"Malware, especially from compromised web sites, was a huge issue in 2008. Many legitimate sites such as MSNBC.com, History.com, ZDNet.com and many others suffered compromises, in some cases for days. Unlike the past, the sites looked normal, but unsuspecting web surfers with vulnerable systems were exploited when they visited these sites.

Search engines were used, such as Google, to compromise systems. This happened in several ways, including:
- Tricking the search engine indexing and results logic to escalate malicious web sites to the top of the list where users were more likely click on it.
- Using the "paid for" or "sponsored links" areas of search engines to direct users to compromised sites.

As predicted, hackers towards compromising end points (individual systems such as desktops, laptops and servers) and placed less emphasis on external direct attacks - although this still happens frequently.

On the flip side, we expected botnets to play a larger role in 2008. While botnets increased in size, scope, and sophistication, they weren't used to the scale expected. Basically, botnet controllers were sowing more and reaping less in 2008.

Also, out of the blue, we had the whole DNS exploit issue come back from the dead. We saw a lot of these in the 90's when DNS was first used and then we went nearly a decade without many DNS flaws. I don't think anyone expected a core DNS vulnerability on a worldwide scale. The good news is that very few known cases of serious exploits occurred.

Vista had fewer serious security vulnerabilities than expected. This may be because so few people are migrating to Vista and many even downgraded to XP. I imagine that if more people were using Vista, 1) we would find more vulnerabilities and 2) more attackers would spend time trying to exploit it. Attackers are all about bang for the buck. If most people are still using XP, they will focus on XP. It is just that simple."

Here's the list.

#1. Malicious Insiders - Rising Threat 

#2. Malware - Steady Threat

#3. Exploited Vulnerabilities -Weakening Threat

#4. Social Engineering - Rising Threat

#5. Careless Employees- Rising Threat

#6. Reduced Budgets - Rising Threat

#7. Remote Workers - Steady Threat

#8. Unstable Third Party Providers - Strong Rising Threat

#9. Downloaded Software Including Open Source & P2P Files - Steady Threat

Read more: http://www.csoonline.com/article/472866/Top_Network_Security_Threats_in_