2012 is shaping up to be a rough year for cybersecurity. The Georgia Tech Information Security Center puts out an annual report predicting the biggest security threats to watch for in the year to come, and with more than a dozen on its list for 2012, it looks like we’ll need to fortify our defenses. As the report puts it:

In the past year, we have witnessed cyberattacks of unprecedented sophistication and reach. These attacks demonstrate that malicious actors have the ability to com­promise and control millions of computers that belong to governments, private enterprises, and ordinary citizens. If we are going to prevent motivated adversaries from attack­ing our systems, stealing our data and harming our critical infrastructure, the broader community of security research­ers—including academia, the private sector, and govern­ment—must work together to understand emerging threats and to develop proactive security solutions to safeguard the Internet and physical infrastructure that relies on it.

Yikes. The Georgia Tech experts group the threats they see into mobile, botnet, online, and persistent threats to physical and critical infrastructure. The list:

• Mobile applications rely increasingly on the browser, presenting unique challenges to security in terms of usability and scale.
• Expect compound threats targeting mobile devices to use SMS, email and the mobile Web browser to launch an attack, then silently record and steal data.
• While USB flash drives have long been recognized for their ability to spread malware, mobile phones are becoming a new vector that could introduce attacks on otherwise-pro­tected systems
• Encapsulation and encryption for sensitive portions of a mobile device can strengthen security.
• Botnet controllers build massive information profiles on their compromised users and sell the data to the highest bidder.
• Advanced persistent adversaries query botnet operators in search of already-compromised machines belonging to their attack targets.
• Bad guys will borrow techniques from Black Hat SEO to deceive current botnet defenses like dynamic reputation systems.
• Security researchers are debating whether person­alization online could become a form of censorship.
• Attackers are performing search engine optimization to help their malicious sites rank highly in search results.
• The trend in compromised certificate authorities exposes numerous weaknesses in the overall trust model for the Internet.
• Advanced persistent threats will adapt to security measures until malicious objectives are achieved.
• Human error, lack of user education, and weak passwords are still major vulnerabilities.
• Cloud computing and computer hardware may present new avenues of attack, with all malware moving down the stack.

How many of this dirty dozen could affect your workplace and infrastructure? Which ones threaten you the most? It’s never too early to make some new year’s resolutions about better security. The full 16-page report is available free online.