The year 2011 will see twice the number of mobile exploit releases that occurred in 2010, according to IBM’s X-Force 2011 Mid-Year Trend and Risk Report.

This could be due to the increase in adoption of mobile devices such as smartphones and tablets in the enterprise, including the "Bring Your Own Device" approach, which allows personal devices to access the corporate network.

Mobile phone vendors do not rapidly provide security updates for their devices, according to X-Force team, which recommends that IT teams should consistently employ anti-malware and patch management software for phones in enterprise environments.

Malware developers find mobile phones as an increasingly attractive platform due to its growing size of the user base and they see it as a potential option to monetise mobile phone infections.

Some mobile malware is designed to collect end user’s personal information, which then can be used in phishing attacks or for identity theft. It is often capable of spying on victim’s personal communications.

The GPS capabilities in some of the smartphones enable mobile malware to monitor and track users’ physical movements.

The percentage of critical vulnerabilities has tripled thus far in 2011, due the increasing number of high-profile attacks and network compromises that have occurred this year.

Teams of professional attackers have been able to gain and maintain access to critical computer networks through a combination of stealth, sophisticated technical capabilities and careful planning. These attackers are often referred to as Advanced Persistent Threats (APTs).

The success of APTs has raised the profile of "whaling," a type of spear phishing which targets "big fish", or those positioned in high levels of an organisation with access to critical data, the X-Force report said.

‘Hacktivist’ groups, who targeted web sites and computer networks for political ends rather than just financial gain, have been successful in using well known, off-the-shelf attack techniques such as SQL Injection.

The report added that anonymous proxies have more than quadrupled in number compared to three years earlier.

IBM X-Force manager of Threat Intelligence and Strategy Tom Cross said the rash of high-profile breaches this year highlights the challenges organisations often face in executing their security strategy.

"Although we understand how to defend against many of these attacks on a technical level, organizations don’t always have the cross-company operational practices in place to protect themselves," Cross said.

The first half of 2011 saw an unexpected decrease in web application vulnerabilities, from 49% of all vulnerability disclosures down to 37%, according to the report.

Despite an increasingly complex browser market, high and critical vulnerabilities in web browsers were also at their lowest point since 2007.

The report shows a trend in the decline of spam and more traditional phishing tactics, as major botnet operators are taken down and off-line by law enforcement officials.

A significant decline in spam volumes in the first half of 2011 has been observed after years of consistent spam growth until the middle of 2010.

In the first half of 2011, the percentage of spam that is phishing on a weekly basis was less than 0.01%.

The X-Force report found attacks on weak passwords are commonplace on the Internet, as are attacks that leverage SQL Injection vulnerabilities in Web applications to compromise backend databases.

IBM researchers tested almost 700 web sites from the Fortune 500 and other most popular sites, and found that 40% of these contain a class of security issues referred to as client-side JavaScript vulnerabilities.

The existence of vulnerabilities like these in so many corporate web sites is indicative of the security blindspots in many organisations, the report said.