Chris Brenton, Dartmouth ISTS

"One trend in 2001 will be a dramatic class separation between the skilled and unskilled attacker communities. The unskilled will continue using automated attacks for Web page defacement and DDoS attacks. The skilled attackers will start focusing greater effort on more esoteric types of attacks in order to prove their level of expertise. These sophisticated attacks will include payload-based attacks at the perimeter, since most firewalls on the Internet today react only to IP header information. They will also include greater development of system back doors that do not show up in process or task lists as this makes them far more difficult to locate during an audit."

Rootkits exist.
Firewalls respond primarily to known attacks.
The class separation already exists.