Skip Links

DNSstuff.com
Get information about your IP
IP Information
50+ On-demand DNS and network tools

Security

Videos

rssRss Feed
Get instant email notification when white papers, webcasts, executive guides are added to our library.  Stay informed and up-to-date with the latest on IT Technologies with Network World's Resource Alerts.
Audio

Crackin' the Kraken bot. Listen now!

Network World's Newsmaker of the Week

Wireless dangers at airports. Listen now!

Network World Panorama

Additional Resources

RSS

FEATURED REPORTS

Executive Guide: Storage Heats Up HP

Get the latest on storage technologies that allow IT professionals to better cope with new IT demands. Learn how storage technologies can help you successfully tackle e-Discover, regulatory compliance, green data center initiatives and the data explosion. Get all the details now.

RSS

FEATURED WEBCASTS

Discover how to Create an Orchestrated Data Center through Virtualization Novell

IT professionals like the idea of consolidating hundreds of servers into only a few, but it takes a lot more to cost effectively consolidate and virtualize servers. Watch this six-chapter webcast, "Reduce Complexity and Cost - Windows Server Consolidation with Virtualization" to learn how to effectively consolidate your Windows environment. One of the themes explored includes the characteristics of an orchestrated data center, which includes: Resource management, dynamic provisioning, job management, policy management, accounting and auditing and real-time availability. Learn more about orchestration and much more today. Register below to learn more and be entered to win an Archos 605 Portable Media Player.

IT Buyer's Guides

View All Buyer's Guides

Free Newsletters

Sign up and receive the latest news, reviews and trends on your favorite technology topics

Save The Date!
What They Are Saying

Out of 19 vendors only 2 participated... This article would have been much more relevant if more vendors...- Anonymous

Join the Discussion

7 dirty secrets of the security industry

Insider tells Interop attendees what to look out for.
By Tim Greene , Network World , 05/01/2008
  • Social Web 
  • Email 
  • Feedback 
  • Close

Corporate IT executives need to beware the seven dirty secrets of the security industry that can undermine the safety of business networks, a security expert told attendees at Interop Las Vegas.

“It’s best to have a healthy level of skepticism about what security vendors are trying to tell you,” says Joshua Corman, principal security strategist for IBM/ISS, which itself is a security vendor.

He called his talk "Unsafe at any speed: 7 Dirty Secrets of the Security Industry," harkening back to the 1960s’ Ralph Nader book about automobile safety, Unsafe at Any Speed. Nader’s book took car makers to task for worrying more about cosmetic improvements that upgrades to make cars more safe.

Security vendors have at times invested development money in management GUIs rather than new security features. And they have a tendency to add features only when customers demand them, he says. “The goal of the security vendor is not to secure, it’s to make money,” Corman says.

He says that is his “zeroth” dirty secret of the security industry. These are the other seven:

1. Antivirus certifications are misleading. The certification standards confirm that devices block 100% of all replicating malcode. The catch is that 75% of malcode coming into networks is non-replicating, such as Trojans. When the standard was set, non-replicating malcode represented 5% of malcode, Corman says. “Certification means [a product] caught 100% of 25% of the bad stuff,” he says. (Compare antivirus products)

2. There is no perimeter. Vendors say that the network perimeter must be defended, but most data that is actually lost doesn’t go through the firewall. Half of all breaches are the result of either lost laptops or lost thumb drives or other removable media. Businesses need to tighten up their business processes at least as much as they need to tighten up network perimeters, he says. “If you still believe in perimeters, you may as well believe in Santa Claus,” he says.

3. Risk analysis threatens vendors. Security vendors want businesses to buy what they sell, so they push specific products to block specific threats. NAC, for example, might solve a real problem. But if the problem doesn’t have a major impact on the company’s top three business priorities, it probably doesn’t need to be addressed. Risk assessment may determine that improved business processes or hardening configurations of existing gear are all that are needed, Corman says. “You need to understand the environment and the big priorities,” he says.

1 | 2 |  Next >
Comments (8)
Login
Forgot your account info?

Against vendors?By tuomoks on May 7, 2008, 6:01 pmNot really and a vendor (or a standard) can only do so much, none (maybe excluding IBM, etc outsourcing services) can do all for the business and they are always...

Reply | Read entire comment

Biased much against the vendors? seems so.By Anonymous on May 7, 2008, 5:13 pmAnd saying compliance with PCI says where to attack may be somewhat plausible, but lets face it, many vendors leave those "portals of opportunity" open if not forced...

Reply | Read entire comment

canyou guys give us a more simpler version of what networking anBy Anonymous on May 6, 2008, 2:52 pmcanyou guys give us a more simpler version of what networking and all other facilities are all about

Reply | Read entire comment

The Small Guy?By rwbms on May 3, 2008, 1:53 pmThis is something the security enterprises should have brought out earlier in the game -- or at least the gate keepers. But the SMBs are listening -- this is very...

Reply | Read entire comment

We have met the enemy...By Anonymous on May 2, 2008, 6:18 pmI enjoyed this article- I found as the head of a corporate IT department, that I could address "perimeter" issues easily- they were well known and understood by...

Reply | Read entire comment

View all comments

Add comment
Anonymous comments subject to moderator approval. Register here for member benefits.
Have a NetworkWorld account? Log in here. Register now for a free account.
First Name
Last Name
E-mail
Zip Code