Joshua Corman would seem an unlikely critic of IT security vendors. After all, he works for one. Yet Corman, principal security strategist for IBM's Internet Security Systems division, is speaking out about what he sees as eight trends undermining the ability of IT security practitioners to mount an effective defense against online outlaws.
Having worked for the vendor side, Corman says he is uniquely positioned to grasp its weaknesses up close. And so, with a PowerPoint presentation on the "8 Dirty Secrets" of the market in hand, he has traveled to seminars and worked the phones, hoping to motivate a change for the better. Here is the breakdown of those 8 dirty secrets and what Corman sees as practical ways to keep the vendors honest. [Related podcast: The Dark Side of the Security Market]
Dirty Secret 1: Vendors don't need to be ahead of the threat, just the buyer
This is the problem that leads to the seven "dirty secrets" that follow. In essence, Corman said, the goal of the security market is to make money, not to ensure the customer's security.
Tom Vredenburg, regional IM manager for Houston-based Wartsila Corp., said Corman's take is consistent with what he has experienced in the trenches. "Not only has security become a phantom deliverable, but the vendors themselves have become equally tough to pin down and evaluate. Are they software sellers or risk managers? Are they service providers or network designers? Am I buying partnerships or licenses? Most of them don't know themselves what they are -- only that they need to sell something that most people don't really want to buy in the first place -- insurance."
Several security vendors defended themselves against that notion, including Cloakware product management director Terry Brown.
"Ultimately, there's still a quest for dollars across the security market, but now, because of the economic downturn, both vendors and customers are developing more reasonable expectations, right-sizing the market and IT spending."
Dirty Secret 2: AV certification omissions
While AV tools detect replicating malware like worms, they fail to identify such as non-replicating malware as Trojans. Though Trojans have been around since the beginning of malicious code, Corman said there's no accountability in AV certification tests. Companies are therefore lulled into a false sense of security, wrongly believing the AV they purchased is protecting them from all malware.
"Today Trojans and other forms on non-replicating malcode constitute 80 percent or more of the threats businesses are likely to face," Corman said. "AV accountability metrics are simply no longer reflective of the true state of threat."
Dirty Secret 3: There is no perimeter
Corman said those who truly believe there's still a network "Perimeter" may as well believe in Santa Claus. That's not to say there is no perimeter. It's just that companies are foggy on what the perimeter truly is, and security vendors are doing little to fix that. For the sake of Dirty Secret 1, the reality of Dirty Secret 3 is swept under the rug, leading companies to buy products that are not always effective in addressing their particular risks.
"We need to define what the perimeter is," he said. "The endpoint is the perimeter, the user is the perimeter. It's more likely that the business process is the perimeter, or the information itself is the perimeter, too. If you design your security controls with no base assumption of a perimeter, when you have one you are more secure. The mistake we tend to make is, if we put the controls at the perimeter, then we will be fine. For many threats, we couldn't be more wrong."