8 dirty secrets of the IT security industry

Joshua Corman would seem an unlikely critic of IT security vendors. After all, he works for one. Yet Corman, principal security strategist for IBM's Internet Security Systems division, is speaking out about what he sees as eight trends undermining the ability of IT security practitioners to mount an effective defense against online outlaws.

Having worked for the vendor side, Corman says he is uniquely positioned to grasp its weaknesses up close. And so, with a PowerPoint presentation on the "8 Dirty Secrets" of the market in hand, he has traveled to seminars and worked the phones, hoping to motivate a change for the better. Here is the breakdown of those 8 dirty secrets and what Corman sees as practical ways to keep the vendors honest. [Related podcast: The Dark Side of the Security Market]

Dirty Secret 1: Vendors don't need to be ahead of the threat, just the buyer

This is the problem that leads to the seven "dirty secrets" that follow. In essence, Corman said, the goal of the security market is to make money, not to ensure the customer's security.

Tom Vredenburg, regional IM manager for Houston-based Wartsila Corp., said Corman's take is consistent with what he has experienced in the trenches. "Not only has security become a phantom deliverable, but the vendors themselves have become equally tough to pin down and evaluate. Are they software sellers or risk managers? Are they service providers or network designers? Am I buying partnerships or licenses? Most of them don't know themselves what they are -- only that they need to sell something that most people don't really want to buy in the first place -- insurance."

Several security vendors defended themselves against that notion, including Cloakware product management director Terry Brown.

"Ultimately, there's still a quest for dollars across the security market, but now, because of the economic downturn, both vendors and customers are developing more reasonable expectations, right-sizing the market and IT spending."

Dirty Secret 2: AV certification omissions

While AV tools detect replicating malware like worms, they fail to identify such as non-replicating malware as Trojans. Though Trojans have been around since the beginning of malicious code, Corman said there's no accountability in AV certification tests. Companies are therefore lulled into a false sense of security, wrongly believing the AV they purchased is protecting them from all malware.

"Today Trojans and other forms on non-replicating malcode constitute 80 percent or more of the threats businesses are likely to face," Corman said. "AV accountability metrics are simply no longer reflective of the true state of threat."

Dirty Secret 3: There is no perimeter

Corman said those who truly believe there's still a network "Perimeter" may as well believe in Santa Claus. That's not to say there is no perimeter. It's just that companies are foggy on what the perimeter truly is, and security vendors are doing little to fix that. For the sake of Dirty Secret 1, the reality of Dirty Secret 3 is swept under the rug, leading companies to buy products that are not always effective in addressing their particular risks.

"We need to define what the perimeter is," he said. "The endpoint is the perimeter, the user is the perimeter. It's more likely that the business process is the perimeter, or the information itself is the perimeter, too. If you design your security controls with no base assumption of a perimeter, when you have one you are more secure. The mistake we tend to make is, if we put the controls at the perimeter, then we will be fine. For many threats, we couldn't be more wrong."

Page Break

Dirty Secret 4: Risk management threatens vendors

Risk management really helps an organization understand its business and its highest level of risk, Corman said. But a company's priorities don't always map to what the vendors are selling.

"Vendors focus on individual issues so you will continue to buy their individual products," he said. "If you don't have a clear picture of your risk priorities, vendors are more than happy to set them for you. Security needs to conform to and support your business priorities. Too often, vendors want your business to conform to their portfolio."

Dirty Secret 5: There is more to risk than weak software

Corman said the lion's share of the security market is focused on software vulnerabilities. But software represents only one of the three ways to be compromised, the other two being weak configurations and people. Unfortunately, he said, the latter two are far more dangerous risks than the big bad software security flaw of the week.

"While we need to find and patch vulnerabilities, we also must understand an organization is only as strong as its weakest link. More attention needs to be paid in mitigating the other two ways beyond software," Corman said.

Also see 9 Dirty Tricks: Social Engineers' Favorite Pick-Up Lines

Dirty Secret 6: Compliance threatens security

Compliance with such laws and industry standards as Sarbanes-Oxley and PCI DSS drives companies to spend far more on security than they might otherwise. Security vendors have obviously seized upon this fact, offering products that do everything from offer PCI compliance out of the box to ultimate cure-alls for healthcare entities coping with the demands of HIPAA. Of course, this too leads to companies buying security tools that fail to properly address the particular risks they face.

Dirty Secret 7: Vendor blind spots allowed for Storm

The Storm botnet, as an archetype, is being copied and improved. The Storm era of botnets is alive and well, nearly two years from when it first appeared, Corman said. How is this possible? He answered:

* 1.) Botnets thrive in the consumer world where there is little money for innovation, a fact Storm and its controllers know. They are making money off of everything from spam to pump-and-dump stock scams.

* 2.) They eat AV for breakfast. A lot of the techniques and innovations used by Storm are not new; they are just being leveraged artfully against the blind spots of AV certifications and AV vendors.

* 3.) Malcode does not need vulnerabilities. Most of the Storm recruitment drives have leveraged social engineering and play off of a holiday or sporting event.

Dirty Secret 8: Security has grown well past "do it yourself"

Technology without strategy is chaos, Corman said. The sheer volume of security products and the rate of change has super-saturated most organizations and exceeded their ability to keep up.

"Organizations realize only a fraction of the capabilities of their existing investments. Furthermore, the cost of the product is often a fraction of the cost of ownership," he said. "There was a time when you could do it yourself."

The vendor community must therefore stop trying to convince companies that they can buy a product, set it and forget it.