Dirty Secret 4: Risk management threatens vendors
Risk management really helps an organization understand its business and its highest level of risk, Corman said. But a company's priorities don't always map to what the vendors are selling.
"Vendors focus on individual issues so you will continue to buy their individual products," he said. "If you don't have a clear picture of your risk priorities, vendors are more than happy to set them for you. Security needs to conform to and support your business priorities. Too often, vendors want your business to conform to their portfolio."
Dirty Secret 5: There is more to risk than weak software
Corman said the lion's share of the security market is focused on software vulnerabilities. But software represents only one of the three ways to be compromised, the other two being weak configurations and people. Unfortunately, he said, the latter two are far more dangerous risks than the big bad software security flaw of the week.
"While we need to find and patch vulnerabilities, we also must understand an organization is only as strong as its weakest link. More attention needs to be paid in mitigating the other two ways beyond software," Corman said.
Also see 9 Dirty Tricks: Social Engineers' Favorite Pick-Up Lines
Dirty Secret 6: Compliance threatens security
Compliance with such laws and industry standards as Sarbanes-Oxley and PCI DSS drives companies to spend far more on security than they might otherwise. Security vendors have obviously seized upon this fact, offering products that do everything from offer PCI compliance out of the box to ultimate cure-alls for healthcare entities coping with the demands of HIPAA. Of course, this too leads to companies buying security tools that fail to properly address the particular risks they face.
Dirty Secret 7: Vendor blind spots allowed for Storm
The Storm botnet, as an archetype, is being copied and improved. The Storm era of botnets is alive and well, nearly two years from when it first appeared, Corman said. How is this possible? He answered:
* 1.) Botnets thrive in the consumer world where there is little money for innovation, a fact Storm and its controllers know. They are making money off of everything from spam to pump-and-dump stock scams.
* 2.) They eat AV for breakfast. A lot of the techniques and innovations used by Storm are not new; they are just being leveraged artfully against the blind spots of AV certifications and AV vendors.
* 3.) Malcode does not need vulnerabilities. Most of the Storm recruitment drives have leveraged social engineering and play off of a holiday or sporting event.
Dirty Secret 8: Security has grown well past "do it yourself"
Technology without strategy is chaos, Corman said. The sheer volume of security products and the rate of change has super-saturated most organizations and exceeded their ability to keep up.
"Organizations realize only a fraction of the capabilities of their existing investments. Furthermore, the cost of the product is often a fraction of the cost of ownership," he said. "There was a time when you could do it yourself."
The vendor community must therefore stop trying to convince companies that they can buy a product, set it and forget it.