Corporate IT executives need to beware the seven dirty secrets of the security industry that can undermine the safety of business networks, a security expert told attendees at Interop Las Vegas.

"It's best to have a healthy level of skepticism about what security vendors are trying to tell you," says Joshua Corman, principal security strategist for IBM/ISS, which itself is a security vendor.

He called his talk "Unsafe at any speed: 7 Dirty Secrets of the Security Industry," harkening back to the 1960s Ralph Nader book about automobile safety, Unsafe at Any Speed. Nader's book took car makers to task for worrying more about cosmetic improvements than upgrades to make cars more safe.

Security vendors have at times invested development money in management GUIs rather than new security features. And they have a tendency to add features only when customers demand them, he says. "The goal of the security vendor is not to secure, it's to make money," Corman says.

He says that is his "zeroth" dirty secret of the security industry. These are the other seven:

1. Antivirus certifications are misleading. The certification standards confirm that devices block 100 percent of all replicating malcode. The catch is that 75 percent of malcode coming into networks is non-replicating, such as Trojans. When the standard was set, non-replicating malcode represented 5 percent of malcode, Corman says. "Certification means [a product] caught 100 percent of 25 percent of the bad stuff," he says. (Compare antivirus products)

2. There is no perimeter. Vendors say that the network perimeter must be defended, but most data that is actually lost doesn't go through the firewall. Half of all breaches are the result of either lost laptops or lost thumb drives or other removable media. Businesses need to tighten up their business processes at least as much as they need to tighten up network perimeters, he says. "If you still believe in perimeters, you may as well believe in Santa Claus," he says.

3. Risk analysis threatens vendors. Security vendors want businesses to buy what they sell, so they push specific products to block specific threats. NAC, for example, might solve a real problem. But if the problem doesn't have a major impact on the company's top three business priorities, it probably doesn't need to be addressed. Risk assessment may determine that improved business processes or hardening configurations of existing gear are all that are needed, Corman says. "You need to understand the environment and the big priorities," he says.

4. There is more to risk than just weak software. Security vendors push protecting against software vulnerabilities, but those flaws don't represent the source of the bulk of successful exploits, Corman says. Weak passwords, weak configurations of devices -- particularly default configurations -- and weak people -- easy victims of social engineering, are bigger problems, he says. "If software were perfect, we'd still have viruses, Trojans, etc., that don't need software flaws to work," he says.

5. Compliance threatens security. Compliance itself is not bad, but complying with security standards set by government, such as HIPAA, or industries, such as PCI, are not enough to keep networks secure, Corman says. The problem is that regulations create a budget and resource conflict between what compliance demands and what network executives think really needs doing to best secure the business it supports. Complying with such standards also signals to potential attackers the exact defenses businesses have. "If PCI tells them where the fortifications are, they start targeting other areas," he says. (Compare Network Auditing and Compliance products)

6. Vendor blind spots allowed the Storm worm outbreak to happen. Corporate defenses that check behavior of network devices can spot machines taken over by the bot network, but there is no such protection for consumer networks. Behavior-based antivirus software for endpoints and anomaly detection systems also work, but not for those who don't have them, he says. " Storm recognized the biggest blind spots in antivirus and exploited them, and Storm employs great social engineering," Corman says.

7. Security has grown well past do-it-yourself. Security vendors try to convince businesses that security is so complex that they cannot possibly do it alone, Corman says. But the security needs of businesses are so individual that merely choosing a product is not enough. "It's not enough to have the right tool. It needs to be installed and configured properly for the environment," he says, and that can best be done by the IT staff itself.