The depressing state of computer security

If you’re in the field of computer security, working on behalf of the good guys, and expect us to win any time soon, think again.

Last week’s column suggested that the only real security solution is to implement default authentication in every piece of hardware and software that we use. Since that isn’t going to happen for a long time, you'd better get used to inadequate computer security solutions and laws.

Stop reading now if you don’t want to get depressed.

Two columns ago, I calculated that one third of all U.S. adults will have their identity information stolen this year. The jury's still out on whether that number will mark 2006 as a record year or just this year’s statistic.

So far this year, phishing is up. Crimeware is up. Malicious URLs, bogus domains, spyware, keylogging Trojans, worms, password stealing programs -- all up!

Hundreds to thousands of new malware definitions get added to anti-malware databases each month. Packed and malicious one-offs make signature-based products a partial solution (as always).

Bots, zombies, and DDoS attacks remain strong forces. Ransom requests continue to plague commercial Web sites. The ransoms are often paid, again and again.

Almost all malware has finally learned to do its dirty business over port 80. The firewall is a non-issue.

There isn’t a safe Internet browser in the house; all of them contain multiple vulnerabilities this year. Each year a new flavor of browser stands up to say that it’s the “secure” alternative, only to be exploited days later.

Security vendors' software is no more secure today than years ago. The software that is supposed to protect us can’t even protect itself: Security vendors continue to be plagued with vulnerabilities.

Security appliances keep getting delivered with built-in vulnerabilities, old software, and vulnerable code.

Vendors continue to believe that deny-by-exception schemes will work.

Security vulnerability lists publish over a dozen new exploits each day. CERT appears to be on pace for yet another record-setting year.

People still don’t patch. And there are still some in the workplace who insist on clicking on every file attachment.

Recommended solutions don’t work because they don’t address the real problem.

Congress passes laws half a decade too late, and what gets passed is ignored. Spam continues nearly unabated years after the CAN-SPAM Act was passed. Over 17,000 violations have been reported since the enactment of HIPAA. Not a single fine has been levied.