Security not keeping pace with technology advances

Trying to lock down your company's applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job -- despite vendor claims to the contrary.

"There's an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets," said Mark Curphey, vice president of professional services at McAfee's Foundstone division, in an interview. "The reality is, in a large enterprise, those things generally don't work."

"Technology is increasing at such a fast and crazy pace, but security technology isn't keeping up with it. With application security it's even worse," Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving "gaping holes" behind, he said.

Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia.

Software vendors and companies must get back to basics to secure their applications. "What the smart banks are doing about this is they're building security into their development life cycles and that's exactly what Microsoft has done," he said.

Since being hit by a series of high-profile vulnerabilities in its software, Microsoft has significantly improved the security of the software it produces, resulting in fewer critical vulnerabilities being reported. "Microsoft are going to be the security vendor of choice in the next couple of years," Curphey said. "There's been a phenomenal turnaround in that company."

While a company's IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. "At the end of the day, security is about building something that's secure enough to do business on," Curphey said.

To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said.

HITB runs through Thursday, Sept. 21.