The depressing state of computer security

If you’re in the field of computer security, working on behalf of the good guys, and expect us to win any time soon, think again.

Free IT resource Virtualization Insights from Top Experts - Learn how virtualization gets real! Sponsored by Dell Free IT resource TechNet: More ways to know it, share it, and keep it running. Sponsored by Microsoft

Last week’s column suggested that the only real security solution is to implement default authentication in every piece of hardware and software that we use. Since that isn’t going to happen for a long time, you'd better get used to inadequate computer security solutions and laws.

Stop reading now if you don’t want to get depressed.

Two columns ago, I calculated that one third of all U.S. adults will have their identity information stolen this year. The jury's still out on whether that number will mark 2006 as a record year or just this year’s statistic.

So far this year, phishing is up. Crimeware is up. Malicious URLs, bogus domains, spyware, keylogging Trojans, worms, password stealing programs -- all up!

Hundreds to thousands of new malware definitions get added to anti-malware databases each month. Packed and malicious one-offs make signature-based products a partial solution (as always).

Bots, zombies, and DDoS attacks remain strong forces. Ransom requests continue to plague commercial Web sites. The ransoms are often paid, again and again.

Almost all malware has finally learned to do its dirty business over port 80. The firewall is a non-issue.

There isn’t a safe Internet browser in the house; all of them contain multiple vulnerabilities this year. Each year a new flavor of browser stands up to say that it’s the “secure” alternative, only to be exploited days later.

Security vendors' software is no more secure today than years ago. The software that is supposed to protect us can’t even protect itself: Security vendors continue to be plagued with vulnerabilities.

Security appliances keep getting delivered with built-in vulnerabilities, old software, and vulnerable code.

Vendors continue to believe that deny-by-exception schemes will work.

Security vulnerability lists publish over a dozen new exploits each day. CERT appears to be on pace for yet another record-setting year.

People still don’t patch. And there are still some in the workplace who insist on clicking on every file attachment.

Recommended solutions don’t work because they don’t address the real problem.

Congress passes laws half a decade too late, and what gets passed is ignored. Spam continues nearly unabated years after the CAN-SPAM Act was passed. Over 17,000 violations have been reported since the enactment of HIPAA. Not a single fine has been levied.

Nearly every hacker that commits a crime gets away with it. The malicious hackers we arrest are usually only the dumbest and the greediest. The few dozen we catch every year wouldn’t amount to rounding error.

VoIP is going big this year and the people in the know say security vulnerabilities abound.

I keep reading about cities putting their EMS systems on the Internet. This isn’t a good thing.

Malware and money-stealing Trojans are on the rise. More money will be stolen from banks this year than ever before. Most banks don’t even know what the real problems are, much less how to address them. (Of course, that last statement applies to nearly every industry.)

More money is being spent on computer security than every before, and as far as I can tell the problem is only getting worse, and will continue to get worse for the foreseeable future. Each year, software gets more complex and ever more connected. Web services promise to connect everything. My computer, television, phone, and stereo are all now network connected, but we continue to develop new Internet protocols without a second thought to security. If your PC doesn't attack you, it will be your copy machine, network printer card, or TV.

Next week, I promise to come back in a better mood with some ideas for real -- and better -- security solutions.