Many Companies Chasing Wrong Security Risks - Twenty-Four Seven Security

« More Google Hacks You Better Know About | Main | Stupidity Trumps Hacker Ability »

February 11, 2008
Many Companies Chasing Wrong Security Risks

An interesting blog over at Dark Reading quotes the antivirus inventor, Peter Tippett, as saying at the Computer Forensics show that many companies are chasing the wrong security risks, in essence they're still building their Maginot Line when the hackers have already mobilized.

Tibbet's first target was vulnerability testing, saying, "Only 3 percent of the vulnerabilities that are discovered are ever exploited," he said. "Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth."

The next weakness Tibbet found was the fact that experts often try to perfect defenses until they are 100 percent secure, often throwing out those that come up short. "If a product can be cracked, it's sometimes thrown out and considered useless," he observed. "But automobile seatbelts only prevent fatalities about 50 percent of the time. Are they worthless? Security products don't have to be perfect to be helpful in your defense."

And there are still plenty of simple things security departments can do that can yield results and not waste time. "For example, only 8 percent of companies have enabled their routers to do 'default deny' on inbound traffic," he said. "Even fewer do it on outbound traffic. That's an example of a simple effort that could pay high dividends if more companies took the time to do it."

And as I try to point out here time and time again, Tibbet said that employee awareness still offers one of the best bangs for the buck. "Employee training sometimes gets a bad rap because it doesn't alter the behavior of every employee who takes it," he said. "But if I can reduce the number of security incidents by 30 percent through a $10,000 security awareness program, doesn't that make more sense than spending $1 million on an antivirus upgrade that only reduces incidents by 2 percent?"