Trying to lock down your company's applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job -- despite vendor claims to the contrary.
"There's an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets," said Mark Curphey, vice president of professional services at McAfee's Foundstone division, in an interview. "The reality is, in a large enterprise, those things generally don't work."
"Technology is increasing at such a fast and crazy pace, but security technology isn't keeping up with it. With application security it's even worse," Curphey said. Security tools, such as code scanners, are able to detect just 1% to 2% of vulnerabilities in an application, leaving "gaping holes" behind, he said. Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack In The Box Security Conference (HITB) in Kuala Lumpur, Malaysia. Software vendors and companies must get back to basics to secure their applications. "What the smart banks are doing about this is they're building security into their development life cycles and that's exactly what Microsoft has done," he said.
Read this full article at NetworkWorld
|
|
Only registered users can write comments.
Please login or register.
Powered by AkoComment!