Noam Eppel posted a commentary on his blog entitled “Security Absurdity: The Complete, Unquestionable, and Total Failure of Information Security”. It is a very interesting read that discusses why he believes that security professionals have failed to protect.
“It is time to admit what many security professional already know: We as security professional are drastically failing ourselves, our community and the people we are meant to protect. Too many of our security layers of defense are broken. Security professionals are enjoying a surge in business and growing salaries and that is why we tolerate the dismal situation we are facing. Yet it is our mandate, first and foremost, to protect.”
I think he might go a little far in specifically blaming security professionals for all of the problems that an enterprise can experience, but he is correct in most of his assertions. Oftentimes, I believe, security is poorly applied because not all the threats are identified and the risks weighed. And, honestly, people are lazy when it comes to security, because security is hard and takes effort for what seems like little return. Mr. Eppel does a good job of addressing many of these points.
Here is the link.
What do you think? Why do you think informations ecurity is so hard, why it isn’t done properly, or why things are getting better (or worse)?