Antivirus Inventor: Security Departments Are Wasting Their Time

[dock98]

Antivirus Inventor: Security Departments Are Wasting Their Time

About a third of current security practices are useless, according to ICSA chief scientist and Verizon exec

FEBRUARY 6, 2008 | 6:02 PM

By Tim Wilson

Site Editor, Dark Reading

WASHINGTON -- Computer Forensics Show 2008 -- Peter Tippett thinks it's time for security professionals to wake up and stop wasting their energy.

In a presentation here yesterday, Tippett -- who is vice president of risk intelligence for Verizon Business, chief scientist at ICSA Labs, and the inventor of the program that became Norton AntiVirus -- said that about one third of today's security practices are based on outmoded or outdated concepts that don't apply to today's computing environments.

"A large part of what we [security pros] do for our companies is based on a sort of flat-earth thinking," Tippett said. "We need to start looking at the earth as round."

For example, today's security industry focuses way too much time on vulnerability research, testing, and patching, Tippett suggested. "Only 3 percent of the vulnerabilities that are discovered are ever exploited," he said. "Yet there is huge amount of attention given to vulnerability disclosure, patch management, and so forth."

full article