4. There is more to risk than just weak software. Security vendors push protecting against software vulnerabilities, but those flaws don’t represent the source of the bulk of successful exploits, Corman says. Weak passwords, weak configurations of devices - particularly default configurations - and weak people - easy victims of social engineering, are bigger problems, he says. “If software were perfect, we’d still have viruses, Trojans, etc., that don’t need software flaws to work,” he says.

5. Compliance threatens security. Compliance itself is not bad, but complying with security standards set by government, such as HIPAA, or industries, such as PCI, are not enough to keep networks secure, Corman says. The problem is that regulations create a budget and resource conflict between what compliance demands and what network executives think really needs doing to best secure the business it supports. Complying with such standards also signals to potential attackers the exact defenses businesses have. “If PCI tells them where the fortifications are and they start targeting other areas,” he says. (Compare Network Auditing and Compliance products)

6. Vendor blind spots allowed the Storm worm outbreak to happen. Corporate defenses that check behavior of network devices can spot machines taken over by the bot network, but there is no such protection for consumer networks. Behavior-based antivirus software for endpoints and anomaly detection systems also work, but not for those who don’t have them, he says. “Storm recognized the biggest blind spots in antivirus and exploited them, and Storm employs great social engineering,” Corman says.

7. Security has grown well past do-it-yourself. Security vendors try to convince businesses that security is so complex that they cannot possibly do it alone, Corman says. But the security needs of businesses are so individual that merely choosing a product is not enough. “It’s not enough to have the right tool. It needs to be installed and configured properly for the environment,” he says, and that can best be done by the IT staff itself.