“It’s best to have a healthy level of skepticism about what security vendors are trying to tell you,” says Joshua Corman, principal security strategist for IBM/ISS, which itself is a security vendor.

He called his talk "Unsafe at any speed: 7 Dirty Secrets of the Security Industry," harkening back to the 1960s’ Ralph Nader book about automobile safety, Unsafe at Any Speed. Nader’s book took car makers to task for worrying more about cosmetic improvements that upgrades to make cars more safe.

Security vendors have at times invested development money in management GUIs rather than new security features. And they have a tendency to add features only when customers demand them, he says. “The goal of the security vendor is not to secure, it’s to make money,” Corman says.

He says that is his “zeroth” dirty secret of the security industry. These are the other seven:

1. Antivirus certifications are misleading. The certification standards confirm that devices block 100% of all replicating malcode. The catch is that 75% of malcode coming into networks is non-replicating, such as Trojans. When the standard was set, non-replicating malcode represented 5% of malcode, Corman says. “Certification means [a product] caught 100% of 25% of the bad stuff,” he says. (Compare antivirus products)

2. There is no perimeter. Vendors say that the network perimeter must be defended, but most data that is actually lost doesn’t go through the firewall. Half of all breaches are the result of either lost laptops or lost thumb drives or other removable media. Businesses need to tighten up their business processes at least as much as they need to tighten up network perimeters, he says. “If you still believe in perimeters, you may as well believe in Santa Claus,” he says.

3. Risk analysis threatens vendors. Security vendors want businesses to buy what they sell, so they push specific products to block specific threats. NAC, for example, might solve a real problem. But if the problem doesn’t have a major impact on the company’s top three business priorities, it probably doesn’t need to be addressed. Risk assessment may determine that improved business processes or hardening configurations of existing gear are all that are needed, Corman says. “You need to understand the environment and the big priorities,” he says.