Credit: Thinkstock Trying to lock down your company’s applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job—despite vendor claims to the contrary.“There’s an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets,” said Mark Curphey, vice president of professional services at McAfee’s Foundstone division, in an interview. “The reality is, in a large enterprise, those things generally don’t work.”“Technology is increasing at such a fast and crazy pace, but security technology isn’t keeping up with it. With application security it’s even worse,” Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving “gaping holes” behind, he said.Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia. Software vendors and companies must get back to basics to secure their applications. “What the smart banks are doing about this is they’re building security into their development lifecycles, and that’s exactly what Microsoft has done,” he said.Since being hit by a series of high-profile vulnerabilities in its software, Microsoft has significantly improved the security of the software it produces, resulting in fewer critical vulnerabilities being reported. “Microsoft are going to be the security vendor of choice in the next couple of years,” Curphey said. “There’s been a phenomenal turnaround in that company.” While a company’s IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. “At the end of the day, security is about building something that’s secure enough to do business on,” Curphey said.To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said.The Hack in the Box conference runs through Thursday, Sept. 21.-Sumner Lemon, IDG News Service (Singapore Bureau)Related Link: Security Measures Seen Doing More Harm Than GoodCheck out our CIO News Alerts and Tech Informer pages for more updated news coverage. Related content brandpost Sponsored by SAP A cloud-based solution to rescue millions from energy poverty Aware of the correlation between energy and financial poverty, Savannah Energy is helping to generate clean, competitively priced electricity across Africa by integrating its old systems into one cloud-based platform. By Keith E. Greenberg, SAP Contributor Nov 30, 2023 5 mins Digital Transformation feature 8 change management questions every IT leader must answer Designed to speed adoption and achieve business outcomes, change management hasn’t historically been a strength of IT orgs. It’s time to flip that script by asking hard questions to hone change strategies. By Stephanie Overby Nov 30, 2023 10 mins Change Management IT Leadership feature CIO Darlene Taylor’s formula for success: Listen, drive, care This Motor City CIO says building and maintaining credibility starts with an empathy-driven approach, which has the potential to render you highly appealing to top talent. By Michael Bertha Nov 30, 2023 6 mins Automotive Industry IT Leadership news MENA IT Spending to Grow 4% in 2024 By Andrea Benito Nov 30, 2023 2 mins Artificial Intelligence Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe