Trying to lock down your company\u2019s applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job\u2014despite vendor claims to the contrary."There\u2019s an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets," said Mark Curphey, vice president of professional services at McAfee\u2019s Foundstone division, in an interview. "The reality is, in a large enterprise, those things generally don\u2019t work.""Technology is increasing at such a fast and crazy pace, but security technology isn\u2019t keeping up with it. With application security it\u2019s even worse," Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving "gaping holes" behind, he said.Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia.Software vendors and companies must get back to basics to secure their applications. "What the smart banks are doing about this is they\u2019re building security into their development lifecycles, and that\u2019s exactly what Microsoft has done," he said.Since being hit by a series of high-profile vulnerabilities in its software, Microsoft has significantly improved the security of the software it produces, resulting in fewer critical vulnerabilities being reported. "Microsoft are going to be the security vendor of choice in the next couple of years," Curphey said. "There\u2019s been a phenomenal turnaround in that company."While a company\u2019s IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. "At the end of the day, security is about building something that\u2019s secure enough to do business on," Curphey said.To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said.The Hack in the Box conference runs through Thursday, Sept. 21.-Sumner Lemon, IDG News Service (Singapore Bureau)Related Link:\n\nSecurity Measures Seen Doing More Harm Than GoodCheck out our CIO News Alerts and Tech Informer pages for more updated news coverage.