Credit: Thinkstock Trying to lock down your company’s applications and protect your systems from attack? If so, security scanners and source-code analysis tools are not up to the job—despite vendor claims to the contrary.“There’s an awful lot of marketing spiel, people introducing technology tools that are sold as silver bullets,” said Mark Curphey, vice president of professional services at McAfee’s Foundstone division, in an interview. “The reality is, in a large enterprise, those things generally don’t work.”“Technology is increasing at such a fast and crazy pace, but security technology isn’t keeping up with it. With application security it’s even worse,” Curphey said. Security tools, such as code scanners, are able to detect just 1 percent to 2 percent of vulnerabilities in an application, leaving “gaping holes” behind, he said.Curphey, who has worked on security for U.S. financial institutions, is speaking this week at the Hack in the Box Security Conference in Kuala Lumpur, Malaysia. Software vendors and companies must get back to basics to secure their applications. “What the smart banks are doing about this is they’re building security into their development lifecycles, and that’s exactly what Microsoft has done,” he said.Since being hit by a series of high-profile vulnerabilities in its software, Microsoft has significantly improved the security of the software it produces, resulting in fewer critical vulnerabilities being reported. “Microsoft are going to be the security vendor of choice in the next couple of years,” Curphey said. “There’s been a phenomenal turnaround in that company.” While a company’s IT systems may never be perfectly secure, IT managers should be able to identify and mitigate risks. “At the end of the day, security is about building something that’s secure enough to do business on,” Curphey said.To help protect their systems, companies need to be sure they are hiring IT staff with the right set of technical skills, setting business processes that determine how to respond to attacks on the system, and providing staff with the tools they need to respond when attacks happen, he said.The Hack in the Box conference runs through Thursday, Sept. 21.-Sumner Lemon, IDG News Service (Singapore Bureau)Related Link: Security Measures Seen Doing More Harm Than GoodCheck out our CIO News Alerts and Tech Informer pages for more updated news coverage. Related content BrandPost The future of trust—no more playing catch up Broadcom: 2023 Tech Trends That Transform IT By Eric Chien, Director of Security Response, Symantec Enterprise Division, Broadcom Mar 31, 2023 5 mins Security BrandPost TCS gives Blackhawk Network an edge with Microsoft Cloud In this case study, Blackhawk Network’s Cara Renfroe joins Tata Consultancy Services’ Rakesh Kumar and Microsoft’s Nilendu Pattanaik to explain how TCS transformed the gift card company’s customer engagement and global operati By Tata Consultancy Services Mar 31, 2023 1 min Financial Services Industry Cloud Computing IT Leadership BrandPost How TCS pioneered the ‘borderless workspace’ with Microsoft 365 Microsoft’s modern workplace solution proved a perfect fit for improving productivity and collaboration, while maintaining security of systems and data. By Tata Consultancy Services Mar 31, 2023 1 min Financial Services Industry Microsoft Cloud Computing BrandPost Supply chain decarbonization: The missing link to net zero By improving the quality of global supply chain data, enterprises can better measure their true carbon footprint and make progress toward a net-zero business ecosystem. By Tata Consultancy Services Mar 31, 2023 2 mins Retail Industry Supply Chain Green IT Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe