Think about it this way, security was once focused on simple solutions to solve problems (network architecture with security in mind, device/OS hardening, etc).
Let us recap the history of the industry so that I can set the stage for where I think it is headed. In the last 5-7 years the security problem has grown complex and sheer number of threats have skyrocketed, which brought to life an industry of complex solutions to a combat a complex problem. IMHO, the wrong way to deal with the problem. Companies began popping up left and right with the latest and greatest network security appliance to position themselves on the network (in some odd or obscure location) and perform tasks that are only useful if you have one of the companies other 5 security devices working in tandem. Odd behavioral and AI technologies had been all the rage for in 01'-03' as IDS rose to the top of the market. With an expensive and complicated network of sensors and reactive response units in every corner of a network it was not wonder that Richard Stiennon from Gartner released the "IDS is Dead" report (http://www.nwfusion.com/news/2003/1006ids.html) back in 03. 2003 IDS Company: "Oh no, IDS is dead, someone call marketing and tell them we are now IPS" We have all seen the move from IDS marketing to IPS marketing, the same stuff, repackaged, repositioned, and resold to enterprise. Fortunately the cream is rising to the top and old re-branded IDS/IPS solutions are being shelved by enterprise. I would like to say that we have seen the last of people installing overly complex 'solutions' to cure their acute security pains... but we have not. So, to where I think the industry is headed. [*] Reactive technologies die out, they cannot react fast enough to modern day threats [*] Security moves back to the host, where it is needed most. Harden the OS. Helps solve internal attack and propagation issues and also external. [*] Routers and switches will begin to incorporate more security features by default. This will keep perimeter security moving along. [*] A handful security companies will fall due to unprofessional business practices, and a handful will find themselves acquired by the bigger fish. [*] The consumer will become more aware of the problem due to in your face spyware/malware that is crippling home computers. Anyone else have their grandmother calling them because their Wintel box takes 30 minutes to boot and is relatively unusable? I hope to see people focusing on solutions more so than problems, but we will see about that one. Cheers, Geoff Shively Founder, Chief Scientist PivX Solutions 23 Corporate Plaza Newport Beach, CA 92661 http://www.pivx.com Ticker Symbol: PIVX.OB PivX defines "Proactive Threat Mitigation". Get Qwik-Fix PRO(tm)! <http://www.qwik-fix.net> -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Barry Fitzgerald Sent: Monday, September 13, 2004 11:23 AM To: Jan Muenther Cc: n30; Mailing List - Full-Disclosure Subject: Re: [Full-Disclosure] Where is security industry gng?? Jan Muenther wrote: >>Network security -> application security -> software security -> ???? >> >>What do u guys think?? >> >> > >job security? > > > or insecurity? POC: #!/bin/sh if [ ! $jobsecurity ]; then export insecurity='high'; else unset insecurity; fi; _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
