Why is the Security Industry Failing?

Why is the Security Industry Failing?

Another year, another set of records broken. 2016 saw the most breaches, the most records breached, and the largest single breach – at least according to one report. News of the latest breach barely registers over the din of others.

In February, I attended a luncheon entitled “Perspectives and Insights from White House Insiders” which featured a panel of former White House advisors. The panel shared their war stories with an audience of CIOs, CTOs, and CSOs, and answered questions about public/private partnerships, government involvement in security, and suggestions for future planning. The conversations in the room were pessimistic. If I could summarize the discussion it would be simply: “Things in cyber security are bad and getting worse.”

And yet, it is clear the security industry is vibrant and flush with innovation. An unprecedented amount of venture capital is fueling dozens of startups in the security industry. A record number of security professionals attended the 2017 RSA Security Conference.

Which brings me to the question I somewhat rhetorically asked the panel. There are a record number of breaches every year; the overwhelming majority of those breaches succeed by exploiting a flaw for which a fix has been available for over a year. Organizations consistently fail to implement the ‘top ten’ or ‘top twelve’ or ‘top twenty’ security controls and yet, there are hundreds of vendors, and tens of thousands of security professionals here at RSA. Are we spreading ourselves too thin?

Richard Clarke, former National Coordinator for Security, Infrastructure Protection and Counterterrorism for the United States was quick to respond to my question, with a resounding “yes!”

To paraphrase his response, Clarke said that venture capital was the biggest blessing and curse to the security industry. Too many people spend their time chasing unicorns, and not enough time doing the dirty work to improve cyber defense.

The irony is that the reason security industry is failing is because it is growing without bound. Security vendors try to turn every potential problem into a sustainable business model. Investors chase the latest shiny technology and don’t see value in the time, productivity, and money being lost to breach recovery and identity theft. And despite the large number of security professionals, there is a growing shortage of qualified workers.

If the true goal is to improve security, we cannot spend all our time and effort buying and implementing new tools to shore up our defenses. The only solution viable in the long term is to focus on building security into our software applications and technology platforms. This means that we need to stop taking short cuts when building software. By working diligently to avoid – and minimize the impact of – security flaws while building systems, we can start to turn the tide. The only way this will be effective is to focus on security in the design, architecture, and development phases – not just in the operations, maintenance, and support phases.

Let’s stop spreading ourselves too thin and instead focus our security efforts on where they have the most impact – building security in.

About the Author

Peter Hesse is the Chief Security Officer at 10Pearls.

Featured

  • Keynote Speakers Announced for ISC West 2025

    ISC West, hosted in collaboration with premier sponsor the Security Industry Association (SIA), unveiled its 2025 Keynote Series. Featuring a powerhouse lineup of experts in cybersecurity, retail security, and leadership, each keynote will offer invaluable insights into the challenges and opportunities transforming the field of security. Read Now

    • Industry Events
    • ISC West
  • Study: Video Doorbells Have a 71% Service Attach Rate

    Parks Associates recently announced a new white paper, Consumer IoT Product Development: Managing Costs, Optimizing Revenues, which provides companies with a business-planning blueprint to evaluate how a consumer IoT solution will perform across its lifetime. Subscription services, such as video storage and professional monitoring, can be critical for covering ongoing cloud and support costs Read Now

  • Michigan City Fights Retail Crime With AI-Powered Video Surveillance, 911 Camera Sharing

    To combat persistent retail crime and deliver peace of mind to workers in the bustling North Leroy Street business district, the City of Fenton Police Department has deployed a new AI-powered video surveillance system with camera-sharing technology to accelerate response time during retail heists or other emergencies. Read Now

  • TSA Intercepts 6,678 Firearms at Airport Security Checkpoints in 2024

    During 2024, the Transportation Security Administration (TSA) intercepted a total of 6,678 firearms at airport security checkpoints, preventing them from getting into the secure areas of the airport and onboard aircraft. Approximately 94% of these firearms were loaded. This total is a minor decrease from the 6,737 firearms stopped in 2023. Throughout 2024, TSA managed its “Prepare, Pack, Declare” public awareness campaign to explain the steps for safely traveling with a firearm. Read Now

Featured Cybersecurity

Webinars

New Products

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3