Increasingly you’re hearing more and more folks say this out loud:
Infosec Professionals Don’t Trust Endpoint Security
When it comes to endpoint protection, the overwhelming majority of information security professionals believe that their existing security solutions are unable to prevent all endpoint infections, and that anti-virus solutions are ineffective against advanced targeted attacks. Overall, end-users are their biggest security concern.
In a recent survey from Bromium, nearly 85% of respondents believe that their existing security technology is unable to prevent endpoint infections. Despite the proliferation of layered security solutions, attacks continue to exploit common vulnerabilities in operating systems, applications, browsers and plug-ins.
I know I’ve long lamented the presence of users on my systems, but alas, companies keep hiring them…
Seriously though, this isn’t so much news as it is validation. We all know the usual suspects in end-point “solutions” have serious shortcomings, the question is: why are we not rebelling against what we know is wrong?
Part of the problem of course is that we’ve regulated ourselves into a corner. Various laws, regs and policies demand that we use products that work to a degree but provide no alternative course of action if something better comes along. If you can’t swap out a bad solution for a good one because the good one isn’t addressed in the regulation then you’re basically saying ‘break the law’ in order to improve security. Since no General Counsel will allow that, well here we are: stuck following rules that marginally help, but don’t enable us to improve.
“Despite the challenge in protecting end-users, it is encouraging so many security professionals are aware of the shortcomings of existing technology,” added Kashyap. “The recognition that the status quo is broken is the first step toward changing it for the better.”
Let’s hope that we can bring about some meaningful changes faster than most 12-step programs.