Feeds

Security suppliers compared to dodgy car mechanics

Wide boys and clueless vendors contribute to 30% security overspend

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

Many anxious users are being duped by unscrupulous or clueless suppliers into buying security products they don't need.

That's the view of security consultancy MIS Corporate Defence, which reckons almost 30 per cent of current security spend in Europe is misplaced or wasted on ad-hoc purchases.

The average security breach costs companies an estimated £16,000 and MIS is quick to stress the need for basic security precautions, which some firms only make after they've been hit. The problem is that unless end users have a basic understanding of security, which means better education, they might misplace their trust in vendors, who might not always have their best interests at heart.

Mark Read, a professional services consultant at MIS Corporate Defence, said that talking to a security vendor was much like talking to a car mechanic.

"If people don't understand how a car works, it's much easier to sell them things that they don't need. The same is true of security," Read told us.

Users should seek to get a clear business reason why they need a piece of technology, Read advises. Bad advice does not always stem from avarice - lack of knowledge about appropriate solutions from suppliers "who have jumped on the security bandwagon" can also lead to problems.

As an example of the kind of security "overkill" MIS is cautioning against, Read reports instances when he discovered the internet connection of a two user branch office was protected by an enterprise class Cisco PIX firewall.

MIS analysis is partially backed up by research by Datamonitor, which discovered that 80 per cent of firewalls fail to perform the task for which they were purchased, primarily due to poor configuration and a lack of advice from suppliers.

Intrusion detection technology was another area where end users can end up with a system that fails to match their requirements, but the issue goes over the whole range of security spending, according to MIS. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Boffins build FREE SUPERCOMPUTER from free cloud server trials
Who cares about T&Cs when there's LIteCoin to mint?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.