Security industry faces attacks it cannot stop | ITworld

Many security experts now agree that patches, up-to-date antivirus, plus intrusion detection systems are not enough to protect companies from the worst of today's cyberthreats.

"The security industry's going to have to think about selling solutions that actually work with this type of environment," Isec's Stamos said. "Basically nothing that people have bought over the last 16 years is going to help them stop a single guy sitting at a computer who is a Windows shellcode person targeting one person, and spending months to break into that computer." Shellcode is the initial payload program hackers use to install further programs, once they have hacked into a system.

But that message hasn't quite sunk in everywhere in the corporate world, said Paul Melson, information security manager with Priority Health, in Grand Rapids, Michigan. "A lot of companies have either turned their security teams into compliance teams or are still fighting the same fight they were fighting six or seven years ago."