Each year more money is spent on information systems security, and each year there are more incidents, more losses, and greater average losses. Security spending, vulnerabilities, attacks, and related losses were at record highs in 2001. This year is expected to be worse.

It should be obvious that the data security industry is missing something critical when it comes to reigning in the losses caused by security incidents. The potential for hundreds of thousands of systems to be compromised literally overnight is a systemic failure that must be corrected.

The increased reliance on the Internet and other networked systems makes developing a real and workable preventive solution for computer security an economic necessity. A security process that can keep systems secure in spite of their vulnerabilities is becoming a necessity. The current vulnerability-driven security process is just not up to the challenge.

[ Read more ]