Dirty Secrets of the IT Security Industry

This was a great article that came out recently in Information Week about the IT security industry's dirty laundry.

1. Vendors do not need to be ahead of the hackers; they only need to be ahead of the buyer
2. Antivirus certifications do not require or test for Trojans
3. There is no perimeter
4. Risk assessment threatens vendors
5. There's more to risk than weak software
6. Compliance threatens security
7. Vendor blind spots allowed for the "Storm" botnet
8. Security has grown well past the "do it yourself" stage