Sadly the response to security compromises in the news seems to be a push to buy more firewalls. Firewalls provide no defense against application security attacks. The article below reminds me of a great chart by Gunnar Peterson
According to the barclay interim report which is also being referenced in stories on CSOonline.com
Attacks against:
Some of these were distributed denial of service attacks, but many were application specific attacks that resulted in the compromise and data disclosure. If the concern is SQL injection and application security, then invest in your SDLC and look for application security experts. No amount of firewalls will help this issue.
Now, don't get me wrong. We still need firewalls and many network security experts. They provide invaluable security services. Just make sure your strategy is actually addressing the problem you are attempting to solve.
-Michael Coates - @_mwc
The increase in electronic attacks has had a direct impact on the demand for network security professionals. Companies are now strengthening their network security infrastructure. There is an increase in demand for firewall experts with qualifications in Juniper and Checkpoint and for security practitioners with experience of configuring IDS/IPS systems. As the year progresses those who have specialised in network security will be more highly sought after which will increase rates for permanent and contract candidates alike.If you read through the barclay report you'll notice they are specifically referring to the following high profile events:
Attacks against:
- Visa, Amazon, MasterCard and PayPal
- The multiple Sony compromises
- Nintendo, RSA SecurID, Gmail and CitiBank
Some of these were distributed denial of service attacks, but many were application specific attacks that resulted in the compromise and data disclosure. If the concern is SQL injection and application security, then invest in your SDLC and look for application security experts. No amount of firewalls will help this issue.
Now, don't get me wrong. We still need firewalls and many network security experts. They provide invaluable security services. Just make sure your strategy is actually addressing the problem you are attempting to solve.
-Michael Coates - @_mwc