Signatures are Useless ?

I was shocked by a pre-sales consultant of a vendor telling that "Signature is Useless. Today we are facing challenge from zero day attacks."....Then he further emphasized his company security solution is strong in detecting new attacks.

The vendor has a strong network optimization background and has been aggressively penetrating to security area recent years. I just hope he is not going to spread this incorrect message to too much clients.

I agree that zero-day (or even negative-days) attacks pose serious security challenge to enterprises and vendors. However, an effective and comprehensive security practice on patches or signature updates is essential part of a solid security defense.

As from Gartner, “90% of successful attacks occurred against previously known vulnerabilities where a patch or secure configuration standard was already available.”

A few vendors emphasize "too much" on new attacks, zero-day attacks, or even negative-day attacks as for their marketing and promotion purposes. Known vulnerabilities, signature's importance has never decreased.

You may be interested in this article from Juniper, about "Understanding Our Approach to Addressing Known and Unknown Vulnerabilities".

Most MNC or large enterprise has vulnerabilities subscribed or purchased. I would say it is a wise investment. There is also available managed vulnerabilities scanning services which charge is very affordable for most companies.

Should All the Security Vendors Merge into ONE ?

Most enterprise looks for the so-called "best-of-breed solution" to cater each different levels of security concerns.

Network Firewall : Vendor A

Proxy                  : Vendor B

Web Filtering       : Vendor C

Application Control / Application Firewall : Vendor D

......and finally....

Security Incident and Event Management (SIEM) - to manage all above vendor solutions : Vendor Z

One day, one client would like us to provide the commonly used brands for different security solutions in the market. Frankly, it is not our style to start with telling about product straight away. Instead, we prefer to discuss with a risk management prospective, so as to advise what his company really need and what his company don't need. However, he "claims" it is only used for his internal reference. (Alright :| ) We try our best to "help" him. Hope we are not unintentionally making a trap for him.

(blurred image, no commercial here. :D )

While preparing a table as above (different types of security in different industries), ..

I think of :    Should all Security Vendors Merge into ONE?

I am not talking about all-in-one solution, like UTM, but having ONE single vendor to research and develop all the security products. Feasible or Not?

As a Security Specialist, one of our roles is to interface with different security vendors. Sometimes I dreamed of a day when every security vendors are integrated in one. My life could become easier, provided that I would not lose my job due to this "too-easy" work.

Back to the questions:  Should all Security Vendors Merge into ONE?   (Feasible?)

Despite of my personal preference of having an easier job, I still prefer existence of different vendors, because this generates....

1.  A healthy competition among vendors
• R&D teams to strengthen the products endlessly, they don't want to lag behind
• Sales and marketing team of different vendors aggressively promote their security solution to end client, which in turn provides free security awareness training to public


2. (Comparatively) Difficulties and complexity for hackers
• There is not "single vendor of failure"
• Hackers need to break into several layers of security control (provided by different vendors) before getting their target (for some cases)
3. Vendors' concentration on handling particular outbreak or vulnerabilities
• Recent example: Oracle is now focusing on fixing JDK v7 vulnerabilities, while other security vendors are aggressively promoting (teaching) how they are good at minimize the risk over browser.