Who watches the watchmen?

No, this post has nothing to do with Alan Moore’s famous comic.

Over these years a flourishing PC security industry has sprung up. The operating system isn’t enough; you have to install antispyware, antivirus, firewalls, and so on.

These new WATCHMEN are present on almost every personal computer, protecting our work, and sometimes getting in its way.

Millions of users put their trust in these products. But how secure are they?

An interesting article by Laurie O’Connell on developerpipeline cites recent studies showing how attacks have shifted from the operating system to this watchdog software.

The chart shows how the number of vulnerability advisories for these products has grown as the market grows, and how at the end of 2004 it starts to exceed the number of advisories for Microsoft flaws:

The problem lies at the roots of the watchdog software.

There is a blindness in this industry: software vendors are not applying good security practices, and developers need to realize that security problems are born of insecure software, software that is broken from a security standpoint.