Can you compare it to performance enhancing drugs in sports? That is, as soon as one is detected another undetectable one--or a new undetectable version of the first one--is engineered. Then the science has to catch up with it. And by that time yet another undetectable chemical emerges.
Isn't that what IT security is about? Reactionary? Developing safeguards against potential threats...while new threats are being constantly developed? Just when we learn to counter one another one crops up that we have to figure out?
Along with
@Dame's post, "yes and no." Yes, as soon as one is detected they look for other means to defeat the system's security. "No" in that security researchers and hackers are constantly looking for new attack vectors in operating systems, applications, plug-ins, breaking encryption, etc. (zero-day exploits) Really obscure stuff like CPU temperature and fan speeds were researched and conditionally exploited (though this was more a proof of concept). Guys (script kiddies) use pre-written programs to scan for vulnerabilities while others break apart the code in a lab and look for cracks and holes.
On the user/ administrator side it is reactionary. Developing best practices, patching against known vulnerabilities, firewall rules, intrusion detection software, etc. This is where security breaks down. Either no one's found a vulnerability (or knows about it) or they are lazy and don't patch, poor security (writing down a password), social engineering, phishing/ whaling, all sorts of methods.
To expound upon my earlier post, the majority of security professionals are guys with a certification and maybe some experience. Their lives are reading log files (not bloody likely if they are swamped), patching systems, paperwork, IDS if their organization has it, and audits. They are very reactionary and tend to worry more about the admin side. When they have technical knowledge it tends to be useless in the day-to-day because it sounds impressive. Oh, you know about encryption? Awesome, what are your firewall rules and logs telling you?
(Blank stare, eyes blink) "Well, our policies in place...."
Their policies are bullshit and totally dependent upon outside sources telling them what to do. The human component fails us. A zero-day exploit is almost impossible to defend against, but most hacking methods are preventable....if the users are willing to do their jobs and if the security guy/ SysAdmin are doing theirs.
Many do not and the end users are lazy. Those components will almost never change.
A few years old, but some numbers:
Hacking, Malware, and Social Engineering Threats | IRMI.com
Hacking methods: global data breaches within Hacking 2011 | Statistic
