A new survey report describes security teams as trapped by a lack of resources into continuing what they have been doing (which, from empirical evidence, clearly is not working) rather than migrating their efforts to what they believe they should be doing (risk analysis and threat modeling).
The survey, by Dimensional Research for Netenrich, questioned 333 IT professionals and executives from medium to large companies and asked about current security practices and planned improvements. While the general sweep of the report is clear, there are nevertheless a few problems in the details.
