Living with threats
Back in 2004, Bill Gates predicted that spam would be a thing of the past within two years. As we all know now, and quite a lot of people predicted at the time, far from being a solved problem, the volume of spam has continued to increase.
It's become one of those things we have become resigned to living with. We continue to fight it with filters, blacklists and other techniques, but we know there is no possibility of curing the problem completely in the foreseeable future.
A lot of security issues are like this. They become a problem, and countermeasures are put in place. But the countermeasures are not totally effective, and the problem is never totally solved. So everyone ends up paying for the partly effective fix and also dealing with the occasional attack that makes it through. Old-style viruses, zero-day exploits, modern malware: it's the same story. And trying to go after the source of the problem by shutting down the malicious websites or botnets is like playing whack-a-mole.
Even problems that are well understood and have been known about for decades suffer from this. Take buffer overflows for example: they have been known about since the early 1970s, but we still see buffer overflow based vulnerabilities. If problems as old and well known as this cannot be cured, what hope do we have that other, seemingly more difficult, problems can be cured? When we consider problems that include a human element such as phishing, spyware and malware, the chances of a complete solution is pretty much zero.
In the absence of a cure, the best approach seems to be to manage the risk. That means using the appropriate countermeasures for the environment, and recognising that there will still be some residual risk. Often a combination of countermeasures will be needed to reduce the risk to a manageable level, and end-user training if often vital to ensure that people don't fall for scams and any successful attacks are reported and dealt with appropriately.
In many ways, information security is similar to physical security in this respect. Everyone recognises that theft, fraud and other crimes will never go away, despite the countermeasures that are put in place. Perhaps it's time to realise that the same is true of information security.