You can guess my main target for the rest of the year. Our vulnerability assessment, antivirus and intrusion-detection tools provide a daily snapshot of the security weather. When we're attacked competently, it's immediately visible to us, like a tornado among many showers, but our new goal is to identify the security climate. I'll let you know when we start getting some useful data. Stupid 'Hack Me' Tricks Events at a recent security exhibition didn't ease my fears about the usefulness of vendor security products.
Some companies try to publicize their security by setting up hacking challenges.
They offer some minor prize, hype the contest to attract free press attention and count any connections to their published test environment as attacks. They set up one copy of their product in an entirely secure manner. They just set up the system in a way that they believe will keep the system from being hacked. Keeping the challenge further from reality, they set time limits and no doubt record everything that goes to and from the system for later analysis. They also set arbitrary definitions of what counts as a successful hack.