3. They don't protect against zero-day attacks
That, however, depends on how your vendor defines a zero-day attack. The original definition of zero-day is a vulnerability that has not yet been discovered -- no security tools are able to consistently stop those. But security vendors that claim their tools protect against zero-day attacks, usually mean they stop new exploits for a known vulnerability, security experts say.
Or they've instead come up with a generic fix for a new Patch Tuesday vulnerability, for example, and say they stopped a zero-day. "They just protected you from the exploits before they became public," says Marc Maiffret, CTO and chief hacking officer for eEye Digital Security.
None of this is very reassuring for customers who worry that if a zero-day were to hit, they wouldn't be protected by today's tools.
"No technology out there is reliable in finding new vulnerabilities as they are exploited in the wild," says Matasano's Ptacek. Ptacek says Cisco and ISS are the two most notorious for claiming they stop zero-day attacks, but these attacks are based on known vulnerabilities, so they don't fit the original definition of a zero-day.
While network-based IPS products can't stop zero-day attacks, host-based IPSes can because they detect buffer overflows, which many zero-day attacks use, says Maiffret.
Anamaly-based detection, where a security tool analyzes traffic based on behaviors, not signatures of known attacks, can help somewhat as an extra filter, but it won't necessarily catch a zero-day exploit. Change is a constant in networks: New routers get added and other new equipment in a merger or acquisition, for instance, and if these tools don't keep up, they end up reporting false positives.
"It's very hard to baseline behavioral systems," says Sequeira of Blue Lane. "It can give you clues and alerts, but you'll still spend a lot of time sifting through information, correlating it and using intuition atop that to make it work."
It all comes back to security products basically protecting you from the known -" rather than the unknown.
