The industry is inexorably moving towards interoperable security standards, I cannot help but recognize that these standards (which have great utility) are almost exclusively focused on protection mechanisms, and not on detection and response mechanisms. If we assume that security must encompass protection, detection, and response can we expect future versions of standards to address the latter two? Or will this be the last mile left to developers and vendors as protection mechanisms historically were? Who will champion WS-Anasazi?
Comments