In May 2007, Bruce Schneir’s latest column in Wired Magazine discusses the security industry where he points out that “The primary reason the IT security industry exists is because IT products and services aren’t naturally secure. If computers were already secure against viruses, there wouldn’t be any need for antivirus products. If bad network traffic couldn’t be used to attack computers, no one would bother buying a firewall. If there were no more buffer overflows, no one would have to buy products to protect against their effects. If the IT products we purchased were secure out of the box, we wouldn’t have to spend billions every year making them secure.”
This article http://www.wired.com/politics/security/commentary/securitymatters/2007/05/securitymatters_0503 caused quite a stir in the industry, especially since it was around the same time as the massively attended InfoSecurity fair in London.
Bruce Schneier, a well known Security expert later explained in his personal blog his perspective more into detail : http://www.schneier.com/blog/archives/2007/05/do_we_really_ne.html
The point was however very well taken, and every industry should every once in a while ask this question on the future of IT Security : where should it go, what will be the next steps and how will the industry itself look like within the next 3 to 5 years.