Old Vulnerabilities issues

Today I was reading the article on Security week and noted that a lot of old vulnerabilities are still exploited by malware. This made me think that why the organizations are not having the old vulnerabilities patched even after 4-5 years. Its evident that most organizations are buying latest security applications to enhance their security practices. On the other hand they are not putting enough efforts to strengthen the basic security structure.

These security applications presume that the organization is having the basic security established and maintaining it throughout. Organization are superficially in an impression that since they have latest security applications their security is enhanced. It’s a mirage for the organizations. They must understand the importance of having basic security in place and ensuring that it is continuously maintained and improved. Otherwise they would be having a very showy security infrastructure but underneath they would be as vulnerable as anyone.

This is a very pinching question to CISO’s that how they need to have the perfect balance between basic security and enhancement on the upper layer. How to optimize the allocation of resources to ensure efficient and effective security infrastructure?