What drew me to the security business is that it resembles an endless game of chess. Every move is almost immediately countered by another move. For every defense a new attack, for every attack a new defense. Just like in chess, it's worth thinking a few moves ahead and looking at the whole picture — if you concentrate too much on one part of the board you get blindsided. 

It's also not about any one piece. A grandmaster can beat a rookie using just the pawns and a good strategy. But if the security business is like chess, we seem to be perpetually looking for a better queen instead of improving our game-play.

In my last column I took a look at the economics of the black market for identities. Attackers are making a lot of money stealing identities and they are developing ever more sophisticated attack networks. Free from the constraints of a regular business, they copy each other's best techniques and code, continuously evolving better attacks. 

If we are to defend against this escalating threat we have to stop trying to match each move and work toward a broader strategy. That means working to build a security infrastructure that brings to bear all our defenses in a coordinated way. Breaking the silos in security is not easy, but we are already doing something very similar with our enterprise apps. 

Enterprises are using service-oriented architectures (SOA) to break monolithic applications into components, creating composite applications and integrating business processes. A few weeks ago I wrote about how companies are building security into SOA. An even more interesting topic is how we can build SOA into security.

Last week one of my colleagues attended the third annual Security Content Automation Protocol (SCAP) conference at the National Institute of Standards and Technology (NIST). SCAP is the technical component of a program that NIST is developing in conjunction with the Defense Department, National Security Agency, and Office of Management and Budget to automate security functions. 

The basic premise is that the only way we'll ever get a handle on the operational challenges of security management is to automate as many of the processes as possible. SCAP pulls information from a number of standardized information sources, including (warning: acronym soup ahead): the eXtensible Configuration Checklist Description Format (XCCDF), the Open Vulnerability Assessment Language (OVAL), Common Vulnerability Scoring System, (CVSS) and Common Vulnerabilities and Exposures (CVE) database.