Usability of security software is partly to blame for low protection levels in many computers, according to international security experts.In a panel session at this year\u2019s Australian Unix Users Group (AUUG) conference in Melbourne Wednesday, software security developers gave reasons why the IT industry is still at the mercy of so many problems.University of Auckland computer scientist Peter Gutmann said many security standards were written 10 years ago and have mostly just been tweaked since then."A lot of the security stuff is designed by crypto-geeks, [and] because of a lack of usability, people can\u2019t apply them correctly," Gutmann said, adding usability is just as important as "having a bunch of crypto and let people figure it out from there."Gutmann said the protocols were designed without usability, and even if a user-friendly GUI could be put over it, it is unlikely the original developers would accept it."They would rather have 100 percent perfect software that\u2019s unusable than 99 percent perfect software that is usable," he said.OpenBSD developer Ryan McBride, who works on packet filter and IPSec code, lashed out at intrusion detection systems, saying the technique has no way of detecting whether a virus is attacking a network."I do IDS work in a Fortune 50 company, and it\u2019s a case of, \u2018Oh look, another box has a virus\u2014go turn it off,\u2019 " McBride said. "It\u2019s very hard to automate turning things off in security."McBride said IDS isn\u2019t the place to solve the problem, but inside the software is.University of NSW School of IT senior lecturer Dr. Lawrie Brown said when looking at modern software, part of the problem is the enormous body of unsafe software that people continue to use, which propagates vulnerabilities.Brown said there is also a mindset within the general population that computers are relatively new, and people are unaccustomed to the importance of information security.German network security PhD student Tobias Eggendorfer seconded this by saying end users are not educated to deal with security threats."It will take 20 to 30 years to educate people about computer security," he said. "You wouldn\u2019t give your house key to someone, so why do the same with your password?"By Rodney Gedda, Computerworld AustraliaKeep checking in at our Security Feed for updated news coverage.