Attendees at last week's ShmooCon security conference were transfixed when news broke that a hacker breached part of Kaspersky Lab's U.S. support site by exploiting a flaw in the site's programming.\n\nLooking around the conference hall in Washington D.C., I could see large groups of people staring at the news on their mobile phones and expressing a variety of opinions.\n\nThe incident was small compared to security breaches suffered by the likes of TJX and Heartland Payment Systems. But it was a big deal to the security practitioners at the conference because Kaspersky is a security vendor, entrusted by its customers to keep this sort of thing from happening to them.\n\nConfidence in security vendors was shaken further when F-Secure admitted days later that its site had been the victim of a SQL injection attack.\n\nBoth vendors deserve credit for their candor.\n\nKaspersky Senior Research Engineer Roel Schouwenberg put it bluntly: "This is not good for any company, and especially a company dealing with security," he said. "This should not have happened, and we are now doing everything within our power to do the forensics on this case and to prevent this from ever happening again."\n\nDavid Frazer, director of technology services for F-Secure's North American division, admitted it's embarrassing when a security company suffers a breach, no matter the size.\n\nThe honesty is appreciated, but they should be embarrassed.\n\nWhen security is your company's business, even the smallest breach is worthy of scorn. If you can't keep the bad guys out of your own database, how can customers reasonably expect that you'll keep theirs safe?\n\nOf course, no company is 100 percent immune from attack, even the security vendors. The key is for the vendor to be up front about that reality when the customer signs on from the outset.\n\nKaspersky and F-Secure have solid reputations in the industry and will get through this. The hope is that other security vendors take careful study of what happened and plan accordingly.\n\nThat means doing a double take at their own internal security, and being honest with customers that like everyone else, they too are at risk.\n\nAbout FUD Watch: Senior Editor Bill Brenner scours the Internet in search of FUD - overhyped security threats that ultimately have little impact on a CSO's daily routine. The goal: help security decision makers separate the hot air from genuine action items. To point us toward the industry's most egregious FUD, send an e-mail to email@example.com.