Security expert: Make vendors liable for bad code
Do that, and safer software will follow, says Bruce Schneier
Computerworld - NEW YORK -- When U.S. courts ruled more than a decade ago that consumers weren't liable for fraudulent use of their credit card numbers after the first $50, credit card companies -- which were left holding the huge bill -- took notice and dove into fighting fraud and losses.
That's the same approach needed now in the software industry to help drastically improve IT security, according to Bruce Schneier, a security expert, author and CTO of Mountain View, Calif.-based enterprise security vendor BT Counterpane. Today's more secure credit card systems were "built because the credit card companies were forced to assume the liability for fraud," Schneier said today at the opening keynote of the first LinuxWorld OpenSolutions Summit held here this week. "The trick here is to align responsibilities with capabilities."
"I think things are getting worse, not better," he said.
To change that, the ultimate economic responsibility for better software should be moved directly to software makers, who can directly influence the creation of more secure applications, he said. "If there is liability, we'll pay more [for software], but at least we'll get better software out of it and things will improve," Schneier said.
A penalty system will ultimately result in a more secure global IT system through better-built and better-maintained products. "That's what I want to affect, and liabilities have a way of doing that," Schneier said.
In his talk about the economics of IT security, Schneier said today's software development system lets software vendors sell products without any real responsibility for it once users begin working with it. That doesn't encourage software vendors to stay on top of security problems that arise, he said. The situation is similar to a company that dumps pollution into a river but doesn't worry about the problem because it's not directly affected by the pollution downstream, he said.
Scenarios like that "are all over [the] security [world] and a lot of security failures are due to them," Schneier said. If a third-party company loses someone's data in a breach, then that company can have little concern because the data loss wasn't ever suffered by a direct customer.
Those attitudes must change, he said. "We're living in a world where our security all depends on each other."
Every year, when Schneier visits his mother, he said, he cleans up her home computer and strips it of worms and other security problems. For her -- and other corporate and private users -- security is seen as mainly important to individuals, without an awareness of the interconnections between users. "I'm sorry to tell you, she really doesn't care about you," he said of his mom's lax home computer security regimen.
By modifying the cost-benefit analysis and giving greater IT security responsibility to software companies through liability assignment, security can eventually be improved, he said. "All I need is for the cost of doing the bad [work] to increase. This is why I favor software liability because it raises the costs of bad software."
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts