LINUXWORLD - Make vendors liable for bad code says expert

Shifting the responsibility to software vendors could drastically improve IT security, expert says

When U.S. courts ruled more than a decade ago that consumers weren't liable for fraudulent use of their credit card numbers after the first US$50, credit card companies -- which were left holding the huge bill -- took notice and dove into fighting fraud and losses.

That's the same approach needed now in the software industry to help drastically improve IT security, according to Bruce Schneier, a security expert, author and CTO of U.S.-based enterprise security vendor BT Counterpane. Today's more secure credit card systems were "built because the credit card companies were forced to assume the liability for fraud," Schneier said Wednesday at the opening keynote of the first LinuxWorld OpenSolutions Summit held here this week. "The trick here is to align responsibilities with capabilities."

A major problem with IT security, he said, is that even as new software patches and other fixes are posted, not every company or home user installs them. Instead, many users, both at work and at home, aren't motivated to keep up with security because vulnerabilities are often unseen, leaving them unaware that they are risking their own operations -- and the larger global system of networks, Schneier said.

"I think things are getting worse, not better," he said.

To change that, the ultimate economic responsibility for better software should be moved directly to software makers, who can directly influence the creation of more secure applications, he said. "If there is liability, we'll pay more [for software], but at least we'll get better software out of it and things will improve," Schneier said.

A penalty system will ultimately result in a more secure global IT system through better-built and better-maintained products. "That's what I want to affect, and liabilities have a way of doing that," Schneier said.

In his talk about the economics of IT security, Schneier said today's software development system lets software vendors sell products without any real responsibility for it once users begin working with it. That doesn't encourage software vendors to stay on top of security problems that arise, he said. The situation is similar to a company that dumps pollution into a river but doesn't worry about the problem because it's not directly affected by the pollution downstream, he said.

Scenarios like that "are all over [the] security [world] and a lot of security failures are due to them," Schneier said. If a third-party company loses someone's data in a breach, then that company can have little concern because the data loss wasn't ever suffered by a direct customer.

Those attitudes must change, he said. "We're living in a world where our security all depends on each other."

Every year, when Schneier visits his mother, he said, he cleans up her home computer and strips it of worms and other security problems. For her -- and other corporate and private users -- security is seen as mainly important to individuals, without an awareness of the interconnections between users. "I'm sorry to tell you, she really doesn't care about you," he said of his mom's lax home computer security regimen.

By modifying the cost-benefit analysis and giving greater IT security responsibility to software companies through liability assignment, security can eventually be improved, he said. "All I need is for the cost of doing the bad [work] to increase. This is why I favour software liability because it raises the costs of bad software."

Join the PC World newsletter!

Error: Please check your email address.

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Todd R. Weiss

Computerworld
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?