Why don't companies buy more secure software?

Bruce Schneider on balancing security and functionality

Balancing security and functionality is nothing new. But is there a way to fairly allocate the security costs to the users who benefit from the functionality? We ask the LinuxWorld OpenSolutions Summit keynote speaker Bruce Schneier.

Why don't companies buy more secure software, or at least why don't they buy less insecure software?

You know those of us in the security industry have been wringing our hands over that question for years, for decades. Why don't they do it? There are a couple of reasons. The first is -- it's sometimes hard to tell what a secure product is. I can hold up two products; they use the same buzzwords. They have the same protocol standards. What is secure, and what isn't? And you don't know. And these might be security products. These might be networking products or office products. It's very hard to tell what a secure product is and what an insecure product is. That's reason one

The second reason, companies actually don't want to be secure, that's wrong. They want to be secure, but it's more important to be able to do things. So, installing a firewall, which would make you a lot more secure, a company is going to configure it pretty much open because it allows them to do peer-to-peer file sharing or use this application or do that or check their mail from afar -- all those things they want to do that go against security. So, when security goes against functionality, it often loses, especially at the high level. You can tell a lowly employee to be secure, but you're not going to tell the CEO. That's the second reason.

The third reason is that a lot of the insecurities we see don't affect the company at the boardroom level. A worm and a virus attack, which might make all the tech staff scramble and work without sleep for 15 hours, the CEO doesn't see. He doesn't care. As far as he's concerned that worked out great. Why bother spending? So, you have a whole lot of factors in play. It's not that companies don't want to be secure; it's that they either don't care or don't know how or don't understand they're not.

So, if you've got, say a marketing department that asks for some big Web application to be installed, and then it turns out there's a security issue with that, whoever is the "security person" inside the company ends up cleaning up that mess.

And the security people know that. I mean if you say no too often, the marketing department is going to go around you. If you say no wireless, someone is going to stick an access point in. If you say no BlackBerry, someone is going to forward their mail to Google, and then get it from there. As a security officer, you're in a very tough position of basically having to allow what the employees want to do and doing the best you can. Now, that's not necessarily bad. If you think about it, security is there to make the company safe while it's in business. If the company can't do the things it wants to do, then the security is irrelevant. So, I'll give you an easy example. And you go to Amazon.com, and you buy books, you can use a secure server. You can use SSL. You could also choose not to. And if you click on, "don't use a secure server," you know what Amazon does? They sell you the book anyway. They realize that even though it's less secure, it is still good business for them to sell the books. There's an example of the business process taking precedence over security. I mean there are some things you should never do, but in general security doesn't win when it goes against what the company wants to do as a company.

So, is there any way to allocate security costs onto the departments that are asking for and receiving the benefits of possibly insecure things?

That's the trick. And I think you have to do that. I mean just like many companies pass IT on to the different departments and have interdepartmental accounting, they could also pass security. If the marketing department decides that it wants to have a new application that punches a new hole into the firewall, and maybe it's good, and maybe it isn't, you could say to the department, 'This is what it is going to cost you, and the cost will be higher because of increased insecurity.' That can work pretty well for some things. For some things it won't. If you're worried about the corporation as a brand, if you're worried about a network breach that will put the company on the front page of the newspaper, you really can't allocate that to a department because it's a very, very great cost, and it affects the entire company. You have one department putting the entire company in jeopardy. So, it's harder to do that kind of economic thinking. But you're on the right track. We need to think about it economically.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Don Marti

LinuxWorld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Bitdefender 2019

This Holiday Season, protect yourself and your loved ones with the best. Buy now for Holiday Savings!

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?