Security Liability Laws are NOT the Answer
Bruce Schneier’s latest opinion piece in ComputerWorld entitled Make Vendors Pay For Security Flaws is correct on premise but flawed on proposed solutions. We should make vendors pay for security flaws, but increased liability law is not the asnwer. IT managers need to learn to vote with their feet.
Mr. Schneier argues several good points. He first points out that it is mostly the consumer or the IT department that shoulders that burden of security, and the consequences of bad software security. He illustrates that software vendors have no financial incentive to make more secure products. But there are two points that I’m sure he is wrong about. I don’t believe that the end consumer should burden the cost, and I don’t believe that security liability laws are an effective solution.
[edit]Bruce has posted his article on his Schneier on Security blog, and was kind enough to link back to this rebuttal. Please click here for more discussion on the topic.[/edit]
Although I disagree, Bruce does make a good point about the end consumer picking up the cost no matter what the solution. His argument is to shift the burden from the consumer to the vendor, but that the vendor will ultimately pass off the additional cost of development back to the consumer. But there are a couple of problems with this theory.
First of all, it makes the premise that good security is something that comes after the fact. His argument supports the “build it first, put security on later” mentality. This is a very dangerous premise, and I don’t believe any good can come from it. Sadly, it does seem to be prevalent in the industry. As an industry, we need to focus more on security at all points of development. The programmer needs to have it in the back of his head at all times. It takes a lot more time to do something incorrectly and go back and fix it, then it does to do it right the first time.
But the biggest problem that I have with this premise, is that the consumer ends up paying extra for something that should be there in the first place. It takes the attitude that security is an added feature. If we have that attitude, no wonder we have software security problems.
Bruce’s call for software liability law is a dangerous premise indeed. Most countries (especially the US) are in dire need of tort reform as it is. Liability law would push up legal fees and insurance fees and do the end user no good. Laws of this nature almost inevitably stifle innovation and prevent growth. Even without presenting issues, the cost of doing business rises exponentially. Smaller and innovative companies fold because they can’t afford the added fees, allowing the larger companies to deepen their monopolistic stranglehold of the industry. Not only that, but you still haven’t taken care of the issue. Those high-volume software vendors are still looking at their huge profit margins, and they’re going to take a gamble. What’s $1 million in liability concerns for a $5 billion product line? In order to make an effect, you need to have huge damage settlements that probably go well beyond the 8th amendment. This just leads to a never ending cycle. You reduce competition brought on by smaller companies, thereby increasing the profit margins of the larger companies. You take away a potentially secure alternative, while simultaneously removing the incentive for the larger companies to provide more secure software.
The real way to wake vendors up and get them focusing on security is to make sure and get them where it counts — the bottom line. IT managers need to vote with their feet… pick software solutions from vendors with proven security records, or demand that security be in place before they purchase. Let the market do the work, not the lawyers. In some ways we’ve seen this at work already. After subsequent warnings from various organizations about IE vulnerabilities, Microsoft is seeing a defined drop in browser market share. The correct message to send software vendors is the one that tells them we’re not even going to buy it if it isn’t secure.
But there’s another force out there that, believe it or not, is going to drive the security issue a lot harder than before. That is Sarbanes-Oxely. With hundreds of IT managers currently self-auditing applications in time to get them fixed and certified for the SEC in order to avoid fines, you’re going to start to see an almost immediate shift. Applications security is a high-point, particularly around users and passwords. As managers sort through the mess, their making a mental checklist of new questions and requirements to ask of software vendors. Why are these passwords stored in plain text in the database? Why can’t this application lock out users after 3 failed password attempts? Why does the program accept a single-character as a valid password? You may laugh, but I’ve had too much personal experience with this kind of nonsense to be joking. And I guarantee you that the next application that I install is going to have these security features out of the box, or the vendor is going to put them in before I buy. And another thing… don’t let that vendor charge you for an upgrade that every one else with that application wants and needs. You do the vendor a favor by letting them develop it on your time so they can charge others.