THE WAY IT IS: Make vendors pay for security flaws

THE WAY IT IS: Make vendors pay for security flaws

Information insecurity is costing us billions. We pay for it in theft information and financial theft. We pay for it in productivity loss, both when networks stop working and in the dozens of minor security inconveniences we all have to endure. We pay for it when we have to buy security products and services to reduce those other two losses. We pay for security, year after year.

Unfortunately, all the money we're spending isn't fixing the problem. We're paying, but we still end up with insecurities. The problem is insecure software.

It's bad design, poorly implemented features, inadequate testing and security vulnerabilities from software bugs. The money we spend on security goes toward dealing with the effects of insecure software.

And that's the problem. We're not paying to improve the security of the underlying software. We're paying to deal with the vulnerabilities rather than eliminating them. The only way to improve the situation is for the vendors to fix their software, and they won't do that until it's in their financial best interest to do so.

Today, the costs of insecure software aren't borne by the vendors that produce it. In economics, this is known as an externality: the cost of a decision that's borne by people other than those who are making the decision.

There are no real consequences to the vendors for having bad security or for having low-quality software. Even worse, the marketplace often rewards low quality.

More precisely, it rewards additional features and timely release dates, even if they come at the expense of quality.

If we expect software vendors to reduce the number of features in their products, lengthen development cycles and invest in secure software development processes, it needs to be in their financial best interest to do so.

If we expect corporations to spend significant resources on their own network security - especially the security of their customers - it needs to be in their financial best interest to do so.

Liability law is one way to make improving security in the best interests of those organisations. The risk of liability raises the costs of doing it wrong and therefore increases the amount of money a CEO is willing to spend to do it right. Security is risk management; liability fiddles with the risk equation.

Basically, we have to tweak the risk equation so a vendor's CEO cares about actually fixing the problem. And putting pressure on his balance sheet is the best way to do that.

Clearly, this isn't all or nothing. There are many parties involved in a typical malicious attack. There's the company that sold the software with the vulnerability in the first place. There's the person who wrote the attack tool. There's the attacker himself, who used the tool to break into a network. There's the owner of the network, who was entrusted with defending that network.

One hundred per cent of the liability shouldn't fall on the shoulders of the vendor, just as it shouldn't fall on the attacker or the network owner.

But today, the cost falls directly onto the network owner, and that simply has to stop.

We will always pay for security. If software vendors have liability costs, they'll pass those on to us. It might not even end up being cheaper than what we're paying today. But as long as we're going to pay, we might as well pay to fix the problem. Forcing the software vendor to pay to fix the problem means that it might actually get fixed.

Currently, there is no reason for a software company not to offer feature after feature after feature. Liability forces software companies to think twice before changing something. It forces them to protect the data they're entrusted with.

Liability means that those in the best position to fix a problem are actually responsible for that problem.

Information security isn't a technological problem, it's an economics problem. And the way to improve information technology is to fix the economics problem. Do that, and everything else will follow.

Bruce Schneier is CTO at Counterpane Internet Security and author of Beyond Fear: Thinking Sensibly About Security in an Uncertain World (Oxford University Press, 2002). He can be reached at

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Brand Post

Show Comments

Industry Events

24 May
ARN Exchange
View all events