Safety Last: Software firms' incentives to take security seriously are too weak
economist.com
economist.com
So long as they aren't willing to resource to security and they aren't held accountable for breaches this trend will basically continue.
Often to the firm's customers, either because the firm directly lost control of private data or because their customers got hacked through their software.
If I buy a laptop and it craps out I don't send it back to the manufacturer, I take it back to the retailer.
Products have warranties, but this isn't really what I'm talking about. That was just an example of who is responsible: the person that you deal with is responsible. You buy a product or a service? The person you bought it from is 100% responsible.
>If Apache has a 0-day, what you want the bank to do about it if their website gets hacked?
The bank shouldn't be relying on software that it can't be sure is secure. If it's using Apache, and Apache has a 0-day, that shouldn't let people get all the way into their cluster and then into all their systems. They should have security in depth.
The bank is responsible for the security of their customers' data. If they rely on Apache, an open source software product that they have put no funding into, have no security checked, have not audited and have not actually put any real effort into securing, then that's their responsibility. If they don't want to be susceptible to Apache 0-day vulnerabilities, they should figure out what they need to do to not be susceptible to a 0-day. That's their problem, not mine. Never mine. Always theirs.
That's how responsibility works. That's how it's always worked. If a lawyer provides poor legal advice because a contracted investigator got something wrong, the responsibility lies with the lawyer.
They are only responsible to the extent that their contract with you allows for. Taking the example of safety deposit boxes, banks will make you sign a contract that removes liability, except in the case of gross negligence. What constitutes gross negligence is up to a court to decide. Applying that to being the victim of a cyber-attack or robbery, I don't recall a court ever not siding with a bank. Of course I don't know every single case, but maybe you can dig one up, since you seem quite motivated here.
The law doesn't allow you to sign away consumer guarantees act or sale of goods act rights (at least here in NZ).
So a bank cannot make you sign a contract that removes their liability to keep things in a safety deposit box safe, because in fact keeping them safe is the entire point of a safety deposit box. That's their responsibility.
If a bank gets hacked, and loses customer information, then it is because of poor security practices, and that is gross negligence.
Now you have a defective Raspberry Pi, the wifi chip in it doesn't work. So what do you do? You do the same thing: you take it back to the person/company you bought it from and demand a refund, a repair or a replacement depending on whether it's a systemic issue with the chip or a one-off or whatever.
If Raspberry Pi then end up taking up issue with Broadcom and complaining to them, that's their problem not yours, just as it's not your customers' responsibility to know only where they got the device.
Whose fault is it? It's probably nobody's fault. But there's still a clear chain of responsibility.
That's how you end up with a weak site run by 2 people on a shared hosting with outdated software but they put up a polished home-page with "military-grade 256-bit encryption" on it and a lock icon and a chunk of people will not know better.
I'm sure there's a proper term in economic theory for this concept someone can point out.
No one says "security of our users is our 158th priority". However their behaviour very clearly shows it.
They just want the benefits of a perception of security without actually putting in the effort. And when the chances of getting punished for it is low enough they can get away with it.
This attitude also creates opportunity for a certain class of employees/contractors to shine. The type that does a very shallow job but claims that "everything is done". Business people love that and think that person is so smart and effective.
Want backups? No problem he'll drop a single line in a cron file to generate unverified nightly backups sitting in /var/backups and says "I have taken care of backups." in 20 minutes.
Chances are nothing goes wrong for years and he'll be the super efficient hero.
But it's also possible that the business will suffer catastrophic data loss and finds out the true cost of their decisions.
The person who wants to tackle the problem more deeply gets punished because they think he/she is too slow or makes things complicated.
It can get pretty frustrating because what happens is you end up getting asked to achieve something and when you attempt to do it people will be like "no no no we didn't mean like that ... can't you just install a security plugin or something in there in an afternoon and move on to the next task?".
So you will be forced to do it in a way that is not effective/full-proof and when things go bad you still have to take the blame because it was your responsibility.
At some point I started calling people out on it.
Lack of security knowledge is the problem I think. In fact most companies that are hacked don't know it and don't have the knowledge to detect and mitigate them.
Security was much worse in the beginning of 2000's with dial ups.
Also don't forget about social engineering...that's a bigger concern than physical hacks...
With a lot of other code you can test your assumptions but how do you know you are secure? How do you test that?