Security Issues in Software

Systems getting hacked. Ransomware. (Computer) viruses. Why are these so commonplace? Marc Goodman has a pretty good answer(s) in his book, Future Crimes. A lifetime ago, computers weren’t everywhere; nor was the Internet. While all that has changed, the Westphalian system of sovereignty hasn’t. What’s that? It was a treaty signed in 1648 that agreed that (Western) countries were “sovereign in their territory, with no role for outside authorities to meddle in a nation’s domestic affairs”.

“(It) was preserved through a system of borders, armies, guards, gates, and guns.”

(It’s the de facto standard for all countries today).

 

But today?

“Bits and bytes flow freely from one country to the next without any border guards, immigration controls, or customs declarations…”

A (digital) crime’s victim may be in one country, the perpetrator in a second, and the money transferred to a third. Who exactly has jurisdiction in such cases? And most countries don’t cooperate with others on criminal matters anyway. The digital world is also a borderless world.

 

Another reason is that when a company gets hacked, it has no incentive to admit a breach. Why not? A company perceived to be unsafe loses business. If credit card data was lost, replacing those cards is costly. Cyber-insurance premiums increase. The stock price falls. This unwillingness to report the crime means that others don’t get to know of any risks or backdoors, which means the software products with those flaws (OS’s, MS Office, PDF, apps) don’t get fixed.

 

While we might replace our phones frequently, the same isn’t true for our laptops or all the even more ancient computers used to control dams, electricity grids and other key infrastructure. Ergo, they use software that was not only not designed for Internet based risks, but even worse, use software for which support has expired (i.e., patches and bug fixes are no longer created).

 

Now that software does everything imaginable, it has also become increasingly complex and big. Inevitably then, the number of bugs and errors has increased in proportion, making all systems even more vulnerable.

 

Then there’s the severe asymmetry in the money one gets by reporting a software security flaw to its manufacturer (Microsoft, Google, Apple, WhatsApp) v/s selling it to online criminals. While companies pay a pittance, organized crime (and yes, governments) pay in proportion to the benefits they reap.

 

And last but not least, remember those EUA (end user agreements) we sign when we install any software? Among its unreadable, incomprehensible content, we agree that the company isn’t liable for any security issues in the software. So there you have it – all the reasons security issues in software won’t go away.