Software companies should be made liable for the security problems that arise in their products, according to security guru Bruce Schneier.
In a presentation at the LinuxWorld OpenSolutions Summit, the BT Counterpane CEO said that this was the only way to help improve IT security, the effects of which were currently taken for granted.
By modifying the cost-benefit analysis and giving greater IT security responsibility to software companies through liability assignment, security could eventually be improved, he said.
"All I need is for the cost of doing the bad [work] to increase. This is why I favour software liability because it raises the costs of bad software."
To change that, the ultimate economic responsibility for better software should be moved directly to software makers, who can directly influence the creation of more secure applications, he said. "If there is liability, we'll pay more [for software], but at least we'll get better software out of it and things will improve," Schneier said.
A penalty system would ultimately result in a more secure global IT system through better-built and better-maintained products. "That's what I want to affect, and liabilities have a way of doing that," Schneier said.
Today's more secure credit card systems were "built because the credit card companies were forced to assume the liability for fraud," Schneier said. "The trick here is to align responsibilities with capabilities."
In his talk about the economics of IT security, Schneier said today's software development system lets software vendors sell products without any real responsibility for it once users begin working with it. The situation was similar to a company that dumped pollution into a river but didn’t worry about the problem because it wasn’t directly affected by the pollution downstream, he said.
Scenarios like that "are all over [the] security [world] and a lot of security failures are due to them," Schneier said. If a third-party company loses someone's data in a breach, then that company can have little concern because the data loss wasn't ever suffered by a direct customer.
Those attitudes must change, he said. "We're living in a world where our security all depends on each other."
Original reporting by Computerworld US