Mary Ann Davidson, chief security officer for database giant Oracle, remembers the first time she heard her company's marketing scheme that advertised its database products as "unbreakable."

"I think my response was 'What idiot dreamed this up?," Davidson said Thursday at the W3C conference in Edinburgh, Scotland.

If civil engineers built bridges in the same fashion in which software developers write code, people would face the "blue bridge of death" every morning going to work, Davidson said. Software developers, she noted, tend to laugh nervously when they hear the analogy -- an insider reference to what programmers call the blank, "blue screen of death" on a PC display when Windows fails.

But Davidson, who commands a security unit responsible for database applications used by multinational companies and governments, said developers often have a blind eye for security. Hackers are proving ever more capable of taking advantage of poorly written software, and it's naive for developers to think those holes won't be exploited, she said.

"The mentality needs to change," she said.

The financial cost of faulty code in software is staggering. The National Institute of Standards and Technology, a U.S. government agency, estimates computer security problems cost between $22.2 billion to $59.5 billion per year, Davidson said.

The problem of insecure software starts with how software developers are taught at universities and goes straight through to systemic vendor attitudes, Davidson said.

Software coders at Oracle often need remedial coding education after they are hired since they don't consider how "evil" input could affect their products such as databases, Davidson said. Universities are not teaching secure coding practices and are reluctant to change their curriculum, she said.

Vendors are pressured to move products into the market as quickly as possible, and often lack the tools to build better ones, Davidson said. As a result, software development is reaching a "tipping point" where poor security is a board-level issue.

The result of bad code means spiraling patching costs for both clients and companies such as Oracle. Davidson said the record for fixing one defect was 78 patches, which cost the company around $1 million.

The IDG News Service is a Network World affiliate.