Why don't companies buy more secure software?

LinuxWorld: Welcome to the Linux World Podcast. Hi, I’m Don Marti, and I’m here with Bruce Schneier from Counterpane Internet Security. Welcome, Bruce.

Bruce Schneier: Thanks for having me.

LinuxWorld: Why don’t companies buy more secure software, or at least why don’t they buy less insecure software?

Schneier: You know those of us in the security industry have been wringing our hands over that question for years, for decades. Why don’t they do it? There are a couple of reasons. The first is -- it’s sometimes hard to tell what a secure product is. I can hold up two products; they use the same buzzwords. They have the same protocol standards. What is secure, and what isn’t? And you don’t know. And these might be security products. These might be networking products or office products. It’s very hard to tell what a secure product is and what an insecure product is. That’s reason one

The second reason, companies actually don’t want to be secure, that’s wrong. They want to be secure, but it’s more important to be able to do things. So, installing a firewall, which would make you a lot more secure, a company is going to configure it pretty much open because it allows them to do peer-to-peer file sharing or use this application or do that or check their mail from afar -- all those things they want to do that go against security. So, when security goes against functionality, it often loses, especially at the high level. You can tell a lowly employee to be secure, but you’re not going to tell the CEO. That’s the second reason.

The third reason is that a lot of the insecurities we see don’t affect the company at the boardroom level. A worm and a virus attack, which might make all the tech staff scramble and work without sleep for 15 hours, the CEO doesn’t see. He doesn’t care. As far as he’s concerned that worked out great. Why bother spending? So, you have a whole lot of factors in play. It’s not that companies don’t want to be secure; it’s that they either don’t care or don’t know how or don’t understand they’re not.

LinuxWorld: So, if you’ve got, say a marketing department that asks for some big Web application to be installed, and then it turns out there’s a security issue with that, whoever is the “security person” inside the company ends up cleaning up that mess.

Schneier: And the security people know that. I mean if you say no too often, the marketing department is going to go around you. If you say no wireless, someone is going to stick an access point in. If you say no BlackBerry, someone is going to forward their mail to Google, and then get it from there. As a security officer, you’re in a very tough position of basically having to allow what the employees want to do and doing the best you can. Now, that’s not necessarily bad. If you think about it, security is there to make the company safe while it’s in business. If the company can’t do the things it wants to do, then the security is irrelevant. So, I’ll give you an easy example. And you go to Amazon.com, and you buy books, you can use a secure server. You can use SSL. You could also choose not to. And if you click on, "don’t use a secure server," you know what Amazon does? They sell you the book anyway. They realize that even though it’s less secure, it is still good business for them to sell the books. There’s an example of the business process taking precedence over security. I mean there are some things you should never do, but in general security doesn’t win when it goes against what the company wants to do as a company.