Security requires economic sense

Security Summit 2009, 29 May 2009

The economic “rules” are very different when considering the security environment of the IT industry.

So said Tyler Moore, postdoctoral fellow at the Centre for Research on Computing and Society at Harvard University, during his keynote address at the ITWeb Security Summit, in Midrand, this week.

Moore stated: “Vendors believe their software is secure, but buyers are sceptical. Buyers then refuse to pay the premium rate for the product.”

Vendors need to prove to the industry that their products are secure. Moore cites two options to reduce uncertainty around product security: certification schemes and enhanced data collection methods.

Organisations can opt for certification schemes that will certify the security of their products. “However, certifications may also have an adverse effect; research has shown that 'untrustworthy' companies are more likely to be certified by using third-party trusted certification seals,” argued Moore.

Data collection presents the problem of organisations either under reporting or over reporting on their security challenges. Moore suggests the industry implement mandatory closure, such as breach notification laws.

Moore further argued, from an economic standpoint, that sharing data within the industry will exponentially reduce the cost of security threats to the organisation.

Most take-down companies only focus on security threats concerning their own clients, despite being aware of other phishing sites and cyber security threats, he noted.

To illustrate this, Moore focused on the URL feeds of a specific take-down company, calculating that over a period of six months the resulting effect of not sharing the data cost the take-down company's clients approximately $163 million.

However, had the take-down company enjoyed a shared collection of data, it is expected the cost to its clients would be approximately $113 million. This highlights the potential cost saving derived from industry cooperation.

Moore concluded that within the realm of security in the IT industry, shared data and industry cooperation makes economic sense.