Following on the heels of my last post about the possible irresponsibility of many in the security profession. I want to look at the idea of responsibility from a different angle for a couple of reasons. First, I had a couple of comments that brought up the topic of software vendors and developers being held responsible for poorly written and insecure code. Second, there is a new “effort” launched to take the message of secure software development to those outside the security profession. There has been some conversation around whether we are wasting our time or if it will provide benefit. Third, I read this article the other day and it made me wonder if it wasn’t time to start holding web site owners responsible when their sites spread malware.
So who should be held responsible when things go wrong in “cyberspace”? (forgive me for using the word cyber I just couldn’t resist). Is it the person who wrote the software that was insecure. Maybe it is their boss or the QA department that didn’t test it fully. Maybe it’s the marketing department because they are the one’s who said that it would be released by a certain date. Possibly it is sales because they promised several customers this functionality in the next release which was already announced by Marketing. Then there is upper management who is pressuring the developers to get the new code out and they also approved the release date. Of course the share holders are also demanding results and missing dates hurts profits.
Or we could look at it from the angle that the developers haven’t been trained in secure coding practices so maybe the school that they got their degree from is the one who should be held responsible. If they didn’t go to school for coding then we can go back to blaming management for allowing them to code without proper training. But what about when you have a well written piece of software that is weakened by a poorly written piece that interacts with it. Who is to blame then?
What about web sites that are compromised because those responsible for it haven’t kept up to date with patches, upgrades and such? Do we then hold them responsible? What if they didn’t do these things because it caused another piece of software to break? Do we then hold that vendor/developer responsible?
You see there is no clear answer here because there are way too many variables. Too many ways things can go wrong. So again, what is the answer and who is responsible. Well, I don’t know the answer but I do have a suggestion. Those of us who do know how to do things securely have to help those who don’t. We have to help them understand the why and how. We have to take the message to the developers, the web admins, the small business owner who has an e-commerce site, the CXOs that run the companies.
Just as we wouldn’t expect our doctors to show us a Power Point presentation on how to set a broken bone and then tell us it’s our responsibility to do it from now on. We shouldn’t expect those who hasn’t been trained properly to secure a system. If they don’t have the skill or ability to do it themselves then they have the responsibility to ensure that it is done by someone who is competent to do it.
So this still doesn’t answer the question of who we hold responsible. I think the answer is everyone. We’re all responsible. We all have a responsibility to do our part and to pass our knowledge on to others. It’s almost impossible to nail it down to one thing as being responsible for a security problem. Just as in a ball game you can’t blame one person, one play or one mistake. If something goes wrong the best we can hope for is that we have done the best we can and covered all of our bases. Then we team up and work together to fix the problem, limit the damage and move forward.
