In the previous post, "Bad Treatment," I argued the current regulatory approach to cyber security is unfairly balanced and ineffective.
-
Imbalanced, because computer system owners are the target of prescriptive regulations meant, in part, to combat the deleterious effects of software vulnerabilities, while software manufacturers remain highly insulated from the costs of emitting vulnerabilities.
-
Ineffective, because computer system owners are “at the end of the pipe” of the software manufacturing process and are therefore least suited to combat vulnerability emissions no matter how hard they might try (or how much money they might be forced to spend).
Unfortunately, like World War I generals, some in the cyber security profession insist that all that is needed is more of the same…more end-user education, broader technical training, stricter configuration requirements, wider network monitoring, increased information sharing, and greater enforcement. This approach results in mandates that sacrifice in effect exactly what is gained in detail. In fact, the U.S. approach to cyber security has been a disaster, increasing the entropy of our information systems to such a degree that defenders are unlikely to ever protect them sufficiently. The situation exhibits almost a farcical quality: Compliance mandates tax software buyers (by way of additional costs) for using insecure software when the only software available is insecure.
In reality, some degree of regulation is and will be required for computer system owners – hopefully not as much as is in place now – but regulation of computer system owners without a concomitant delegation to, and accountability for, secure software from software manufacturers is dangerously incomplete both from a public policy and national security perspective.
In this installment of the “Cyber Security At the Crossroads” series I continue with the third item on our topic list (see "Introduction" for complete list) and discuss what “good” regulation for the software market might look like.
The Bare Minimum
Stuart Hart observes in his book Capitalism at the Crossroads:
The Great Trade-Off Illusion trained a generation of corporate, business, and facility-level managers to assume that societal concerns could only be drags on their business. As a consequence, [manufacturers] attitude tended to be reactive—they would do only the bare minimum necessary to avoid legal sanction.
The Great Trade-off Illusion Mr. Hart speaks of relates to the assumption by industrial manufacturers at the time that societal concerns (such as health and environment) could only impinge on business and profit performance. To be and remain competitive as an industrial manufacturer meant societal concerns were to be minimized, if not completely ignored.
As such, the first wave of environmental regulations in the 1970s certainly changed some behaviors for the better, but did little to change the prevailing mindset. Threat of sanctions became the incentive, which was itself treated as yet another business risk to be avoided where possible and paid only when forced.
Mr. Hart argues this need not have been the case; business performance and societal concerns are not mutually exclusive. The crossroads for capitalism then, was the realization and subsequent choice by business leaders that addressing societal concerns could lead to greater profits and increased market valuations as a whole. The realization and choice, unfortunately, were not entirely self-directed by philanthropic aspirations of business leaders. Government intervention, no matter how imperfect, was necessary at first to avert environmental disasters.
As bad as early environmental regulations might have been, some might argue it was better than the worst scenario: no regulation. Which is the current situation regarding software manufacturers and vulnerability emissions into cyber space. Because software manufacturer currently have no threat of legal sanctions (or any form of sanctions really) software manufacturers may opt to do anything regarding cyber security, up to and including nothing. Apple is one such example.
For years Apple happily boasted its products were more secure than products of its rival Microsoft. However, as Apple’s market share steadily increased so too have hackers’ exploitation of the company’s products (and customers). Some might mumble weakly in Apple’s defense that perfect software is not possible, but a company that touts itself as more secure than its rival should deliver on such a statement. But this has not been the case.
As Apple’s vulnerability counts steadily rise (in some years surpassing Microsoft’s), the company’s response has been less than comforting. Apple publicly waffled on recommending anti-virus for its customers (which is not entirely relevant for this discussion but was ham-handed nonetheless) and has shown a distinct lack of innovation regarding improved security for its products and thus protection for its customers. This is a shame given the company’s world famous innovative capabilities. The reality is that Apple is free not to innovate on reducing vulnerability emissions if it finds such practices too inconvenient or too expensive (this despite Apple’s gargantuan cash reserves).
But therein lays the issue. The Great Trade-off Illusion for Apple (or any software manufacturer) is that societal concerns such as cyber crime or cyber pollution (via vulnerability emissions) are perceived to impinge on business and profit performance. At this point in time, to be and remain competitive as a software manufacturer means societal concerns can be conveniently minimized, if not completely ignored. Apple is happy to advertise greener, more environmentally friendly laptops, but its software emits vulnerabilities in cyber space equivalent to that of a coal-fired power plant.
Aspire Beyond Minimum
Mr. Hart points out however that avoidance of legal sanction occurred because of prescriptive command-and-control regulations that failed to address the prevailing mindset. This is why the initial regulatory approach for industrial manufacturers and the current approach to cyber security for computer system owners is exactly the wrong approach to take with software manufacturers.
Prescriptive, command-and-control regulation, specifically cyber security compliance, should teach us one thing: compliance does not breed competitiveness; it breeds complacency and aversion. There at least two reasons for this. First, compliance is not an aspirational model. Second, compliance has no spectrum.
Compliance regulations as currently formulated for cyber security fails as an aspirational model because prescriptive mandates create a blanket of rules that stifle innovation, promotes aversion, and distorts our notion of trust. Firewalls are a lousy way to protect a network, but what incentives might appear to employ better protective technologies if audit checklists require firewalls from stem to stern? If we “trust” a computer system owner with our data simply because sanctions apply for failing to be compliant, we do not, in fact, trust them at all. Such an implicit message of distrust kills aspirations to improved security.
Second, compliance mandates provide no competitive spectrum; no granularity. Either an organization is compliant or it is not. Either the organization passes an audit, or it does not. For something as ridiculously complex as cyber security (or software security), a binary measure of compliance is outlandish. Worse, lack of granularity creates an artificial ceiling which regulated entities have little incentive to venture beyond ensuring that the “bare minimum” is the best we can ever hope for. And worst of all, the more detail that is added to security baselines, the less likely baselines will deliver the intended effect. In essence, we are “regulating down”, when we should be “regulating up.”
For these reasons, and many more, reluctance, aversion, and ineffectiveness will remain key characteristics of cyber security compliance programs until something changes (more on that on another blog post). So we have an idea of what not to do with software manufacturers. First, we should not strive for binary compliance according to some highly articulated set of coding standards. Second, we should promote competitiveness among software manufacturers. For heaven’s sake, let’s not bludgeon software manufacturers like we did industrial manufacturers or do now to computer system owners. What then might “good” regulation for software manufactures look like?
Regulate Up
First, a few words on regulation. To some, regulation is a despicable, four letter word ne’er to be mentioned by or around devout capitalists; it is the Leach of Invention, the Crusher of Profits, the Destroyer of Will. To others, regulation almost attains messianic status promising to right all that is wrong with the world (particularly capitalists; bankers more specifically).
In fact, regulation is none of these. Regulation is simply a tool. As a tool used to maximum positive effect, “good” regulation introduces important competitive variables into the market place that would be highly unlikely to appear by themselves (and no, compliance is not a competitive variable). Fuel efficiency is one such example. Without regulation, the competitive variable of “fuel efficiency” did not magically appear in the 1930s, 40s, 50s, or 60s automobile market and thus there was no competition among manufacturers to supply it. This made everyone worse off, even people that did not drive. Now that fuel efficiency is a standard competitive variable (married to increased fuel costs let’s be honest), manufacturers scramble over each other to advertise new wonderfully fuel efficient cars.
That “good” regulation can create important competitive variables is, on balance, positive. Further distinction regarding “good” regulation is still required, however. “Good” regulation is not such much a result of a debate between sense and non-sense, but a compromise between different kinds of irrationality; irrationality regarding the best and worst that can possibly happen. The inconvenient truth regarding regulation is that a majority of the costs and benefits of regulation are hidden in the future. As a consequence, imprecise, speculative measurement of costs and benefits in some fuzzy, imaginary future is the best possible analysis. This gives irrationality, no matter how balanced by analytics, wide latitude. Even at its best then, “good” regulation will incite vociferous debate and caterwauling of biblical proportions.
That said, good regulation in the software market has a number of desired characteristics:
-
Does not constrain profits: Regulated companies should make more money, not less. Say what you will about profits, but capitalism is based on making profits otherwise we wouldn’t use the word “capital.” A regulatory model should promote profits rather than sanctions. Sanctions certainly have a place in a regulatory model, but it should not be the primary focus. For software manufacturers, this means that creating more secure software results in improved profits in the process of reducing vulnerability emissions.
-
Promotes innovation, investment, and competition: Because profits can be realized (and stakeholders can be rewarded), regulated companies have an incentive to drive innovation, thus intensifying competition, improving security, and likely driving down production costs. The reason why security is so darn expensive is because the industry really isn’t innovating, just solution-finding. For software manufacturers, this means discovering new and more efficient ways of producing secure software and beating competitors at doing so.
-
Focuses on customers (or Promotes visibility): Because profits are derived from hungry customers, regulated companies have a vested interest in reducing the transactional costs to buyers at point of sale. For software manufacturers this means reducing the burden of educating buyers on “security” by contributing to and driving an objective signaling mechanism to buyers. Buyers actually do understand “fuel efficiency” without being energy experts, they do get “auto safety” without being safety engineers, and they do get “sustainability” without being biologists all because of customer-oriented signaling mechanisms. Buyers can and should get secure software without becoming geeks.
-
Promotes diversity: Because competition is intensified, some companies will undoubtedly be forced out of the market. This is efficient, allowing capital and labor to be re-allocated to more productive pursuits creating greater diversity (and relevance) of products for customers. For software manufacturers this means a greater number of addressable markets rather than less.
-
Lowers prices: Instead of paying a premium for secure software, customers pay less overall. Not only are regulated companies incentivized to innovate on reducing production costs (to make more profit), customers spend less on adjusting for inadequacies. For software buyers this means spending less on protecting software (and data) as well as spending less on software overall.
-
Optimizes oversight: Because regulatory models are dealing with a fuzzy future, a competitive model promotes more responsiveness from government regulators. Don’t get me wrong, the regulatory process will still be painful and slow, but not nearly as painful and slow as under a stodgy command-and-control regime. A competitive regulatory model requires that agencies must provide some analysis of potential costs and benefits with milestones for review (NHTSA is an example).
There are many more desirable characteristics to be certain, these are just some, and my explanations are certainly far from complete, but certainly an aspirational model that makes everyone better off is promising (and does not repeat the mistakes of the past). So we’ve covered a lot of ground in this blog post, I know, but there is one overriding message the reader should take away:
Regulate up and help dissolve the great trade-off illusion for software manufacturers.
There are still an enormous number of obstacles to regulating the software market which I will discuss in part in the next and final blog post in this series.
Till next time…
