Why is security usually an afterthought?

Summary:You can stumble onto an ActiveX vulnerability with a little help from Google and a 5 minute tutorial on fuzzing. When you ask and technology executive about potential security issues with virtualization you get a blank stare.

You can stumble onto an ActiveX vulnerability with a little help from Google and a 5 minute tutorial on fuzzing. When you ask and technology executive about potential security issues with virtualization you get a blank stare. And we're stuck on this patch-go-round that never ends.

All of these issues are side effects of one illness: The software industry and the customers that implement applications rarely think about security first. You see it with Web 2.0 apps, shoddy browsers and the huge patches (basically code rewrites) that plug holes in some of the more favorite Web software (IE, Skype, QuickTime etcetera). Does it strike anyone as odd that we were hit by patches for four major vulnerabilities in 24 hours this week?

Here are the priorities among software developers:

  • Cook up applications quickly;
  • Gain massive distribution;
  • Get people to install it;
  • Monetize it.

Among customers the priorities go something like this:

  • Save money;
  • Ease of use;
  • Ease of installation;
  • Enable the business somehow (and save more money).

In this state of affairs little things like security is bolted on once these applications are widely adopted. Does that make sense?

Why should we need an attack on (pick your hot software of the moment) to think about security and all of the processes that enable it? The only explanation is that developers and software companies are lazy and know there's no immediate return. It's a far easier business model to turn out crappy software and then sell us stuff to fix it. Bizarre.

Simply put, security would be a lot better if companies gave just a smidge of forethought to vulnerabilities. Sure there are a few bright spots--I thought MySpace's move to put its third party apps through some security testing before unleashing them to users was a great idea. But far too often I'm wondering why security isn't at least thought about a bit before we move on to the latest and greatest thing.

Thoughts?

Topics: Software, Security

About

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic. He was most recently Executive Editor of News and Blogs at ZDNet. Prior to that he was executive news editor at eWeek and news editor at Baseline. He also served as the East Coast news editor and finance editor at CN... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.