Information Security CS 526 Topic 15a Market Failure for Secure Software CS526 Topic 15a: Market Failure

Why Software Has (or appear to have) So Many Bugs? Software is complicated, and created by human Software is no more buggy, is just more targeted? Unique nature of software Near-zero marginal cost Market failure for secure software Market failure: a scenario in which individuals' pursuit of self-interest leads to bad results for society as a whole i.e., free market could lead to bad outcome Users cannot just vote for security with their money. lack of measurement for security Vendor has no incentives to produce higher quality software. Materials in the new few slides from “Geekonomics: The Real Cost of Insecure Software” by David Rice Other things are also complicated and created by human. Nothing can really stand against determined attackers? Car window can be easily broken, unscrew tire. If people can tamper with it, it is not secure. House can be easily entered. How software and hardware differ? Hardware needs to be produced, and bugs are more difficult to fix. Creation process People believe in free economy. Every agent pursues its own utility, the overall outcome is good. Companies compete, and better products win, right? Economist George Akerlof examined the market of lemons in his notable paper: "The Market for Lemons: Quality Uncertainty and the Market Mechanism", published in Quarterly Journal of Economics in 1970, in which he identified the severe lemon problems that may afflict markets characterized by asymmetrical information. He eventually received a Nobel Prize for the broad applications of the theory in this paper. Knows no quality of used car. Demand lower price. Sellers have no incentive to sell good used cars. This becomes a vicious cycle. Information imbalance between sellers and buyers. With equal access to information (either ), then market will be okay. Cars in the 50’s and 60’s are extremely unsafe, because no incentive to increase safety. -Car safety standard (five star ratings) introduced in 70’s and 80’s help improve car safety. It is not easy to standardize this. Need to design & measurement. Without standard, people are uninformed about the actual safety. CS526 Topic 15a: Market Failure

Guy Kawasaki: “The Art of Innovation” Don't worry, be crappy. An innovator doesn't worry about shipping an innovative product with elements of crappiness if it's truly innovative. Churn, baby, churn. I'm saying it's okay to ship crap--I'm not saying that it's okay to stay crappy. A company must improve version 1.0 and create version 1.1, 1.2, ... 2.0. This is a difficult lesson to learn because it's so hard to ship an innovation; therefore, the last thing employees want to deal with is complaints about their perfect baby. Innovation is not an event. It's a process. Let us look at what vendors think. Due to Guy Kawasaki, Silicon Valley venture capitalist. The first permutation of a innovation is seldom perfect--Macintosh, for example, didn't have software (thanks to me), a hard disk (it wouldn't matter with no software anyway), slots, and color. If a company waits--for example, the engineers convince management to add more features--until everything is perfect, it will never ship, and the market will pass it by. I am sure that these are good advices, but it won’t lead to secure software. To be fair, also include “Churn” CS526 Topic 15a: Market Failure

Why Vendors Lack Incentive to Produce More Secure Software Cash flows when product starts shipping. Market dominance is key to success being first often means becoming de facto standard No liability. Bugs can be patched with little cost. No expensive recall. Thorough testing is inefficient. Let the users test it and fix only the bugs that affect users For a software company to survive in the beginning, cash flow is key. For software startups, foremost self interest is survival. No liability means no need to worry about correctness and thorough testing. Find out which bugs matter most, and fix only them. CS526 Topic 15a: Market Failure

The Perversity of Patching Releasing a patch costs little Buggy software can force users to upgrade Achieving market dominance means competing with previous versions Stop releasing patches for old versions can force users to upgrade Patching provide an opportunity of offering new licensing terms Even if thoroughly testing software were possible, Venders ultimately have a perverse incentive not to make better software. This is due to nature of software; patching. CS526 Topic 15a: Market Failure

Topic 15a: Market Failure Coming Attractions … Discretionary access control CS526 Topic 15a: Market Failure