Enforcement of Computer Security

Marc Horowitz

Section 4: Prof. Peter Elias Luis Rodriguez March 12, 1991

Of the three alternatives proposed, only a buyer beware market is a reasonable method of enforcing computer security. This is not because it is the best solution, but because it is the only viable solution. In my argument, I’m assuming that it is intended that the computer industry remain viable for small companies as it is now.

Government regulation, such as that in the pharmaceutical industry, makes it impossible for small companies to do anything at all new without support from a large, established firm. Right now, it costs tens of millions of dollars and years of time in testing to bring a new drug to market. If the same were true of computer security systems, it would be prohibitively expensive for all but the largest computer companies to do security systems, and the costs would be passed to the consumer, who might not be able to afford the products once they were announced. A perfect example of this is Multics, which passed the goverment’s tests, but was too expensive for general use. Also, the government has shown that it seems to be incapable of understand the issues involved in regulating computers. One need only look at the current controversy over software patents to see how government regulation has “protected” computer users.

Manufacturer’s liability would make the vendors very happy, but the consumer would receive the short end of this arrangement. Assume that a small company buys Large Computer Company’s security product, and it proves defective. Recovering damages from LCC would probably be so expensive and difficult that it wouldn’t happen most of the time. Conversely, no small company would even consider producing security software, since a liability suit would probably destroy the company, even if the company were not at fault.

So, the only alternative is that the market enforce itself. However, this is only possible with cooperation between the producers and consumers of security systems. It is well-estabilished that only a system which is secure when all details of the trusted computing base are well-known can be considered truly secure. Therefore, the producers must make specifications, or possibly even code, available to customers, or perhaps a private third party, for evaluation. Products which are deemed insecure by the user community will simply not be purchased, and so will be fixed by their vendors, or dropped. Any system which can hold up under public scrutiny this close must be secure, or it will be forced off the market. In this way, the industry can police itself, with varying standards of capabilities and features arising out of internal demand, rather than external regulation. Large and small companies can coexist, since there is no guarantee that the larger companies can produce better products. A self-enforcing system also allows for niches, where a user needing a specific combination of features can find someone willing to provide a product.