\documentstyle[6.033-ps,11pt]{article}
\title{Enforcement of Computer Security}
\date{March 12, 1991}
\setallmargins{1.1in}
\begin{document}
\maketitle

Of the three alternatives proposed, only a {\em buyer beware} market
is a reasonable method of enforcing computer security.  This is not
because it is the best solution, but because it is the only viable
solution.  In my argument, I'm assuming that it is intended that the
computer industry remain viable for small companies as it is now.

Government regulation, such as that in the pharmaceutical industry,
makes it impossible for small companies to do anything at all new
without support from a large, established firm.  Right now, it costs
tens of millions of dollars and years of time in testing to bring a
new drug to market.  If the same were true of computer security
systems, it would be prohibitively expensive for all but the largest
computer companies to do security systems, and the costs would be
passed to the consumer, who might not be able to afford the products
once they were announced.  A perfect example of this is Multics, which
passed the goverment's tests, but was too expensive for general use.
Also, the government has shown that it seems to be incapable of
understand the issues involved in regulating computers.  One need only
look at the current controversy over software patents to see how
government regulation has ``protected'' computer users.

Manufacturer's liability would make the vendors very happy, but the
consumer would receive the short end of this arrangement.  Assume that
a small company buys Large Computer Company's security product, and it
proves defective.  Recovering damages from LCC would probably be so
expensive and difficult that it wouldn't happen most of the time.
Conversely, no small company would even consider producing security
software, since a liability suit would probably destroy the company,
even if the company were not at fault.

So, the only alternative is that the market enforce itself.  However,
this is only possible with cooperation between the producers and
consumers of security systems.  It is well-estabilished that only a
system which is secure when all details of the trusted computing base
are well-known can be considered truly secure.  Therefore, the
producers must make specifications, or possibly even code, available
to customers, or perhaps a private third party, for evaluation.
Products which are deemed insecure by the user community will simply
not be purchased, and so will be fixed by their vendors, or dropped.
Any system which can hold up under public scrutiny this close must be
secure, or it will be forced off the market.  In this way, the
industry can police itself, with varying standards of capabilities and
features arising out of internal demand, rather than external
regulation.  Large and small companies can coexist, since there is no
guarantee that the larger companies can produce better products.  A
self-enforcing system also allows for niches, where a user needing a
specific combination of features can find someone willing to provide
a product.

\end{document}
