Reason #573 to Get Motivated about Internet Security: The Cost
One of my clients is the Cyber Security Industry Association, a trade group that is trying to get policymakers to think smart about public protection when it comes to all the ways in which technology connects us. I was reading a recent article, “The Internet is Broken” in Technology Review, when I came across the following factoid:
Take Microsoft, for example. Its software mediates between the Internet and the PC. These days, of the $6 billion that Microsoft spends annually on research and development, approximately one-third, or $2 billion, is directly spent on security efforts. “The evolution of the Internet, the development of threats from the Internet that could attempt to intrude on systems — whether Web servers, Web browsers, or e-mail-based threats — really changed the equation,” says Steve Lipner, Microsoft’s director of security strategy and engineering strategy. “Ten years ago, I think people here in the industry were designing software for new features, new performance, ease of use, what have you. Today, we train everybody for security.” Not only does this focus on security siphon resources from other research, but it can even hamper research that does get funded. Some innovations have been kept in the lab, Lipner says, because Microsoft couldn’t be sure they met security standards.
In other words, instead of spending money to make our programs better, Microsoft is spending money to make our programs safe. And it’s not working. But until the public is informed and engaged enough to spur their elected representatives to action, we won’t see the kind of coordinated action between government, academia, consumer groups and private industry necessary to solve the problem. Even if the lack of action doesn’t result in the oft-predicted Internet meltdown, it will still mean we are spending way more than we need to for products that aren’t nearly as good as they could be.
