Insurance, liability will drive security

The challenges and problems of computer and network security won’t be adequately addressed until companies can be held liable for their software and the use of their computer systems and until insurance companies begin to offer computer intrusion insurance, says one expert.

Bruce Schneier, founder and chief technical officer of Counterpane Internet Security Inc., said insurance companies and liability laws need to come into play because the real problems of computer security are not technical problems while speaking Wednesday at the RSA Conference 2002 in San Jose, Calif.

“Technology is not going to solve this,” Schneier said. “Fundamentally, security is a business problem. It’s a people problem.”

Within companies, especially software companies, security is looked at as a trade-off, he said. More secure products cost more to produce and have fewer features, which angers customers, while the other option is less secure software that could result in bad press, angry customers or regulatory pressure. Faced with that choice, many companies will offer less-secure products because the risk is smaller, Schneier said.

However, when audits, costs and liability are injected into the equation, the business analysis changes, he said. Firewalls became standard parts of companies’ security arsenals because without them companies could fail security audits, he said. Security is only driven by its ability to affect the bottom line, he said.

“The CEO (chief executive officer) is only going to do what everyone else does because that’s the business analysis,” Schneier said.

Security would affect the bottom line if developers were held liable for flaws in their software, he said.

“Software should not be exempt from normal product liability,” he said. “If no one is accountable for a problem, no one will do anything about it.”

When developers are liable for their products, they will want to transfer that liability to insurance companies to be able to predict costs and protect their bottom line, he said. This is the thinking that drives “real world” companies to insurance, he added.

“I think insurance is a big part of (improving) computer security,” he said. “In the real world, insurance drives security.”

Computer security will be aided by the presence of insurance companies in the market because insurance companies will look for a way to standardize models for determining the level of risk a potential customer poses, Schneier said. As they seek this model, they will make determinations about which products are more secure, which may, in turn, lead companies to use those more secure products in order to save money, he said.

“(Insurance companies) are going to want better products and services,” he said.

Beyond insurance, companies will also be looking for ways to reduce their computer security risks, Schneier said. Because most companies won’t be able afford their own security staffs to monitor their networks full time, the best option for reducing risk is outsourced security monitoring, he said.

“Outsourcing is the only way to make security scale,” Schneier said, adding that security services such as what fire and police departments provide are essentially outsourced services. Computer security services that are good candidates for outsourcing include monitoring, vulnerability testing and implementation and installation, he said. Schneier’s company, Counterpane, provides outsourced security monitoring services.

“Everything we want to do on the Internet we need to do securely,” he said. “The limits of security end up being the limits of the Internet.”

“The risks will always be with us,” Schneier said. “The best thing we can do is manage the risk – just like in the real world.”

The RSA Conference 2002 runs through Friday.

Counterpane, in Cupertino, Calif., is at

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now