As a customer, you can’t spend money on computer security. The system vendor has to have spent that money at design time and during implementation. If they underspent, it’s too late to fix it.

The sad truth is that people don’t want to pay for computer security. (Or automobile safety. Read the drunk driving stories in the newspaper.)

I think we *do* know what to do about security. Why are people still writing operting systems in C?

John asks “How are we really going to get enough security knowledge in the hands of developers to change their behavior in a sustainable way?” and the answer is clear: stop rewarding bad behavior.

“Code analysis” is good but cannot be applied to random code written by strangers. It only makes sense as part of a comprehensive theory of how a product will be assured to a desired level.

A long time ago my friend Roger showed me his plan to write a file system. I forget the exact numbers: say six months of coding and six of debugging. I said, “Let me get this straight. You are going to write mixed good code and bugs for six months, and then spend six more taking the bugs out.” Roger said, “Gee, when you put it like that it sounds sort of dumb.”

I’ll let the next 12-24 months of ‘history’ show us where static analysis goes. But, I appreciate your more punchy final paragraph. Looking at mine, I was implying the same, and challenging not only those that design systems but also those that help companies deploy security methods to think harder about solutions that wouldn’t be seen as silly.

You and I worked together, once long ago at Cigital. At the time, Cigital’s researcher would have rousing conversations about how to use their own thoughts in concert with research that had come prior to make things better. The good news is that I finally feel surrounded by a critical mass of people 1) aware enough of what’s come before them and 2) in possession of enough mental horsepower to apply it to today’s software technologies.

…better yet, I’m finding some of their “rare gem” types in client organizations!

The problem is we don’t know how to design and architect secure systems of the size and complexity that customers need. And until we learn, they’re going to continue to laugh at our silly efforts to provide unworkable patchwork solutions that are expensive and don’t pay off in the end.

Evangelism is fun, and we security guys are pretty bright, so we have a hard time admitting that sometimes the guy in the room wearing no clothes is us.