So the other day I was talking with my buddy Kevin Finisterre. One of the things that we were discussing was people who just don't feel that security is an important aspect of their business because their customers don't ask for it. That always makes my brain scream "WHAT!?". Here's a direct quote from a security technology vendor "We don't perform regular penetration tests because our customers don't ask us to do that."
Isn't it the service provider's/vendor's responsibility to properly manage and maintain the security of their infrastructure? Don't they have an ethical obligation to their customers to protect the service that they are offering and any information that the customers decide to store on their systems?
The real question is, how many customers would they lose if the customers heard them say that? That is after all just like saying "We don't care about security because our customers aren't asking us to care about it."
So who have I heard this from? Here's the (very) short list:
- Vendors that make security software (like email gateways, anti-virus technology, Intrusion Prevention Systems, etc).
- Vendors that make technology that is used to control our Nuclear Power Plants, Water Purification Plants, Traffic Control Systems, etc.
- Vendors that sell business enabling technologies like PHP based Content Management Systems, Commercial Web Servers, Server based applications, Web Applications, etc.
- Vendors that sell desktop applications like Financial Tracking Systems, Invoicing Systems, File Sharing Systems, Backup Solutions, etc.
- I've also heard this from MAJOR Service Providers such as Web Hosting Providers, Email Providers, Backup Service Providers, etc.
- The list goes on....
I think that people need a wake up call. This strikes me as a serious ethical issue, what about you? Leave me a comment I'm very interested in feedback on this one.
They don't do it because their customers don't ask them to?
ReplyDeleteI always assumed, as I'm sure other people also did, that the implication was implicit. A security technology vendor not offering security is oxymoronic!
You need to remember, security technology vendors are not always security experts. They might be experts in email encryption, or process monitoring, or network filtering but not in systems penetration and vulnerability exploitation. In effect, they are highly specialized software developers out to solve a unique problem with technology. But yes, people make the assumption that security technologies are secure when in fact they are usually not. As a matter of fact, most security technologies contain exploitable vulnerabilities. Take a look at milw0rm for examples of such vulnerabilities.
ReplyDelete