About InfoWorld : Advertise : Subscribe : Contact Us : Awards : Events : Store
InfoWorld HomeNewsTest CenterOpinionsProduct GuideTechIndex
 COLUMN ARCHIVE  FORUMS
 

COLUMN

 
Security Adviser
P.J. Connolly

Modest proposal II

AMONG THE platitudes we've heard from the media in the wake of the past summer's accounting scandals were the words "corporate responsibility." The funny thing is that I always thought that corporations were devised to relieve individuals of responsibility for their actions.

   ADVERTISEMENT
  

Free IT resource

Virtualization Insights from Top Experts - Learn how virtualization gets real!

Sponsored by Dell

Free IT resource

TechNet: More ways to know it, share it, and keep it running.

Sponsored by Microsoft

RELATED LINKS
»  IE 7 bug reopens debate over patch responsibilities
»  Woman ordered to pay for file-sharing will appeal
»  McAfee to buy SafeBoot for $350M
»  Security RSS feed 

IDG ENTERPRISE NETWORK
Research Reports  (CIO)
Ask the Expert  (CIO)

TOP NEWS 


IT SOLUTION SEARCH
I began thinking about this last week, when I added my voice to the chorus calling for time bombs to be built into software to ensure that systems connected to the Internet have a minimum safe patch level. After all, in many states you have to display a vehicle inspection sticker to operate a car on the public roads; an unsecured computer can be just as much a danger to public safety as an automobile with a broken headlight.

But there are more than a few differences between cars and computers. If we buy a lemon, we can sue the dealer and the manufacturer. If a car component fails during reasonable use in a way that causes economic loss, injury, or even death, we may have a case against the supplier as well as the automaker. Try suing a software vendor for economic losses; in most cases, the take-it-or-leave-it license doesn't allow for these damages.

With software, the only stick most customers -- businesses and consumers alike -- possess is the option of finding another supplier. The problem with that approach is that you don't have a lot of options in office suites or operating systems. There's no incentive in corporate America to produce quality goods without a punishment for producing shoddy and dangerous ones.

Of course, even if there were civil or criminal penalties for companies that produced software with security flaws, it might be tough to pin the responsibility on an individual or even a corporation. Think about all the foundation work in TCP/IP that was done on college campuses. Are we now going to hold liable U.C. Berkeley, MIT, and most of the Big 10 for software that was developed 10 or 20 years ago and was never intended to morph into this Brobdingnagian beast called the Internet?

Let's face it: Such an arrangement would be a lawyer's nirvana. Could I in good conscience inflict such a torrent of legislation upon our already overburdened court system?

I much prefer something I tried a long time ago with a vendor whose software was critical to my business's operations but wasn't up to par. I prepared a bill itemizing the time our company's staff had put in testing the software, replicating and documenting the errors, and recovering from software failures. When I presented the invoice at the next meeting with the vendor, I was reminded that our agreement precluded such a billing -- so I didn't get the money. But I did get my point across: The pace of bug fixes on that project picked up dramatically.

Vendors should stand behind their products and accept responsibility when their products are defective -- the question is how to punish miscreants. It's too bad that trial by ordeal is no longer an option. Jail time and fines will have to do.


P.J. Connolly is a senior analyst at the InfoWorld Test Center. Contact him at pj_connolly@infoworld.com.




RELATED ARTICLES

A modest proposal


RELATED SUBJECTS

Security

Click here for all of P.J. Connolly's past columns.


SPONSORED WHITE PAPERS
EMC - Lower costs and improve reliability-Get the EMC CLARiiON white paper!
Ciphertrust - Are you ready for Sobig.G? Learn how to protect your email systems.
CDW - Personal attention. CDW. The Right Technology. Right Away.
EMC - Explore key performance features and capabilities of EMC ControlCenter 5.1.1.
Intel - Free Intel white paper shows you how to deploy a secure wireless LAN
Cisco - FREE WHITE PAPER: BLUEPRINT to design and implement secure VPNs
Verity, Inc. - "Mass Consolidation Hits the Web-Search Market"
McDATA - Download a FREE storage consolidation white paper from McDATA(R).
Lucent Technologies - Overcoming Common Firewall Limitations
Lucent Technologies - Leverage Your Mobile High Speed Data Access. Download Free White Paper!
Nokia - Get the scoop! Mobilizing business white papers & case studies.
BMC Software - Maximize the Potential of Enterprise Data: Free white paper!
Network Associates - Free white paper - Strategies for Optimizing Network Costs and Benefits
Entrust - Manage identities across applications. Improve productivity.
Stalker Software - CommuniGate Pro - Transform your Email and Calendaring
Remedy - A NEW Gartner Research Note:Producing Quality IT Services

Search the IDG White Paper Library:


SPONSORED LINKS

INFOWORLD MARKETPLACE


» IT Compliance Conference: Nov. 5-7 in San Diego
Best Practices, Peer Experiences, & Expert Advice for Building a Defensible IT Compliance Program
» FREE Sophos Threat Detection Test
Is your AV catching everything it should? Free virus, spyware and adware scan.
» IT Audit Checklists
Prepare for your next internal IT audit. Checklists cover security, risk management, PCI, and more.
» FREE White Paper: Mitigating Rock Phish Attacks
Standard anti-phishing methods cannot defeat complex Rock Phish attacks. Learn how to fight back...
» Apply BPM and ITIL at your IT Help Desk
ServiceWise brings BPM to complete IT service while eliminating integration cost. Learn more here.




 HOME  NEWS  TEST CENTER  OPINIONS  PRODUCT GUIDE  TECHINDEX   About : Advertise : Subscribe : Contact Us : Awards : Events 

Copyright © 2009, Reprints, Permissions, Licensing, IDG Network, Privacy Policy

All Rights reserved. InfoWorld is a leading publisher of technology information and product reviews on topics including viruses, phishing, worms, firewalls, security, servers, storage, networking, wireless, databases, and web services.

Computerworld :: Network World :: CIO :: PC World :: Darwin :: CMO :: CSO
IT Careers :: JavaWorld :: Macworld :: Mac Central :: Playlist :: GamePro :: GameStar :: Gamerhelp
ITWorld Canada :: Computerwoche :: Techworld UK :: tecChannel :: IDG.se :: IDG.no