"it's an insurance company or government contractor getting software from an individual or a company with nine employees."
The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust/Eiffel for larger ones that can easily eliminate entire classes of attack. Ada & SPARK have been around decades. Eiffel over a decade. Hardly anyone in security-critical space using them.
Most of what you see is easily prevented. Even with small teams. They just don't care or try. A baseline stopping code injection or insecure configurations would knock out a ton of problems. The next thing that would happen, as did with DO-178B regulation & TCSEC, would be reusable components and consulting services designed to meet the standard where the cost & limited expertise is spread among many customers.
It could be done. Even for smaller players to a large degree.
"What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers."
Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.
Oh absolutely, it isn't that small teams can't create secure software, it's that product liability isn't the way to do it. Because when the lawyers come for the bad coders they just turn their pockets inside out and then go back to writing bad code, while all the HMOs carry on using OpenSSL and vulnerable XML parsers.
> Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.
Can you be more specific about your DDOS solution?
"Can you be more specific about your DDOS solution?"
The root cause is 0-days in software or bad configuration of mass-market products in most cases. The former can be detected automatically by many tools. The latter can, given the flaws I've seen so far, be spotted in 5 minute review by an amateur consultant. Mandating such things in a regulation or expecting them as "reasonable, professional standard" during a lawsuit would be a start. Prevents many DDOS bots as a side-effect.
My main solution to DDOS mitigation in the interim & part of long-term package is here:
The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust/Eiffel for larger ones that can easily eliminate entire classes of attack. Ada & SPARK have been around decades. Eiffel over a decade. Hardly anyone in security-critical space using them.
Most of what you see is easily prevented. Even with small teams. They just don't care or try. A baseline stopping code injection or insecure configurations would knock out a ton of problems. The next thing that would happen, as did with DO-178B regulation & TCSEC, would be reusable components and consulting services designed to meet the standard where the cost & limited expertise is spread among many customers.
It could be done. Even for smaller players to a large degree.
"What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers."
Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.