News

Bruce Schneier Questions Why We Need a Security Industry

The primary reason the IT security industry exists is because IT products and services aren’t naturally secure, Schneier says.

By Paul McNamara, Network World

Page 2

The whereabouts of that initial "incentive to invest in security upfront" is something of a mystery—were it there today in sufficient quantities we wouldn’t be having this discussion—but once it is located and widely acknowledged, it’s difficult to argue that the other pieces wouldn’t fall into place. Today, however, the more prominent incentive for vendors is that so many customers appear perfectly comfortable buying today’s level of security, so why should vendors invest the time, effort and money to provide more?

Next he hits the eject button.

"I know this is a utopian vision that I probably won’t see in my lifetime, but the IT services market is pushing us in this direction. As IT becomes more of a utility, users are going to buy a whole lot more services than products. And by nature, services are more about results than technologies. Service customers—whether home users or multinational corporations—care less and less about the specifics of security technologies, and increasingly expect their IT to be integrally secure."

In the meantime—the very long meantime—IT hardware and software vendors will continue to swear their fidelity to security and fail to deliver the goods. The security industry will go on pumping out products that network professionals will continue to buy and deploy because their failure to do so will lead to their unemployment, among other nasty consequences. Market forces may eventually bring us Schneier’s "utopian vision" of a standard IT infrastructure built upon ubiquitous and inherently secure services, but I’m turning 50 this year and like Schneier do not expect to see this happen in my lifetime.

He spends the balance of the column touting security services, which his company provides (not that there’s anything wrong with it), and piling up caveats to counter this type of critique of the headline and top half of the piece.

So, do we really need a security industry?

Heck, yes—but we wouldn’t if pigs could fly.

-Paul McNamara, Network World