High Tech Firms Who Outsource Software Development to China – The Dirty Little Secret

The recent attacks by China against Google have gotten a great deal of press. There are reports to Congress and information from analysis from every tech rag out there. It is being discussed at the water cooler at every tech company, blogged about, tweeted, argued and is the topic of meetings at DHS. But what is not being discussed is something that occurs every day that is much more insidious and diabolical. From January to October of 2009, China's software services industry has accomplished the operating revenue of 769.12 billion yuan, and it is estimated that the annual growth rate will be about 20 percent, becoming the most rapidly developing industry besides auto industry. 769.12 billion Chinese yuan = $112.67 billion.This is huge! A 2007 Software & Information Industry Association (SIIA) survey found that 57 percent of offshore companies (participating in the survey) have significantly increased offshore work in the past 18 months. Many plan to continue to do so. The survey goes on to state that: Growth was cited as an important or critical driver for 84 percent of respondents doing off shoring; increasing speed to market and productivity were the next most important drivers. SIIA said respondents claim to be meeting 80 percent to 100 percent of cost-saving goals. But gains in productivity appear to be less-than-expected. The Code Project (www.codeproject.com) says that: … if a software company, Evil Empire Inc., can produce its software, World Dominationware, at a cost of US$ 1 million using domestic programmers, or US$ 100,000 using offshore programmers producing software of equal quality, Evil Empire Inc.’s executives have little economic reason to choose the domestic programmers.Many of the largest US based technology firms have software development operations in China using colleges and universities to leverage the skills of Chinese developers at a lower than low rate. And these operations are growing. In fact, several US firms used the recent recession and economic downturn to layoff US works while significantly growing their Chinese based operations (not to mention other members of BRIC (Brazil, Russia, India China). But this is not the dirty little secret that is insidious in nature.Many of these US based tech firms provide technology to the US government and very large corporate entities that are part of our critical infrastructure. The software being developed in China is core to these products, sometimes developed as part of the firmware that hits ring zero. The question I have is:How much of the code being written is embedded malware?I have seen the software development practices first hand and know that they are geared towards rapid development and quick functionality returns. I have witnessed development that forgoes security in the SDLC or it is a ‘voluntary opt in’ requirement only. I have seen security removed from the SDLC to hit timelines. Why do I need to hack a company or entity when the hack is embedded and has been validated as general availability software?The dirty little secret is that this occurs daily. Software is being written for some of our most critical commercially available products by nations that are our friends on one hand yet preparing for the inevitable cyber war on the other. Software transactions with embedded malware that has been validated as the software product itself can easily transmit packets of information as needed, when required. By the time security gets into the act the scans and analysis are over a finished product. The reviews are pro forma, rudimentary and not of much substance.So as we continue to pursue cost savings at every turn, we must ask ourselves:Did the recent Google hack by the Chinese have any real significance?In light of what I wish was not true and something that I cannot prove, I think not.

Americas

Asia

Europe

Oceania

Topics

About

Policies

Our Network

More

High Tech Firms Who Outsource Software Development to China – The Dirty Little Secret

More from this author

Why cybersecurity will suffer the same fate in 2015 as it did in 2014

Most popular authors

Show me more

Arm patches bugs in Mali GPUs that affect Android phones and Chromebooks

UK businesses face tightening cybersecurity budgets as incidents spike

Cybersecurity experts raise concerns over EU Cyber Resilience Act’s vulnerability disclosure requirements

CSO Executive Sessions Australia with Nathan Morelli, Head of Cyber Security and IT Resilience at SA Power Networks

CSO Executive Sessions Australia with Nicole Neil, Director of Information Security at Seer Medical

CSO Executive Sessions Australia with Siddiqua Shaheen, Head of Cyber Governance at Lander & Rogers

CSO Executive Sessions Australia with Nathan Morelli, Head of Cyber Security and IT Resilience at SA Power Networks

CSO Executive Sessions Australia with Nicole Neil, Director of Information Security at Seer Medical

What is zero trust security?

High Tech Firms Who Outsource Software Development to China – The Dirty Little Secret

Related content

The Sandbox - RSA Conference 2014 - San Francisco

NY Times Story on Snowden Way Off the Mark

Maskirovka – Tactical, Operational, Strategic Deception

Is this gun smoking? Certified Unethical Training

From our editors straight to your inbox

More from this author

Why cybersecurity will suffer the same fate in 2015 as it did in 2014

Most popular authors

Show me more

Arm patches bugs in Mali GPUs that affect Android phones and Chromebooks

UK businesses face tightening cybersecurity budgets as incidents spike

Cybersecurity experts raise concerns over EU Cyber Resilience Act’s vulnerability disclosure requirements

CSO Executive Sessions Australia with Nathan Morelli, Head of Cyber Security and IT Resilience at SA Power Networks

CSO Executive Sessions Australia with Nicole Neil, Director of Information Security at Seer Medical

CSO Executive Sessions Australia with Siddiqua Shaheen, Head of Cyber Governance at Lander & Rogers

CSO Executive Sessions Australia with Nathan Morelli, Head of Cyber Security and IT Resilience at SA Power Networks

CSO Executive Sessions Australia with Nicole Neil, Director of Information Security at Seer Medical

What is zero trust security?