How IT can be more defensible

The lack of market power from technology buyers to compel IT suppliers to deliver more secure products is contributing to the security challenges that enterprises are facing today, according to an engineer at Google.

Thomas Dullien, a reverse engineer and vulnerability researcher at Google, told a packed audience of IT security practitioners at Black Hat Asia in Singapore that part of the problem lays with the fact that the IT market is dominated by a few large suppliers.

“With these massive conglomerates on one side, enterprises really have no market power,” said Dullien, also known as Halvar Flake, the founder of security analytics software company Zynamics that Google acquired in 2011.

“Realistically, most enterprises buy hardware and software for which they have very little input into the design process – and the CISO [chief information security officer] has even less say,” he added.

As a result of such market dynamics, an entire cyber security industry was spawned to bridge the gap between the secure products that enterprises want and what is available in the market, Dullien said.

“We have security suppliers that recognise that we can’t get what we want, so they try to sell us an approximation of what we would like to have,” he said.

Dullien pointed out that security products are “very puzzling to look at”. Some antivirus software, for example, is built on antiquated code that runs with root privileges to scan email attachments on local machines, he said.

“Anybody who architects software knows this is a bad idea. It’s puzzling why there’s still a market for products that are not all that useful,” he said, adding that such products work only by the grace of cyber attackers who may not perform quality assurance checks on the security software they are attempting to bypass.

To minimise security risks, CISOs often buy a variety of security products that are hardly differentiated, leading them to base purchase decisions on how manageable the products are, Dullien said.

Whether the security products work or not is secondary, he added, as long as the CISOs have shown they have done something to mitigate the risks.

Cyber insurance is another way to mitigate security risks and elevate the financial impact of cyber security measures to a business. For example, companies that employ better security products and a more secure infrastructure can enjoy lower premiums, Dullien said.

Dullien added that cyber insurers can also help to aggregate the buying power of enterprise customers to pressure technology suppliers to deliver better and more secure products.