The 2015 Trust Wave Security Report calculates that attacks on end users enjoys an ROI of 1,425%.
Can you guess the liability for producing software that allows attacks on end users?
It’s the same amount as the return on making software secure. That is 0% ROI.
No doubt the Obama administration will spend $millions if not $billions in its multi-year cyber egg roll to improve cybersecurity for government networks, but the result will be:
an insecure IT stack topped off by insecure security software.
Unless and until there are economic incentives and hence meaningful ROIs for secure software, cyberinsecurity will continue.
Given the near idolatry of capitalism and economic incentives in the United States, it is truly surprising that lesson remains unlearned.
Well, save for the realization that secure software requires more investment in tools, training and testing, than current approaches to building commercial software.
Customers demanding more secure software, who are willing to pay more for secure software and liability for the production of insecure software, are all keys to solving (over time) the current state of cyberinsecurity.