Geekonomics

by Rice, David

• ISBN13: 9780321477897
• ISBN10: 0321477898
• Edition: 1st
• Format: Hardcover
• Copyright: 2008-01-01
• Publisher: Addison-Wesley Professional

Summary

"The clarity of Davidrs"s argument and the strength of his conviction are truly inspiring. If you donrs"t believe the world of software affects the world in which you live, you owe it to yourself to read this book." Lenny Zeltzer, SANS Institute faculty member and the New York Security Consulting Manager at Savvis, Inc. "Geekonomicsstays with you long after you finish reading the book. You will reconsider every assumption you have had about software costs and benefits." Slava Frid, Gemini Systems, CTO, Resilience Technology Solutions "Information Security is an issue that concerns governments, companies and, increasingly, citizens. Are the computer systems and software to which we entrust our sensitive and critical information, technologies that are out of control? David Rice has written an important and welcome book that goes to the heart of this issue, and points to solutions that society as a whole needs to debate and embrace." Nick Bleech, IT Security Director, Rolls-Royce "If you are dependent upon software (and of course, all of us in the modern world are) this book is a fabulous discussion of how and why we should worry." Becky Bace The Real Cost of Insecure Software bull; In 1996, software defects in a Boeing 757 caused a crash that killed 70 peoplehellip; bull; In 2003, a software vulnerability helped cause the largest U.S. power outage in decadeshellip; bull; In 2004, known software weaknesses let a hacker invade T-Mobile, capturing everything from passwords to Paris Hiltonrs"s photoshellip; bull; In 2005, 23,900 Toyota Priuses were recalled for software errors that could cause the cars to shut down at highway speedshellip; bull; In 2006 dubbed "The Year of Cybercrime," 7,000 software vulnerabilities were discovered that hackers could use to access private informationhellip; bull; In 2007, operatives in two nations brazenly exploited software vulnerabilities to cripple the infrastructure and steal trade secrets from other sovereign nationshellip; Software has become crucial to the very survival of civilization. But badly written, insecure software is hurting peopleand costing businesses and individuals billions of dollars every year. This must change. InGeekonomics, David Rice shows how we can change it. Rice reveals why the software industry is rewarded for carelessness, and how we can revamp the industryrs"s incentives to get the reliability and security we desperately need and deserve. Yours"ll discover why the software industry still has shockingly little accountabilityand what we must do to fix that. Brilliantly written, utterly compelling, and thoroughly realistic,Geekonomicsis a long-overdue call to arms. Whether yours"re software user, decision maker, employee, or business owner this book will change your lifehellip;or even save it. The Alarming Cost of Insecure, Badly Written Software... and How to Finally Fix the Problem, Once and for All! Six billion crash test dummies: why yours"re at greater risk than you ever imagined. You pay the price: why c

Table of Contents

Preface	p. xiii
Acknowledgments	p. xix
About the Author	p. xx
The Foundation of Civilization	p. 1
Software and Cement	p. 4
In the Shadow of Utility	p. 10
Fragile Analogies	p. 15
Six Billion Crash Test Dummies: Irrational Innovation and Perverse Incentives	p. 19
The Story of Crash Test Dummies	p. 24
Five Stars and Rising	p. 26
You Can Learn a Lot From a Dummy	p. 29
Private Benefits, Social Costs	p. 38
Market Failure Martini, Straight Up	p. 42
The Need for Speed	p. 48
The Perversity of Patching	p. 53
Irrationally New	p. 59
Market Failure Martini, with a Twist of Lemon	p. 64
Wrap Up: The Martini Hangover	p. 68
The Power of Weaknesses: Broken Windows and National Security	p. 73
Only the Stupid Are Caught	p. 75
An Underground Market	p. 83
Numbers Don't Always Measure	p. 87
Fraud and Terror	p. 91
Information's War	p. 94
The Theory of Broken Windows	p. 101
Broken Upon Receipt	p. 108
Blind Risk	p. 112
Enter the Dragons	p. 117
Evil Inside	p. 120
Fixing Broken Windows	p. 127
Myopic Oversight: Blinded by Speed, Baffled by Churn	p. 131
The Law of Churn, the Decree of Speed	p. 133
Free Hands Have Consequences	p. 137
X-Rays Show More Than You Think	p. 141
Don't Slow Us Down, We Have Lives to Save	p. 144
Discovered Only After the Damage Is Done	p. 146
Knobs of Unknown Origin	p. 148
We'll Be Compliant, Later	p. 152
Speed Blind	p. 156
You Can Learn a Lot From an Interstate Highway System	p. 161
A Matter of Trust	p. 167
One of Skill in the Art	p. 172
Absolute Immunity: You Couldn't Sue Us Even If You Wanted To	p. 179
The Forces of Failure	p. 185
Absolution for Dereliction	p. 188
Victims of a Border War	p. 194
Duty, Breach, Cause, Damage	p. 202
Teleporting Tigers	p. 208
The Least-Cost Avoider	p. 212
Negligence Versus Strict Liability	p. 215
Stripping Immunity	p. 217
Strict Liability and Aeronautical Charts	p. 221
The Tort of Negligent Enablement of Cyber Crime	p. 232
The Verdict	p. 236
Open Source Software: Free, But at What Cost?	p. 243
Open and Shut	p. 244
The History of Free and Open	p. 251
An Incentive to Itch	p. 258
The Question of Sustainable Security	p. 264
Distributed Immunity: No Body to Kick, No Soul to Condemn	p. 268
Doffing the Wizard Hats	p. 269
Moving Forward: Rational Incentives for a Different Future	p. 273
Hands-off	p. 275
An Inconvenient Tort	p. 288
One Ring to Rule Them All	p. 291
The Great Screw	p. 301
A Market for Weakness	p. 307
Closure	p. 318
Epilogue	p. 321
Notes	p. 325
Index	p. 341
Table of Contents provided by Ingram. All Rights Reserved.

Excerpts

Extreme Programming Installed Preface You may or may not have an inkling of what insecure software is, how it impacts your life, or why you should be concerned. That is OK. This book attempts to introduce you to the full scope and consequence of software's impact on modern society without baffling the reader with jargon only experts understand or minutia only experts care about. The prerequisite for this book is merely a hint of curiosity. Although we interact with software on a daily basis, carry it on our mobile phones, drive with it in our cars, fly with it in our planes, and use it in our home and business computers, software itself remains essentially shrouded--a ghost in the machine; a mystery that functions but only part of the time. And therein lays our problem. Software is the stuff of modern infrastructure. Not only is software infused into a growing number of commercial products we purchase and services we use, but government increasingly uses software to manage the details of our lives, to allocate benefits and public services we enjoy as citizens, and to administer and defend the state as a whole. How and when we touch software and how and when it touches us is less our choice every day. The quality of this software matters greatly; the level of protection this software affords us from harm and exploitation matters even more. As a case in point, in mid-2007 the country of Estonia, dubbed "the most wired nation in Europe" because of its pervasive use of computer networks for a wide array of private and public activities, had a significant portion of its national infrastructure crippled for over two weeks by cyber attacks launched from hundreds of thousands of individual computers that had been previously hijacked by Russian hackers. Estonia was so overwhelmed by the attacks Estonian leaders literally severed the country's connection to the Internet and with it the country's economic and communications lifeline to the rest of the world. As one Estonian official lamented, "We are back to the stone age." The reason for the cyber attack? The Russian government objected to Estonia's removal of a Soviet-era war memorial from the center of its capital Tallinn to a military cemetery. The hundreds of thousands of individual computers that took part in the attack belonged to innocents; businesses, governments, and home users located around the world unaware their computers were used as weapons against another nation and another people. Such widespread hijacking was made possible in large part because of insecure software--software that, due to insufficient software manufacturing practices leaves defects in software that allows, among other things, hackers to hijack and remotely control computer systems. Traditional defensive measures employed by software buyers such as firewalls, anti-virus, and software patches did little to help Estonia and nothing to correct software manufacturing practices that enabled the attacks in the first place. During the same year, an experienced "security researcher" (a euphemism for a hacker) from IBM's Internet Security Systems was able to remotely break into and hijack computer systems controlling a nuclear power plant in the United States. The plant's owners claimed their computer systems could not be accessed from the Internet. The owners were wrong. As the security researcher later stated after completing the exercise, "It turned out to be the easiest penetration test I'd ever done. By the first day, we had penetrated the network. Within a week, we were controlling a nuclear power plant. I thought, 'Gosh, this is a big problem.'" Indeed it is. According to IDC, a global market intelligence firm, 75 percent of computers having access to the Internet have been infected and are actively being used without the owner's knowledge to conduct cyber attacks, distribute unwanted email (spam), and support criminal and terrorist activities. To solely blame hackers or hundreds of thousands of innocent computer users, or misinformed--and some might say "sloppy"--power plant owners for the deplorable state of cyber security is shortsighted and distracts from the deeper issue. The proverbial butterfly that flaps its wings in Brazil causing a storm somewhere far away is no match for the consequences brought about by seemingly innocuous foibles of software manufacturers. As one analyst commented regarding insecure software as it related to hijacking of the nuclear reactor's computer systems, "These are simple bugs mistakes in software, but very dangerous ones." The story of Estonia, the nuclear reactor, and thousands of similar news stories merely hint at the underlying problem of modern infrastructure. The "big problem" is insecure software and insecure software is everywhere. From our iPhones (which had a critical weakness in its software discovered merely two weeks after its release) to our laptops, from the XBOX to public utilities, from home computers to financial systems, insecure software is interconnected and woven more tightly into the fabric of civilization with each passing day and with it, as former U.S. Secretary of Defense William Cohen observed, an unprecedented level of vulnerability. Insecure software is making us fragile, vulnerable, and weak. The threat of global warming might be on everyone's lips, and the polar ice caps might indeed melt but not for a time. What is happening right nowbecause of world-wide interconnection of insecure software gives social problems once limited by geography a new destructive range. Cyber criminals, terrorists, and even nation states are currently preying on millions upon millions of computer systems (and their owners) and using the proceeds to underwrite further crime, economic espionage, warfare, and terror. We are only now beginning to realize the enormity of the storm set upon us by the tiny fluttering of software manufacturing mistakes and the economic and social costs such mistakes impose. In 2007, "bad" software cost the United States roughly $180 billion; this amount represents nearly 40 percent of the U.S. military defense budget for the same year ($439 billion) or nearly 55 percent morethan the estimated cost to the U.S. economy ($100 billion) of Hurricane Katrina, the costliest storm to hit the United States since Hurricane Andrew.1 Since the 1960s, individuals both within and outside the software community have worked hard to improve the quality, reliability, and security of software. Smart people have been looking out for you. For this, they should be commended. But the results of their efforts are mixed. After 40 years of collaborative effort with software manufacturers to improve software quality, reliability, and security, Carnegie Mellon's Software Engineering Institute (SEI)--an important contributor to software research and improvement--declared in the year 2000 that software was getting worse, not better.. Such an announcement by SEI is tantamount to the U.S. Food and Drug Administration warning that food quality in the twenty-first century is poorer now than when Upton Sinclair wrote The Junglein 1906.2Unlike progress in a vast majority of areas related to consumer protection and national security, progress against "bad" software has been fitful at best. While technical complications in software manufacturing might be in part to blame for the sorry state of software, this book argues that even if effective technical solutions were widely available, market incentives do not work for, but work againstbetter, more secure software. This has worrisome consequences for us all. Incentives matter. Human beings are notoriously complex and fickle creatures that will do whatever it takes to make themselves better off. There is nothing intrinsically wr