Bad Security Driving Out the Good

Bruce Schneier has up at Wired a typically thoughtful piece on how, in the security market as in others, the lemons are winning out over the good products. Schneier harks back to "The Market For Lemons," the 1970s work of economist George Akerlof, to explain why the market's invisible hand pushes most of the best products into the abyss: "With so many mediocre security products on the market, and the difficulty of coming up with a strong quality signal, vendors don't have strong incentives to invest in developing good products. And the vendors that do tend to die a quiet and lonely death."

The way of the world

[pytheron (443963)]

Marketing and persuasion always wins out in the end. How many tech guys have tried to convince a boss that whatever solution they are going with is not in the interest of the company. Even if you make an objective flow-chart/business impact plan.. their mind is made up. Dick from marketing has personality-brainwashed him. He took him to lunch, he couldn't possibly be like the other salesmen.. nice chap.

Re:The way of the world

[BSAtHome (455370)]

You are right; it is not security/xyz that sells, but the perception of securty/xyz. That is where the marketers come in.

Re:The way of the world

[Alzheimers (467217)]

In New Jersey, their governors don't have any speed limit...

The best Marketing = Religion

[LibertineR (591918)]

Tech Companies should learn this and never forget it.

Endless promotion, Endless recruitment, Constant attack on competition.

Persuasive spokespersons, Constant reminders of what you WONT get if you dont buy, and buy NOW.

An answer to every question or challenge about your product, and when that wont work, promote FAITH in the organization, and patience in the reciept of what you are really wanted.

Unashamed, unabashed belief in your product as THE ONLY real solution.

This is Evangelism, and it works better than anything else, regardless of whether you really have the goods or not.

Re:The way of the world

[Red Flayer (890720)]

It's funny, though, TFA has little to say about marketing -- except for asymmetrical information theory. Marketing ties into this because it is how companies take advantage of buyers, who have less accurate info than sellers.

The problem is not just marketing. The problem is that since buyers aren't well-informed, they choose mediocre products, which prices out the best products. This starts a nasty cycle, since with the best products out of the market, buyers then choose even poorer solutions to save a buck, which ends up pricing out the best remaining products, and so on.

Marketing takes advantage of asymmetrical information -- but the root cause is the buyer's lack of information. Given that most decision-makers do not have the resources to adequately research every purchase they make, how can this be fixed? How much should a company spend on researching products, in relation to the cost of those products? Many people can't justify spending a lot of time researching the options for a $2000/yr solution. When the proposals come in, and several[1] of the vendors offer a seemingly-equivalent solution for $1500, how can I justify spending $2000? Purchasing is about choosing products that meet your requirements at the lowest cost. It's not feasible for every purchase to undergo a full TCO analysis that includes factored risk of loss -- how many businesses employ actuaries?

Multiply this scenario by thousands, and the best solutions are driven out of business.

[1] It's important that there are multiple options at that price point, since it makes each of the products at that level seem acceptable.

Re:The way of the world

[zappepcs (820751)]

It gets better. Take an honest look at advertising, look at what they are selling and how they are selling it. Chances are better than 90% of the products you either don't need, can live without, or just plain can't use. Any product that is worth its weight simply doesn't need to be advertised.

While you are looking at marketing campaigns, see who spends the most money. I believe that the value of a product is inversely related to advertising dollars spent. With the exception of products that are new. VoIP is one of those (even though I can't for the life of me figure out what the Vonage marketers were thinking) exceptions where the product is so new that advertising is as much about education as it is selling. Sleeping aids and medicines for ailments your parents never heard of is no better than little blue pill junk mail. There are times that I think that such advertisements should be blockable and covered under the can-spam act.

Anyway, advertising sells. Without it consumers won't even know there is a product. Despite the buzz about desktop linux there actually are people in North America that do NOT know what Linux is, never mind if they want to use it. Security products and practices are the same. I haven't counted, but I know I don't have enough fingers for counting the number of times I've heard a VP spouting verbatim from some magazine article as if he learned it in college or something.

This effect is what keeps MS products so prominent, people don't actually know or understand that there are other competing products. People know about Mcafee and Norton. They don't know about ClamAV, and are not sure what Symantec does.

The open market, in this respect, is just a popularity contest.

I had hopes that sites like Consumer reports et al would change that, but no, consumers really are mostly sheep.

marketing

[gEvil (beta) (945888)]

It really boils down to marketing, IMHO. And laziness. The average person doesn't want to have to learn about something and investigate its merits. By and large they're much happier being told that Item A does XYZ, while Item B does XYZ *and* W, all while being easier to use than Item A. Despite W being a useless feature, and the "easier to use" claim being baseless, Item B will win out due to how it's been marketed.

Re:marketing

[Turn-X Alphonse (789240)]

I completely disagree.

My parents both wish to learn more but they just don't understand what thinks mean. They think "memory" (RAM) is used to hold data (Hard drive space), so getting more RAM must mean they can store more files. Logically this works, memory = storage in the classic sense and this is why marketing works. Saying "More 255 QUQUTALUU memory!" and "wow a massive 20 gig hard drive" makes it seem like these things are big and impressive, where as people who know see it's complete crap.

Maybe if we stopped calling people lazy and taught them just the basics (what RAM does, what a hard drive does etc.) they would understand marketing for the bullshit it is and see through it. But instead we sit here going "lol idiots, too lazy! idiots!" and end up having to slave over their mistakes.

Re:marketing

[gEvil (beta) (945888)]

You are correct--there are some people who honestly are interested in learning about these things so that they can make these decisions themselves. However, they are the exception, not the rule. If someone is truly interested in learning, I'm more than happy to help them out. But when offers of assistance are met with "I don't want to know about that" or "That doesn't matter to me" then all bets are off and you're on your own, as far as I'm concerned.

Money.

[Sorthum (123064)]

As TFA states, it's easy for someone to create a security product which they themselves cannot break. Hiring external testers can be a huge expense if done right, and when companies rely more on hype than on technical brilliance, they end up getting screwed. SecuStick is rare only in that its crappy security made headlines.

Re:Money.

[cyphercell (843398)]

Secustick is rare in that they admitted that their device was insecure when the flaw was discovered (highly commendable). This is something I see happening at work quite often, you simply don't talk about your mistakes or anyone elses, because people are so damn neurotic about it. You have to very carefully say what you're trying to say, or people will get defensive and supervisors get offensive. Quality takes a back seat because people don't have an f*ing clue what the difference is between accountability and guilt/incompetence. Secustick is holding themselves accountable, but I'm sure many see them as a joke.

The best understatement of the year so far?

[ZorroXXX (610877)]

Written by no other than Bruce Schneier:

... but even I couldn't tell you if Kingston's offering is better than Secustick. ... And if I can't tell the difference, most consumers won't be able to either.

Vista

[Toe, The (545098)]

Well... that explains why Vista is selling.

(Yeah I know... flamebait. But it had to be said.)

Re:Vista

[Architect_sasyr (938685)]

Is it flamebait? If I had mod points I'd probably flag as insightful. As I've stated before I'm the linux guy in a Microsoft shop and the majority of Vista upgrades (that are voluntary - so about 3% of our vista users) have done it because Vista offers better security and a slick interface, from a team of Microsoft oriented tech's, this has produced outrage. Despite the best intentions of the IT team Vista is coming regardless of what we want. I personally blame the marketing, and would cite the comment made to me not 3 days ago. "Vista has to be more secure. All the ad[vertisement]s say that it is". I can't compete with Microsofts marketing tactics (nor any other company) I simply don't have the resources. Only the respect of the IT team and the proven skill/competency in what we do has kept the CEO's from asking for the upgrades.

On Topic: Is this really a "bad security winning out" scenario, or are we merely looking at the triangle of cost, security and usability... cost and usability are of course the big factors for most corporations, so the sacrifice of security is, perhaps, merely a progression of cost cutting and the aim to supress those "annoying messages" that indicate a potential PEBKAC when inputting data.

My $0.02 AU

This story 2400 years old.

[qazsedcft (911254)]

Socrates in the 400s BC was already complaining about how sophistry is winning over logic and reason. The world will never change.

Re:This story 2400 years old.

[kisrael (134664)]

The Earth is degenerating today. Bribery and corruption abound.
Children no longer obey their parents, every man wants to write a book,
and it is evident that the end of the world is fast approaching."
--Assyrian tablet, c. 2800 BCE (allegedly)

Matter of desire

[tomstdenis (446163)]

Fundamentally people claim they want security, but are often not willing to pay for it. The business that spends the market driven required amount of time on security (even if it's not enough) wins out.

If on the other hand you spend the proper amount of time on security, and position yourself outside the market by the delay in time and additional cost, you lose.

Which is pretty much why OSS rules in terms of security. In the OSS world, we can afford to spend an extra month or two per release to make sure everyone is in order and decent procedures are followed. Which isn't to say it's always the case [most GAIM plugins are horribly written] but usually more often than not it is with things like GPG, OpenSSL, OpenSSH, etc...

Tom

Marketers are terrible.

[CastrTroy (595695)]

I find the people in Marketing are terrible not only when you're buying a product, but also when you're the company making the product. Sometimes people in marketing make stuff up just to get a sale. I think it's in their blood. It hurts both sides because the customer is expecting to get something that doesn't exist, and the development team has to now build this thing that never existed. So often it gets cobbled together really fast, just so the customer thinks it works, but it reality it's only a half working solution.

Secustick

[by Anonymous Coward]

I'm a $600/hr security consultant - you'd know my name, I used to work at - well I probably shouldn't say. I've FORGOTTEN more than Bruce Schneier knows about crypto, and I think the Secustick is a VERY secure product.

Good vs Good Enough

[Archangel Michael (180766)]

There is an invisible line between being good (as in above average) and good enough (as in gets the job done).

All things equal, people will choose good over good enough, however all things are not equal. Better products tend to cost more, better service costs more. Cheap products that do mostly marginal job wins the price war and hence wins the market.

There are always going to be niche markets that serve people who KNOW quality and service, most people don't care enough. They'll just choose whatever is cheapest at the moment from brands that they know (even if cheap), as long (and this is key) the quality is "good enough".

Which is why if I were making a product line, I'd make two different and distinct products, one "good enough" and one with better higher quality/service. I'd even go so far as to make sure by brand distinction that people would knwo "cheap, but good enough" from "good" by using strong branding.

Take McDonalds vs any higher quality hamburger shop (Red Robin, White Castle etc), which one is "good enough" vs good. Why don't more people choose the better burger?? It is because McDonalds is "good enough". And in spite of everyone complaining about McDonalds employee quality of service, it is "good enough" to keep going back.

Computer Security - The Problem for Joe Blow

[Grashnak (1003791)]

I feel there is a basic problem when we consider computer security for the average user (not people who have professional or legal obligations to protect their data). There are now two types of average users, those who are so dumb they don't have any security at all (no firewall, no anti-virus, open Wi-Fi etc). These people need to be educated. On the other hand, there is an increasing population of average users who have been turned into paranoid security freaks.

Most people have no need of a USB key that self-destructs. They don't need to encrypt their hard drives, on which they probably store nothing more sensitive than their really bad first novel draft. They don't need a 26 character Hex password on their operating system. I suspect that a much higher percentage of these normal people lose their data because they can't remember the password to access the data than lose it due to not having tight enough encryption protection. They are out there having to reformat their drive because they can't remember their login password, or having their laptop explode because they installed the new "Explodo-Crypt" device and then accidently had the caps lock key on when they tried to access it.

People need to get effective security solutions for their REALISTIC needs.

Maytag Washers

[a_nonamiss (743253)]

My grandmother bought a Maytag washer in the 1950's. In 2003, the knob on the front broke. 50 years later, it still washed clothes fine, but there were vice grips clamped to the stem where the knob was. Maytag doesn't make that part any more, so she replaced it with a new top-of-the-line Maytag. It broke last year. My parents bought a Maytag in 1972. It's still working fine. From what I've read about the new ones, they're complete crap. What's more, there isn't a washing machine on the market that could last 30 years, let alone 50 years. They aren't made to last that long.

It's because there's no financial incentive for a company to make good washing machines any more. The ones out there are rushed to market, made of inferior quality parts and put together poorly. If I have to buy a new one in 5 years, even better for the company that makes it. They get to sell me another one.

In the free-market economy, if I decided to make a 50 year washing machine, I'd have to compete with companies that are established in the market. My washer would necessarily be more expensive than a GE or Whirlpool, and nobody's ever heard of my company. On the off-chance some people buy it, realize that it's great and it gets a good reputation, I'm still faced with the fact that once everyone in the world has a 50 year washer, I'm out of customers until 2057. Now what?

I used Washing Machines as an example here, but it's true of nearly every consumer device out there. I'm not sure what the solution is, but I don't see it getting better any time soon.

Re:The winners are never the best.

[Simon80 (874052)]

Check your spelling [tfd.com] before you send your messages, you're hurting my eyes!

Re:Uh-oh "market failure"...

[Bluesman (104513)]

Nobody argues the free market is infallible. If they do, don't listen.

What people argue is that the free market is "good enough," and is a system that is so complex and quick to react, that any attempt to regulate it for its own good should be looked at long and hard -- simply because it's so difficult to do better without detrimental ramifications, even with the best of intentions.

Natural monopolies are a problem and environmental costs are a problem, and are good targets for regulation.

"Imperfect information" -- I don't understand where this idea got started, but it's completely wrong when applied to free markets. It has to do with zero-sum games like the bond market where there are definitely winners and losers -- here, the guy with the best information wins.

In a free market, when a transaction takes place, the idea is that both parties are better off than they were before. I make a piece of furniture to sell you, you buy it because you can't make as good a piece of furniture for as low a price. I make a profit, and you profit by using your time more efficiently. We both win, despite the fact that I'm a furniture expert and you don't know every detail about the construction of the chair I sold you.

In fact, it's precisely this reason, that you don't need to have perfect information to participate to your advantage, that the free market works.

No, it's not perfect, but it's the best we've got in a free society.

Re:Uh-oh "market failure"...

[marcosdumay (620877)]

"What people argue is that the free market is "good enough," and is a system that is so complex and quick to react, that any attempt to regulate it for its own good should be looked at long and hard -- simply because it's so difficult to do better without detrimental ramifications, even with the best of intentions."

In other words: "La la la la. I'm not hearing you". We've already saw how the free market behaves, and didn't like it. The deployed solution was regulation, and that made the situation better, but created a lot of problems itself. Can you put any other alternative on the table?

And imperfect information IS a problem. You enter a deal if you THINK you'll be better after than before it. What you think will happen doesn't have to resemble what will really happen, they just are the same thing if you have perfect information.