FDA for Cyber?

Back in the bad old days before the Food and Drug Administration (FDA), the government philosophy was buyer beware: ‘caveat emptor’. The result was drugs that frequently did not do what they claimed and in many cases were not even safe. Similarly, food that was spoiled or otherwise unhealthy could be sold. Every buyer had to figure it out for themselves or die trying.  

From the FDA.gov website:

“…its origins as a federal consumer protection agency began with the passage of the 1906 Pure Food and Drugs Act. This law was the culmination of about 100 bills over a quarter-century that aimed to rein in long-standing, serious abuses in the consumer product marketplace.”

Now think about how often you get software updates. How many of those are to fix serious security vulnerabilities?

I was fortunate enough to have a large Information Security organization. Part of my team did security evaluations of products the firm was considering purchasing. They regularly discovered serious vulnerabilities in commercially-available hardware and software products – vulnerabilities that anyone else could find if they applied the same resources. What about all the other organizations who don’t have the same resources? Why didn’t the vendor find these issues? How are they able to sell products with glaring flaws? Caveat Emptor. If you can’t find the problems with the product then you’re stuck with the problems the vendor hands you, potentially exposing your business and customers to huge risks.

A more disciplined approach could bake security in at the start. This applies to commercial products as well as in-house developed systems. Requiring independent testing for safety and efficacy could dramatically improve cyber security. But just as in the bad old days before the FDA there is nothing currently forcing this. Because of the FDA, when new drugs are being developed they are first evaluated for safety. Only after they are proven safe can testing for efficacy begin. You must have FDA approval before you can sell something as safe and effective. This is not optional. Consider the idea of an FDA for Cyber.

Would having an independent government agency that provides oversight over the safety of software slow down the delivery of products? Yes, initially. If it led to a transformation in the way products are created – comparable to the way medicines are tested and delivered – it might well be worth it.

For those who fear the creation of a new federal bureaucracy, consider the current cost to the economy of cyber security problems. Consider the current risks to national security, international security and global competitiveness that come from our current situation. Consider the resources you dedicate to try to protect yourself from security flaws. Unless you invest in a team like mine you are at a competitive disadvantage. You have to trust that the snake oil you are being sold will not make you sicker and will actually cure your ills. I know enough not to buy it.

One of the primary functions of government is to ensure the safety of its citizens. As proven repeatedly, cyber security is a risk. The government has a responsibility to protect us from this risk.

Now consider a brave new world where products are not delivered with built in SQL injection and XSS vulnerabilities, default back doors, missing bounds checking, authentication bypass and dozens of other incredibly common, simple security flaws that are as easy to prevent as they are to exploit. The products you buy are not only safe for your business but enhances its operations and competitiveness. You do not need to have a dedicated team of cyber security experts to check for security issues any more than you need a dedicated team of chemists to check the safety of your medicine.

Let’s not wait another 25 years to deal with the problems in the information technology industry.