|
Another way to rephrase the question is: why don't
networked devices require signoff from a professionally licensed engineer on its specific software implementation before it goes to market? You see "forethought" in devices offered to the public when regulation DEMANDS it: think cars, bridges, medical devices, because (or so it's been rationalized), the public needs accountability (a named, professionally licensed, buck-stops-with-them head to roll) when that product can cause harm. But software harms TOO!. Think privacy, banking, relationships. Those can be harmed. It's always felt to me like a historical accident that networked devices, really most software in general, slipped past this accountability requirement. Without a specific , named accountable person, security seems to fall into the not-my-problem phenomenon, and continues generates articles like from the OP. In the imagined future where signoff from professional engineers was required, you'd see pushback against a vendor by the engineer until the implementation was secure, because the engineer's licensure was on the line until it was secure. And the vendor couldn't just "shop" for a favorable signoff, because every engineer would be held to the same ethical standard and penalty. |
It's a hard problem.