Why does product security go wrong, and what drives companies to invest in it?

It goes wrong through lack of expertise and awareness, low priority, increasing complexity, lack of collaboration and lack of testing. It is driven by laws and regulations, vulnerabilities and incidents, market requirements, customer satisfaction and requirements from other fields such as safety and privacy.

* Five causes lead to security issues; five drivers push companies to fix them. *

Causes of security issues:

• Lack of expertise and awareness: developers aren't trained to think like attackers.
• Low priority or wrong focus: features and deadlines beat non-functional requirements.
• Increasing complexity: more components, more interfaces, more third-party code.
• Lack of collaboration between R&D, security, product management and operations.
• Lack of testing: no security testing, or none until just before release.

Drivers:

• Laws and regulations: CRA, FDA, UN R155 and others make it a market-access condition.
• Vulnerabilities and incidents: the cost of a breach or recall.
• Market requirements: certifications that tenders and big customers demand.
• Customer satisfaction: customers expect safe, trustworthy products.
• Requirements from other fields: safety and privacy depend on security.