Re: Charging customers on security

Security is the holy grail. Even if you direct vulnerability experts to 
endlessly test and debug you might not have the resources or the option to do 
that to every line of code that you depend on (like in the operating system).  
Absolute security is unattainable. But educating clients and end users about 
security is vital.

You can say we live in a market economy and someone is simply going to slap 
together a few lines of code and offer a lower price. But how many people 
bought a Yugo because it was the cheapest car? When buying a car, brand, 
style and safety are deciding factors too. Safety only became an issue when 
too many people suffered from the lack of it, and software is arriving at 
that turning point too. 

Crashing on the 'information superhighway' shouldn't have to be lethal. But 
those that did crash and are still in business have aquired a keen security 
awareness. 

Educating your customers about security is vital. Suppose joe cracker logs in 
with username paul and password paul, and joe cracker finds the delete 
button. Not only are you going to get the call, you're probably also going to 
be the first to figure out that someone hacked the system, you're probably 
going to have to fix it as well, and they're not going to be very 
understanding when you charge them for it. Suddenly their security has become 
your problem and liability. Issues like password and network security should 
not primarily be your responsibility, but they usually are.

There is no predisposition towards learning something requiring a high level 
of abstract understanding without incentive. But there's plenty of material 
on the net 
(http://news.google.com/news?hl=en&ned=us&q=botnet&btnG=Search+News) that 
will interest them and will make them start to wonder and become predisposed. 

Now is the time to sell your customers a Saab or Volvo.