6th European Conference - Academic Conferences

Mecealus Cronkrite et al.
with security requirements for government information systems. Security rests with the acquisition
policy and contract, vendor management controls that they defined, a non-standard approach.
However, the GAO has found that the federal government overall has major deficiencies information
security. Mainly due to the lack of technical acquisition expertise needed to interpret and apply security
requirements to contracts and the rigor and sustaining efforts required to keep validating vendor
quality. (GAO-09-661T, 2009) Therefore increasing the federal IT workforce and capabilities, DHS
NCCD can start to upgrade and improve the performance of security within the US government. Security
requirements should be equally valued and balanced as e-government requirements in order to
improve CI defence from disasters and attacks. Moreover, adding vendor non-compliance fines in the
government IT acquisition process should increase the attention paid to CI systems.
5. Conclusions and future work
There is a growing relationship between preventable software assurance failures and exposed critical
cyber infrastructure risk. Preventable software defects remain unresolved at the peril of all software
consumers and endanger the cyber infrastructure on which we all rely. The software consumer is uninformed
and cannot self assure that the outsource software they order meets an acceptable standard.
Making the security case clear enough to the public to understand is harder than making the
case to the developer and the business manager through market forces.
The growing black market economy of malware is exploiting the existing known defects in widely distributed
commercial software. Targeting known common software defects is a primary vector to enter
trusted networks and systems. Preventable programming errors make “zombie” slave computers accessories
to organized crimes. The growing criminalisation of cyber attacks is driving the need for
new controls in the previously unregulated software development culture.
Without support, the business will tend to favour of profits over safety. It is the nature of profit motivation.
Firms on their own will not decide to invest the socially optimal amount in cyber security because
it conflicts with their own rational decision making criteria. However, by supported standards it enables
the developer and publisher to mitigate preventable risk.
Improving software assurance practices is one of the key countermeasures for protecting critical infrastructure.
The industry needs to be motivated to encourage accountability and liability on behalf of
the public good by avoiding common errors. This would also raise the barriers to entry on the software
development market and ease the pressure on existing competitors who are able to adopt assurance
practices, while legitimatizing IT as a new profession responsible for entrusted with the public good
defending the critical cyber infrastructure.
The proposed approaches examined a framework of increasing government and private controls on
software quality and software assurance outcomes.
Mandate Cyber Incident Reporting for CI industries to increase transparency and research ability.
Enforce (Fines) for Federal IT Security development Non-Compliance to create better vendor
compliance.
Create better IDE tools that check for common programming errors, to help prevent the programmer
from making common errors, and increase the resilience of the software infrastructure.
Encourage professional licensing and non-repudiation for CCI Developers and Publishers to help
to increase accountability and transparency in the publisher and developer community.
The software industry will not be able to negotiate the safety standards process alone, without some
government assistance. There is a need for standards based software professional accreditation to
ensure the consistent application of basic security programming techniques and data privacy. However,
the industry should not wait for legislation. Software publishers have the ability to seize the momentum
of media awareness and establish accountability for code security within their corps.
Acknowledgements
This work is an extended study of our final team project of IST623 (Introduction to Information Security),
taught by Prof. Joon S. Park, in the School of Information Studies at Syracuse University in
Spring 2010. We would like to thank the class for valuable feedback, insight, and encouragement as
we researched and developed this project during the semester.
74