Fifty years of security by design: why isn't it working?

"We have known how to design safe IT systems since the 1970s. Academics have written down the principles, policymakers have nodded in agreement, and the industry has promised to do better. And yet, computers today are no more secure than they were fifty years ago. In fact, the vulnerabilities are piling up. The chance of an organization being hit by a cyber incident remains astonishingly high at one in eight."

"That question has preoccupied Bibi van den Berg, Professor of Cybersecurity Governance at the Dutch Leiden University. Together with her colleague Christina Del Real, Assistant Professor in Cyber Crisis at Leiden University's Institute of Security and Global Affairs, she delved into the archives. She presented her findings during her keynote speech at the ONE Conference in The Hague: a history of misguided incentives, conflicting interests, and a Silicon Valley culture that prays at the altar of speed."

""We said: let's just read everything that has ever been written about security by design," says Van den Berg. It turned into an archaeological quest through decades of literature. The goal was to find the origins of security by design, that vague and unclear concept everyone talks about but no one seems to be able to define. And that's not surprising. There have always been multiple conversations taking place about security by design, siloed into different worlds."

Safe IT system design principles have existed since the 1970s, yet computers remain no more secure today and vulnerabilities continue to multiply. The probability of an organization suffering a cyber incident is approximately one in eight. Archival work traced the persistence of security shortfalls to misguided incentives, conflicting interests, and a Silicon Valley culture prioritizing speed. Distinct communities—academics, industry, and policymakers—held siloed conversations with differing framings and little coordinated action. Computer scientists in the early 1970s understood that connecting machines demanded security measures analogous to placing locks on doors during house construction.

Read at Techzine Global