LOGIN | REGISTER NOW | SUBSCRIBE
 
Print

Zeichick’s Take: Securing the data


By Alan Zeichick


 Alan Zeichick
Email
December 19, 2011 —  Whose fault is it when data is stolen? It’s rarely blamed on the programmers.

If a company executive leaves a laptop filled with confidential data in a taxicab, you probably wouldn’t blame a software developer. Instead, you’d presumably ask, why was that data on the laptop to begin with? I’ve often wondered why corporate executives have access to customer card information in the first place, and why security policies allowed such data to be downloaded to any end device, especially a not-locked-down laptop. But you wouldn’t blame the programmers.

If an unencrypted data backup tape disappears en route to a secure offsite facility, you’d yell at a sys admin, not at a C++ coder. “Why wasn’t the data encrypted?” you’d want to know. “How could it be written in plain text?” That’s the fault of the backup software, or again, security policies—not the programmer who wrote the applications whose data is being backed up.

Now, whom do you blame when hackers violate credit-card terminals? My family’s local grocery store—a Lucky store in Millbrae, Calif.—was recently penetrated by so-called skimmers, who tampered with in-store card readers and grabbed up to 500 customers’ credit card numbers. As far as we can tell, our credit card wasn’t compromised, but you can trust that we’ll be scrutinizing the Visa bill extra closely from now on.

Certainly you can blame Lucky for not ensuring the physical security of those devices. But what about the back-end programmers for the grocery chain? How about the embedded developers of the card reader’s firmware? Or how about any number of applications that were involved, from the credit-card clearinghouse to the bank? Could programmers be in any way responsible? Could they have done something, anything, to prevent this incident?

The reality is, well, no. It’s unlikely, especially since the devices were physically tampered with. But even so, it’s impossible for programmers to anticipate every possible scenario, or to model every type of threat to a complex web of applications developed by many companies, and administered by many companies.

Just as no series of locks and alarms can truly prevent a home from being targeted and robbed by criminals—or burned down by arsonists—there’s an increasing awareness that there’s nothing that developers can do to protect today’s modern interconnected application 100%. But that doesn’t mean that we shouldn’t try.

Alan Zeichick is editorial director of SD Times. Read his blog at ztrek.blogspot.com.




Related Search Term(s): security


Share this link: http://sdt.bz/36202
 
Most Read Latest News Blog Resources
Virtualization: Not just for machines anymore
Network virtualization allows multi-tiered applications to behave as though they were in a physical network
Magic announces the release of its revolutionary mobile offering for the development of business applications, with new native clients for iOS and Android platforms
Magic announced today the availability of native iOS and Android clients for its mobile enterprise application platform
Achievements and learning: Gamification comes to businesses and schools
Startup takes page from gamers by offering achievement marks to get developers more engaged in their projects
Zeichick’s Take: The handheld and the tablet, circa 1976
Texas Instruments' and Hewlett-Packard's calculators were doing things decades ago we take for granted today
Digg!  Digg
Reddit  Reddit
Slashdot  Slashdot
Share on facebook  Facebook
Share on Twitter  Twitter


Add comment


Name*
Email*  
Country     


  • Comment
Loading




close
NEXT ARTICLE
Cigital Develops Ready-to-Use Tools for Securing the Smart Grid
Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan Read More...
 
 
 
 
News on Monday
more>>
SharePoint Tech Report
more>>


   

 
 

Download Current Issue
MAY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?


 
blogs tab
Creation
To write better software, cultivate your ability to be creative.
05/19/2012 07:40 PM EST

Slick...but who needs it?
compilr.com is a well-designed site and the folks behind it seem to have their heart in the right place. But...who needs it?
05/16/2012 12:45 PM EST

How to be a better software developer
Want to be a better developer? You won't get there by mastering an interesting language or learning a new set of APIs.
05/14/2012 12:18 PM EST

Wooing Galatea
Do yourself a favor and check out Galatea 2.2, a wonderful book by novelist Richard Powers.
05/12/2012 07:05 PM EST

The world as story
An artificial-intelligence system at Carnegie Mellon seeks to understand the world by making statements about it.
05/10/2012 06:39 AM EST

The Rise of the Brogrammer, or the Rise of the Sexist Programmer?
Women in Silicon Valley get vocal about sexist ads and campaigns that contribute to a tense work environment.
05/09/2012 03:14 PM EST

 

Events calendar tab
Business Analytics Innovation Summit
5/23/2012 to 5/24/2012
Chicago
IEG

IBM Innovate Conf.
6/3/2012 to 6/7/2012
Orlando
IBM Rational

Agile Development Conference West
6/10/2012 to 6/15/2012
Las Vegas
SQE

Better Software Conf.
6/10/2012 to 6/15/2012
Las Vegas
SQE

AMD Fusion Developer Summit
6/11/2012 to 6/14/2012
Bellevue, Wash.
AMD