You can talk all you want about return on investment, core competencies, strategic initiatives or win-wins. No IT system in your company will really be worth its bits until it passes security muster. Bad news about security is the only constant, along with change, in the technology world.
Just this past week, the Mozilla Foundation plugged holes and leaks in its latest Firefox browser, followed by a researcher finding a denial-of-service flaw in the latest beta of Internet Explorer 7. While users waited for the so-called Feb. 3 D-Day attacks, more than 200,000 Boston-area residents found that their credit card and bank account numbers arrived as fish wrap with the morning Globe newspaper. This was after an Ameriprise employee lost a laptop with financial data from some 230,000 former and current customers. Where, or when, will it end?
Not this week. In fact, we may just be getting started. Software as a service is just as vulnerable to attack as the same application residing snugly inside your own data center, if not more, write eWEEKs Dennis Fisher, Paul F. Roberts, Peter Coffee and Ryan Naraine.
With everyone from Salesforce.com to SAP to Microsoft to Google joining in, on-demand applications are unquestionably the way that most software will be delivered in the coming years. Yet there will be few products or services on display at next weeks RSA Security Conference that focus on securing those very applications.
The paucity of third-party on-demand security solutions is only part of the problem. Malicious hackers will always be one step ahead of the patch unless developers make applications more secure from the ground up. Microsoft and Oracle, for instance, have been trying this, but they will control only a few of the many on-demand applications coming on the horizon.
In addition, most current service applications are merely “Web enabled” (remember that one?) for on-demand use and not designed with the on-demand model in mind.
This does not mean you should scrap your on-demand initiatives. IT managers should be putting all their software-as-a-service projects through the same security screens as everything else. The business model of on demand makes too much sense to fail, but only when vendors start solving their own uptime and security issues can we truly say that on demand is here to stay.
eWEEK magazine editor Scot Petersen can be reached at [email protected]