Regulation vs. Market Forces – A collection of recent posts….
I’ve seen a few discussions around the Net recently on this topic of “market forces” being the drivers of better IT security practice versus “regulation” so I thought I would resurrect some recent posts for discussion.
- Crime Insurance – Implications of bad business IT security practices: Could swing to either side of the debate.
- Regulating IT Security Practices – PCI DSS too tough?: It doesn’t have to be seen as impossible.
- Workaround, accepted mediocrity and questionable future benefits/improvements: Giving up and taking the “easier” paths?
- Regulation is Bad! Let the market solely dictate things!….What a load of BS!: A response to some recent posts posted a few months before the recent posts.
Keen to get your thoughts.
June 3rd, 2009 at 12:36 am
@Drazen are you a supporter of restricitive IP rights, DRM, software patents, trusted computing group?
June 3rd, 2009 at 8:24 am
Ralphy, what’s the link or are you just interested in my thoughts on those subjects?
June 3rd, 2009 at 9:28 am
You can hope for market forces to erupt into magnificent flight and if you sit back and do wait, you will probably be waiting a long time. We’re going backwards, not forwards now.
We are such optimists at times in this industry while we consider ourselves cynics. We look forward to great things happening. Great change all magically brought about by invisible forces that are just around the corner and about to change our lives and of those around us. Fairy tale stuff.
What other industries did make significant change for the better without some form of regulation kicking off the process AND then the ‘market forces’ riding in on the coat tails.
June 3rd, 2009 at 10:08 am
@drazen, just your thoughts…
June 3rd, 2009 at 6:37 pm
Ralphy,
For what it’s worth and I don’t profess to being an expert on any of these:
- “IP Rights”: Big area to cover. Anything specific? Of course I support the inventor, developer etc to protect their IP. Let me clarify, as long as it is within reason and does not hinder others (within boundaries of protecting someone else’s IP) that [who] can help progress positive developments within society and/or their field.
- DRM: Scares me with what “large” companies try to do with this. Major failures to date, misguided strategies and WTF! My position? I understand the motives but the delivery has been questionable. Look at the failures over the years from the large companies to try imposing control. Hopefully you’ve read some of my somewhat related thoughts on the iiNET case here in Australia.
- Software Patents: Again, within reason, there should be some protections but more at a macro level if that makes sense. I don’t know enough to really comment more about what a “software patent” entails. If I rip-off Twitter and create the same simple application would I be in trouble? Probably not….just guessing. Should I? If you related it back to “normal” business, you probably would.
- Trusted Computing Group: I don’t really know much about them. I am cynical though of “alliances” setup by large corporates that are more marketing than substance and there’s been a few of those over the years. Most fizzle into nothing but hey, if this group has done something of substance, well that’s a good thing.
Just my thoughts. Keen to hear what you think.
DD
June 3rd, 2009 at 11:33 pm
Interesting to see this:
http://securitybuddha.com/2009/04/28/the-future-regulation-is-futile-market-forces-will-prevail/
Another buddha but with no meat to the message.
June 6th, 2009 at 10:04 pm
Oz View,
(and to the deleted anti-USA message. Why do you do that DD?) typical US view of the world. All US centric and only US or US known people can solve it. World has changed other buddha blogger and it has only changed from your view. We have never seen only USA people as the ones to have solutions! Yeah, send so and so to TED. WTF? Who else do you know. Your world seems so small. Send them! You think the WORLD actually all listens to TED? LOL. You are funny!
June 6th, 2009 at 10:44 pm
@Ralphy been following this to see your angles dude. Personally, my thoughts to DD’s:
- “IP Rights”: Big area to cover. Anything specific? Of course I support the inventor, developer etc to protect their IP. Let me clarify, as long as it is within reason and does not hinder others (within boundaries of protecting someone else’s IP) that [who] can help progress positive developments within society and/or their field.
RADAR— Accepted BUT what more can you do?
- DRM: Scares me with what “large” companies try to do with this. Major failures to date, misguided strategies and WTF! My position? I understand the motives but the delivery has been questionable. Look at the failures over the years from the large companies to try imposing control. Hopefully you’ve read some of my somewhat related thoughts on the iiNET case here in Australia.
RADAR— BS to much PC DD!
- Software Patents: Again, within reason, there should be some protections but more at a macro level if that makes sense. I don’t know enough to really comment more about what a “software patent” entails. If I rip-off Twitter and create the same simple application would I be in trouble? Probably not….just guessing. Should I? If you related it back to “normal” business, you probably would.
RADAR— TOO soft…it is all open and should be. How do you control it?
- Trusted Computing Group: I don’t really know much about them. I am cynical though of “alliances” setup by large corporates that are more marketing than substance and there’s been a few of those over the years. Most fizzle into nothing but hey, if this group has done something of substance, well that’s a good thing.
RADAR— Also never heard of them!
June 8th, 2009 at 2:42 am
God I am lazy…sorry RADAR
Yes there was somewhat of an angle…
@DrazWas trying to see where you stand on regulation that was technology related but not directly in your usual info sec rant space.
To address each point as I do realise you (or I for that matter) are not an expert in these topics…
IP Rights: you support regulation with limits. I don’t thoroughly understand what you mean by hinder others. I support limited (more limited that continually extending) copyright and other IP protections. However the total protection of IP currently prevents (legally) all sorts of things… the next Disney as you can’t reuse their stories (as they so successfully have done to past authors), hip hop musicians, whilst some a very thorough at getting permission most are not good when sampling music, should they be?
DRM: To quote “I understand the motives but the delivery has been questionable.”
Couldn’t security regulation do the same… will regulation do more harm than good?
and quote again “Hopefully you’ve read some of my… thoughts on the iiNET case here in Australia.” This is purely a copyright issue and belongs above. However you do seem to advocate people taking responsibility whether it is the end user or the service providers… why should ISPs be any different? You could hardly defend them as doing their upmost to protect IP holders rights?
Software Patents: to quote “If I rip-off Twitter and create the same simple application would I be in trouble?” If they had patented the ‘idea’ of microblogging then yes you would. That is one of the problems of regulation (well in this example) that patents which protect inventions are being used to protect ideas… like the infamous double click.
Trusted Computing Group: The TPM is wonderful… it can be used for good (for consumers and end users) things like HDD encryption and good (for business) things like locking people out of content when they don’t follow the ‘rules’.
What I think you are saying is that limited regulation is a good thing. I guess in infosec there is no regulation and in the last 40 or so years of IT we haven’t got anywhere with the existing framework, so its time to try something new?
Thinking about it now maybe my chosen examples weren’t the best as the regulation you argue for is directed at helping consumers and the regulation above general protects big business (or that is its unintended consequence). Which I think is the point I was trying to make.