-1

Why is it so hard for companies to implement better security when developing their websites? For example, Sony, a multi-million dollar company thought it was okay to store user names, passwords, and credit card information in plain text on their servers. Why couldn't the programmers encrypt the data before storing the information?

I highly doubt that the programmers are doing away with security just to speed up web development.

I always thought that no good computer programmer would take out security just to speed up development on a web page or application.

So what is really going on? Are the developers not starting production with security in mind (I highly doubt it) or is the company that hires these programmers telling them to do away with security just to speed up development? Or (I’m afraid to even think it) are the developers on purpose not taking security into mind just so they could develop the site or application faster?

Improve this question
14
  • "I always thought that no good computer programmer would take out security just to speed up development on a web page or application." Sadly, you thought wrong. :) Many great programmers take heat form their bosses and cut the corners they're told to cut.
    – Ƭᴇcʜιᴇ007
    Mar 28, 2014 at 14:01
  • @techie007 - Why are you happy I thought wrong?
    – Nexusfactor
    Mar 28, 2014 at 14:06
  • because if you thought right we'd be in deep security doodoo
    – Joe Taylor
    Mar 28, 2014 at 14:08
  • Sacrificing security is not part of enhanced productivity. New technology is a part of enhanced productivity. For example, my company wants to build a web application using ASP .NET. I told them that through newer technology, I could build this 10x faster without sacrificing quality. I'm currently developing in Ruby on Rails and within a weeks time have come near completion of the project that they had been working on for 3+ months.
    – kobaltz
    Mar 28, 2014 at 14:12
  • Wait maybe I'm misunderstanding, what was wrong about what I said? I simply said that No good programmer would do away with security just to speed up development.
    – Nexusfactor
    Mar 28, 2014 at 14:12

2 Answers 2

Reset to default
3

When it comes to large scale projects:

enter image description here

Pick two.

For more info see: http://en.wikipedia.org/wiki/Project_triangle

Improve this answer
3
  • great diagram and sadly oh so true
    – Joe Taylor
    Mar 28, 2014 at 14:10
  • very succinct (but a little trite as well). This is much of the problem with business, but there are also underlying issues of usability, and the fact that no one can build everything that makes up their app. if there is a vulnerability in an underlying system, it doesn't matter how much you know, how much time you take, or even how much you spend. Depth of defence strategies focusing on failure safety are essential (and costly per your venn) but even them, security is an ideal state that can never actually be attained, just infinitely approached.
    – Frank Thomas
    Mar 28, 2014 at 14:18
  • @FrankThomas "...the fact that no one can build everything that makes up their app." -- "...doesn't matter how much you know, how much time you take, or even how much you spend..." I disagree, if there was enough time and money one could build all layers, at the top-most quality. Ain't gonna happen though. :)
    – Ƭᴇcʜιᴇ007
    Mar 28, 2014 at 14:32
0

My guess is they left it out for faster development and also faster network speeds. Because if you include encryption in you communication its going to run slower. My opinion they should have implemented it. If anyone wants to edit my answer to improve it go for it.

Improve this answer
4
  • @Ted Williams- But even if slower network speed are a result of security implementation the company shouldn't do away with It. Users blindly trust these big companies with their credit card information. It maybe time to seriously take a look at who we trust with out information
    – Nexusfactor
    Mar 28, 2014 at 13:56
  • If their information was not encrypted then yes that is irresponsible. A lot of company's don't bother to hire pentesters to test there security. They rely on there indian tech's which only have a diploma in systems admin to maintain security sorry not being racist. Network administrator's should run nmap scan's and web vulnerability scans sadly most don't.
    – Tim Jonas
    Mar 28, 2014 at 14:06
  • @TimWilliams, PenTesting is never a sign that you are safe, just a sign that your security is better than the guy you hired. not saying its a bad practice, just never a foolproof one.
    – Frank Thomas
    Mar 28, 2014 at 14:15
  • @FrankThomas yes a program like skipfish or owasp might say your website is secure but manually looking through source code can prove otherwise. When there is open source software these days there is always a way to exploit.
    – Tim Jonas
    Mar 28, 2014 at 14:18

Not the answer you're looking for? Browse other questions tagged .