Software is quickly becoming a serious threat to business. Regardless of the reasons for information systems' vulnerability, without adequate attention to security, our newfound digital wealth may begin slipping away. They argue that survivability blends computer security with software engineering and business risk management. This chapter presents their research objects and ideas for creating a practical software development methodology that leads to more secure and survivable COTS-based systems. Their belief is that achieving a survivable system requires that survivability be integrated into the software development lifecycle and not treated as an add-on property.
Most companies are woefully unprepared to respond to incidents because of their faith in avoidance.
The Time Based Security technique provides a common metric, time, to be used to gauge both risk and security of a network system. Schwartau goes on to argue that we should at least know how fast our existing detection and reaction processes are, even if we cannot know how strong or weak our protective products and processes are. The metric he proposes addresses this problem. They argue that although the username and password concept has worked thus far, it lacks the needed portability and scalability that will be required in the future as more and more transactions are carried out over the Internet. Because the authors envision that the future global e-commerce system will accept various equipment, ranging from desktop computers to handheld devices, they argue for the need to have as little as one certificate to authenticate an individual across multiple services and equipment instead of the multitude of passwords we use today.