But even in the IETF, security is often reluctantly added at the end rather than designed in from the beginning. It has sometimes been quite a fight to get working groups to seriously worry about the issue. If it's this hard to get secure protocols within an organization that has made security a specific goal, it seems to be almost impossible in commercial applications development organizations. Features are added to programs seemingly without any thought of the security implications. This is not going to be easy to fix.
Security is hard.
They will find any small chink in the armor - and unless the developer is a real security expert, it is hard to see a chink when programming one in. Companies must get security expertise into their software development groups and users must use the resulting security tools. Otherwise, the Internet bubble may burst in a very ugly way. Feedback Tell us your thoughts on this article or the issues raised in it. When you click Submit, you'll be taken back to this article.