# Impact of Metcalfe's law on the quality of security

This question probably has a high likelihood of getting flagged as "too broad", but I'll take my chances.

I received the following question on a homework assignment:

How does Metcalfe's law impact the quality of software security.

This is a vague question and I know that my professor is probably most interested in my train of thought and reasoning, rather than a concrete answer.

Metcalfe's law states that the value of a telecommunications network is proportional to the square of the number of connected users of the system. I know the answer has something to do with the fact that the software industry is getting away with low quality standards for security. It is still an immature market and the risk of security flaws can is transferred to the customer. This, together with the lemon market and the low cost of security failures, means that inferior security quality leads to success.

However, I can't see the relation with Mecalfe's law. Does it mean that the more companies invest in security, the more valuable it becomes to invest in security as well?

Here are some things to point you in the right direction:

• First of all forget the conclusion you are trying to draw. That's how you end up never seeing anything. Think, and let that process take you to a conclusion right or wrong.
• Remember that equations, even proportional ones, can be interpreted as easily as well defined ones. Think about what that means. For example if [value (V)] ~ [# of users (U)]^2 that means that the change of value dV ~ 2U. A linearly increasing function.
• If the change in value (dV) is always increasing, what will that do for the interest of criminals in said system?
• Remember # of Users includes criminals.
• Remember the opposite is also true, as value increases what happens to those who wish to protect said system?
• I bet you there is a relation between the value of a system, and the amount of work users are willing to put into it to break/protect it. I might be highly correlated to our initial premise.
• Now that you have a system of equations (you should have 3 or more at this point) What happens as U->infinity and U->0. Does this change the perspective of the other points at all? yes or no?
• Remember that if you are really clever there exists a logical path to relations you can create, some you have, some you need to make yourself, and some very interesting conclusions come out of it.

These points should help you get started the right way. Dig into it. It's actually a really interesting thought experiment.

EDIT:

As an extra little hint, bullet point 6 above was worded very specifically and is central to the epiphany. Especially if you also want to analyze the effect of the "lemon market" as you say. It was really cool to see what was developing as I kept writing.