In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably impossible to be reduced to zero.

Which national authorities similarly control the safety (security) of software and hardware being used?


There is not government organization overseeing information security. What we have are sets of standards such as PCI or laws like Sarbanes Oxley and HIPPA. When a company wants to do business with MasterCard or Visa they will (usually) be required to be PCI compliant and have an audit done before they can do business. If your business depends on communicating with healthcare organizations and you don't comply with the HIPPA standards they (usually) won't do business with you. If a company does business with another company that isn't compliant with the relevant standards or regulations and there is a breach it will cause a huge public backlash against both of them the fear of that loss of reputation and therefore business on top of the law suits may result is what keeps them in line.

  • Who checks the conformity to such standards? How trustworthy are the checkers, if these are not governmental? Jul 4 '13 at 11:10
  • 1
    External auditors. For example if company X want's to interface with Visa and company X will be handling Visa's customer data then Visa will require company X to be PCI compliant and have an external audit done. Company X will do what it has to do to be compliant then they will have to hire a qualified external company to check off that they are compliant. The external auditing company has to be certified by the PCI Security Standards Council. If the auditing company does something unethical like take a bribe for a passing score they will lose that certification and be out of business. Jul 4 '13 at 15:35
  • @Mok-KongShen compliance is more market-driven than government enforced.
    – schroeder
    Jul 4 '13 at 15:53
  • Of course everything at the end depends on one's own evaluation/estimation of different matters in the society. Apology that I have thus to say that there could be no well meaningful argumentation in the current context in the sense of e.g. some topics in mathematics and I am afraid we would be eventually arguing like persons of different religions (or over tastes and colours). Jul 4 '13 at 20:49
  • 1
    Markets would not likely trust government but would trust audit firms.
    – Rory Alsop
    Jul 4 '13 at 22:57

There is no such control. You could further argue that if such control existed, it would almost certainly fail.

Certain industries have their own regulation; for example there's HIPAA for health care, SOX for publicly traded companies, and a whole panoply of regulation for defense and federal contractors. Most of these rules have nothing to do with IT security, but do affect and inform the way IT professionals have to look at their job.

And then there's a bunch of liability implication, from which you get strange things like the explicit prohibition against using iTunes at a nuclear facility or air traffic control tower.

But as for a federal agency setting rules and regulation to keep the Internet safe: no such thing exists.

There are several commercial organizations that offer security guidance; PCI-DSS, for example, is primarily a creation of Visa/MC/et.al., and compliance is a matter of contract adherence rather than regulatory control.

While PCI compliance isn't sufficient for real security, It's in the card industry's own best interest to continue to improve the policy as rapidly as manageable. US law makes Visa and other card issuers (rather than users or merchants) ultimately responsible for the cost of fraud involving their cards, so Visa is acting in their own self-interest by requiring some minimal level of security with respect to card usage.

Had such rules been prescribed by a government agency, they'd be subject to politics, lobbying, partisan bickering, and disproportional influence by well-connected organizations.

Instead, by setting up the incentives such that organization in the best position to make the rules (Visa et.al) stands the most to lose because of insecurity, these companies will naturally establish a baseline of security standards which matches the cost of exploit (from their perspective) with the cost of security (again, from their perspective).

To improve security standards further, the most effective regulation will put the cost of exploit not necessarily on the victim, but rather on the organization best positioned to improve conditions.

  • The big problem IMHO is that, as there are no governmental authorities that excercise tight control over IT security, there couldn't be any "genuine" IT security in any practical sense. (Just imagine the case that there were no FDA in the US and everything would have to depend on the honesty and self-discipline of the commercial people involved.) Jul 4 '13 at 9:23
  • @Mok-KongShen What makes you think agencies like the FDA are effective? Particularly when it comes to complex and fluid systems like you have in IT? For example, the FDA does have control over medical devices (both hardware and software) and has done a fairly miserable job up to this point ensuring that they're secure and reliable.
    – Xander
    Jul 4 '13 at 15:51
  • @Mok-KongShen perhaps the better question is, "why do you think governmental control is inherently better?" Government is people. Auditors are people. Both groups have the same strengths and flaws.
    – schroeder
    Jul 4 '13 at 15:55
  • @Xander and schroeder: Well, of course nobody can be infalliable. But generally in countries with comparatively good functioning governments the employees of governments are under good oversight to do their jobs properly. (In Germany, for example, government employees have also to swear an oath upon being employed.) Certainly one could question whether all such measures really help. But then a question in the other direction is: Why would one consider that the lack of such measures be better? For me personally anyway the said hypothetical scenario without FDA is quite clear. Jul 4 '13 at 20:16

This sounds like a homework question. The short answer is: there is no authority for IT as a whole, as the FDA for example has legal mandates and the power to punish. There is no agency that has this power over IT or IT Security.

There are however laws that apply to security in certain industries like health care or financial services, but that is a fairly narrow scope and the question needs more context before a proper answer can be given.

  • It's not a homework question. It's actually inspired by discussions in my thread "Risks of software backdoors" posted a day earlier. Please read also my comment to the post of tylerl above. Jul 4 '13 at 11:06
  • My mistake. Sorry. :)
    – Steve
    Jul 4 '13 at 17:36

Whilst this is not a complete answer, I wouldn't accept any answer that does not at least mention NIST in this context. I believe that their standards and recommendations are only binding to IT security of the US Federal Government. Yet their practical importance (as guidelines or basis for industry standards) far exceeds that. Find more info at http://csrc.nist.gov/.

  • I fully agree that NIST has contributed very much to IT security, e.g. the AES standard for encryption. In my personal view, national standardization bodies could further contribute to IT security by issuing certificates to software and hardware products that are relevant to IT security. (I happened to know long ago that the German standardization body issues certificates certifying the standard conformity of programming language compilers. The same work evidently should be doable for IT security software and hardware IMHO.) Jul 4 '13 at 20:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.