It seems to me that computer software is becoming more secure every year - there are fewer zero-day exploits to be found, many hacker-proof concepts are becoming widespread (such as virtualization and strong encryption), system administrators and users are starting to become aware of the importance of security, etc.

Is it reasonable to assume that the field of information security will start to shrink in a few years? Or is it just an illusion and things are getting worse?

closed as primarily opinion-based by TildalWave, Adi, Xander, Rory Alsop May 21 '14 at 19:24

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Do you have a source for the idea that software is becoming more secure every year? As Tom answered, there are more and more users, and there are more and more new developers every year who need to learn how to develop securely... – schroeder May 21 '14 at 18:18

Biggest vulnerability in any computer system is the human user, and human users don't get better at security over the years. In fact, since computer systems' prevalence increases (even my mother now uses a computer occasionally -- hello, Mom !), there are more human users than ever before, which I choose to read as: there are more targets. In that sense, overall security decreases (steadily).

However, we can say that attackers have professionalized. In the 1980s and early 1990s, attackers were mostly bored youngsters, amateurish and exuberant. They were hacking for fun, not profit. There were some pro attackers, usually on the payroll of various governments (they say that Bulgarians were uncannily good at this), but not a lot of them. This famous movie captures the ambiance of that era quite well.

Nowadays, everything has changed. Attackers are organized, efficient, and petty; they act for money; most no longer worry to justify their lifestyle with elaborate notions of ethical liberalism. There used to be a lot of quite crazy intellectual constructions about how hacking into computers was a tribute to Marx, Darwin or Salvador Dali, or even all at once; this was quite entertaining; but these days are gone. Now, most attackers are just after a quick gain, they hijack machines just to send spam, and this is boring. A few groups try to maintain a politically aware outlook (e.g. when so-called "Anonymous" try to grab attention) but it often is a disguise prudishly thrown over less glamorous actions.

So, no, systems are not "more secure". But the heroic, flamboyant era of intrepid adventurers is done. Now InfoSec is just a business.

  • It might be helpful to go beyond the human users are getting dumber and the human attackers are getting better. Systems of systems growing in both complexity and ubiquity may suggest the OP's proposition that the systems are more secure may be fundamentally flawed and incorrect. Seems we in the InfoSec business should look hard at this aspect as it may suggest our train user and patch, rinse, patch methodology might not keep up with the leaks in the boat. EBay today, Target five months ago, yada yada. InfoSec as a business seems to need some fundamental systems level changes to status quo. – zedman9991 May 21 '14 at 18:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.