Software Choice is Critical to Cyber Resilience
Restrictive Software Licensing Undermines Customer Cybersecurity
By Ryan Triplette, Executive Director, Coalition for Fair Software Licensing
When people think of cybersecurity threats, they tend to think of foreign hackers or rogue employees. What few realize, though, is that one of the most serious emerging threats to an organization’s cyber resiliency plan is restrictive software licensing that limits an organization’s choice of security products.
How Restrictive Licensing Practices Harm Customers
In recent years, some legacy software providers have utilized restrictive software licensing practices to compel customers into adopting their security and cloud products. According to a Morning Consult survey, almost 70 percent of tech decision makers who have experienced unfair software licensing practices said that unfair licensing terms restrained their ability to roll out new features or products.
The immediate impact of these practices is limited customer choice – of preferred cloud providers, software vendors, and security products. While this alone raises concerns meriting attention, the long tail effect of limited choice is becoming increasingly known; namely, increased customer vulnerability to cyberattacks.
Cyber resiliency is defined as, “the ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.” To ensure cyber resiliency, customers need to ensure that they have not only a diversity of cyber products, but also vendors with seamless integration capabilities. Here’s how restrictive software licensing practices pose a threat to customers meeting those needs:
Vendor Lock-In and Tying of Security Solutions
Vendor lock-in occurs when customers cannot easily change vendors, generally because switching would be either too costly or complicated. Vendor lock-in holds customers to the status quo against their wishes and allows vendors to capitalize on customer dependencies to condition – or tie – the sale of dominant core products at discounted prices to purchase agreements for products in adjacent markets.
Increasingly, legacy software providers, particularly those with leverage over government customers, are conditioning discounts for dominant software products on customer adoption of a bundled suite of adjacent product offerings, including their cybersecurity and cloud solutions. For example, Microsoft packages its security products with their productivity suite with a bulk discount conditioned on the customer’s use of Azure. Given both the importance and dominance of Microsoft’s productivity suite, enterprise customers become locked into those security products as they try to extract the most value out of their purchase. Over time, it becomes more difficult to replace security products or switch cloud providers that are embedded across customers’ networks and security operations.
Vendor lock-in and product tying can prevent customers from adopting potentially more secure, and certainly diverse, product offerings. As CrowdStrike’s co-founder and CEO George Kurtz recently noted when discussing the threats to customers being forced to put all their eggs in one basket. “…This can be a real risk to the company, using both Microsoft for security as well as applications, cloud, and everything else.”
There was considerable coverage of the company’s security practices in October of this year when Microsoft confirmed a misconfiguration exposed troves of sensitive business data for more than 65,000 customers. However, the more concerning demonstration of this risk is the number of vulnerabilities that the company discloses on a monthly basis, including as recently as this month when it acknowledged six zero-day vulnerabilities that were being actively exploited.
Impeding Interoperability
A “single point of failure” is a vulnerability that, if exploited, can bring down an entire system. A diverse and interoperable cybersecurity ecosystem enables customers to benefit from innovation by enabling the rapid integration of best in class cybersecurity solutions. That is why it is critical for IT architecture to be built with interoperability in mind. Otherwise, we will continue to see cyber attacks that prove that software designed with limited integration capabilities is “one of the primary reasons why ransomware attacks spread from single machines to entire organizations unchecked.”
Unfortunately, many cloud customers are learning that their existing software and security products – which were originally compatible with other systems – have diminished integration capabilities at the very time when interoperability is more important than ever. For example, in a June 2020 blog post, Matt Stoller shares a note from one of his readers – a cyber security professional for a Fortune-100 company – describing how Microsoft made it “incredibly difficult” to integrate with the Splunk logging platform before launching a logging platform of its own.
Limiting integration capabilities to foreclose the utilization of competing products puts customers in a precarious position because, in the event of a breach, responders cannot access and deploy the best resources to remedy the situation if they cannot interoperate.
Solutions Are Within Reach
Widespread dependence on certain software reinforces the effect of vendor lock-in and product tying. Legacy software providers can, and increasingly do, leverage their customers’ dependence on software to grow their share of adjacent markets, such as what we are seeing in the cybersecurity sector.
The good news is that commonsense, effective solutions are within reach. Ninety percent of technology executives and directors support the adoption of the Principles of Fair Software Licensing as industry best practices to preserve customer choice. By adhering to these Principles, software providers can empower their customers to implement the best cybersecurity solutions.
In a world of persistent cyber threats, these Principles represent any organization’s best chance at protecting itself, both on-premises and in the cloud.