Software can deliver on utopian dreams, but only if it’s secure

Taylor Armerding
Dev Genius
Published in
7 min readJun 29, 2020

--

Photo by Markus Spiske on Unsplash

“It’s tough to make predictions — especially about the future,” said the late, great intuitive philosopher and baseball icon Yogi Berra.

He was right, of course. Last Christmas nobody had a clue that within six months a lethal pandemic would kill more than 120,000 Americans and crush a roaring economy.

He was especially right about technology, which moves at such blinding speed that few people try to forecast even six months out, never mind a decade.

But that didn’t stop Alfred Chuang, co-founder of BEA Systems (sold in 2008 to Oracle) and now general partner with Race Capital, an early stage venture capital firm.

In a recent post on TechCrunch, Chuang invites us all to view the impact of software on the world of 2030 through his own crystal ball, noting that at that point the iPhone will have been around for 24 years and it will have been a decade since the launch of 5G networks.

What will it look like? Well, he thinks it won’t simply be that, as Marc Andreessen, co-author of Mosaic and co-founder of Netscape, put it in 2011, “software is eating the world.”

Software will have long since eaten the world. As he put it, “In 2030, software is the world.” And he predicts that the world’s largest organizations in every industry — education, finance, food, hospitals, entertainment and more — will all be software companies.

The future is now

Which at one level seems like not much of a prediction at all. It’s already true. Virtually every company that does business outside its own neighborhood (and probably even those that stay in their neighborhoods) is a software company.

Virtually any company in existence has web apps that are built and run with software. Software runs their systems and networks; it handles their finances, human resources and everything else that used to require mountains of paper and rows of file cabinets.

But it is also pretty much a sure thing that we have barely scratched the surface of what a world powered (essentially possessed) by software will do. It is likely that what seems cutting edge in 2020 will seem hopelessly dated in just a decade.

Especially given the exponential growth of the Internet of Things (IoT), which is already becoming the Internet of Everything (IoE). From a “mere” 7 billion devices in 2018, there will be 31 billion in use before the end of this year, and some forecasts are for that to grow to 41.6 billion by 2025.

Those devices, all powered by software, will do physical things far beyond giving you directions or helping you make a music playlist. They will build cars, deliver your groceries, perform surgery, keep your home secure, remind you when you’re low on milk, deliver low-cost, high-quality education and offer limitless entertainment options.

But if history is any guide, the software behind those devices will also have vulnerabilities that, as is the case today, hackers will be relentlessly looking to exploit. So unless there is a much more focused effort to “build security in” to software products, and to make security as important as functionality and features, another decade will simply yield a much more vast attack surface and an even more constant stream of headlines about ransomware, multiple millions of compromised records, distributed denial-of-service (DDoS) attacks and hostile nation-state attacks on our critical infrastructure.

Jonathan Knudsen, senior security strategist at Synopsys, who sees 5G as an incremental change rather than revolutionary, said the underlying network doesn’t really matter. “As always, the challenge is building applications and devices with security in mind at every phase of development,” he said.

Relentless optimism

Chuang doesn’t get into that. His vision is one of relentless optimism. He predicts a software-powered educational system that will offer personalized learning with no need to travel to a campus or sit in a classroom. Tuition will plummet. Student debt will vanish. Kids will finally be able to “focus on learning, not just getting an education.”

Most of which is probably already technologically possible and would be a colossal relief to hard-pressed students and their parents. But it doesn’t address the fundamental disruption of a massive educational establishment that is unlikely to welcome the elimination of most of its jobs. There are more than 4,100 two- and four-year colleges and universities in the U.S., which employ more than 1.5 million professors, not counting administrators and other staff to manage and maintain those campuses.

Below the college level, there are nearly 100,000 primary and secondary public schools, employing nearly 3.4 million teachers. The largest public school teachers’ union, the NEA, has 3 million members. They are unlikely to agree that most of their jobs aren’t necessary.

But it does raise the obvious question: Will software eat not only the world but your job as well by 2030?

Probably yes and no. Any dynamic economy is constantly shedding and creating jobs. The invention of the car eliminated the horse and buggy but created vastly more jobs than those lost. The personal computer, powered by software, destroyed the typewriter industry but created millions more new and different jobs in the process.

So the upending of the existing “legacy” educational system, if it happens, will likely create more jobs than it destroys. Which is probably the case in other industries as well, if only because the ubiquity of the software needed to run it all will create a corresponding demand for those skilled in building and keeping it secure.

Indeed, it is not a stretch to believe, as Chuang predicts, that within a decade groceries will be delivered by robot or drone with no human involvement — a move that is already underway. But there will still need to be humans to make sure all that technology functions correctly and to protect it against inevitable, evolving cyberattacks.

Some predictions aren’t waiting for a decade to come true. As we’ve all noticed recently, major healthcare insurers, including Medicare and Medicaid, suddenly “discovered” that “telehealth” — medical visits using videoconferencing — is valid enough to qualify for coverage.

While many things will still require in-person contact, it is now possible to “see” your doctor from anywhere, and for a doctor to diagnose and prescribe treatments for many ailments that, pre-COVID-19, would have required an in-person visit.

Using software, but not building it

But not everybody agrees that, within a decade, the biggest healthcare systems will essentially be software companies with robots doing all surgeries under the guidance of a doctor from anywhere in the world, working from home.

Danny Lieberman, founder and CEO of the Israeli clinical data startup FlaskData, said it’s “highly unlikely” that the biggest health care systems (HCS) will be turning into software companies anytime soon. “The standards are not there yet and the challenge to change for big players like that is too big,” he said.

But he said he’s already seeing smaller ones make the transition. “The top two Israeli health care providers are already software companies,” he said, adding that he thinks they are maintaining good security.

“The threat surface does not seem to hold them (the Israeli providers) back,” he said. “It’s complex but not more than Airbnb or Uber, which means that with good architecture, money and people and good management it can be done.

Other predictions from healthcare experts are mixed, however. “I don’t see healthcare delivery organizations truly being software companies,” said Dan Lyon, principal consultant at Synopsys. “They are going to continue to evolve as integrators of all sorts of software — EMRs [electronic medical records], medical devices, mobile apps, remote access tools, etc.,” but not “software companies” in the sense of writing their own.

“They will be consuming other companies’ software — these places want to deliver patient care, not create great/innovative software,” he said.

His colleague Chris Clark, principal security engineer at Synopsys, agrees that overall, the healthcare industry will increase its use of software but won’t be building it.

“Having said that, tools developed and provided to interpret the data collected from medical device manufacturers will change how doctors and clinicians consume this information,” he said. “The companies that transform to true software houses will be looking at how data meshing and synthesis will reduce patient encounters and raise positive outcomes.”

Clark said while the sci-fi tricorder and sickbay from Star Trek have been viewed as the ultimate healthcare nirvana, “the near future is owned by AI-aided medicine. The amount of data that need analysis and integration into larger health solutions is too vast for traditional methods.”

Ultimately, in the same way that software is already decentralizing the workplace (an event hastened by the pandemic), Dan Berger, a healthcare cybersecurity consultant, sees that happening in healthcare.

“No doubt healthcare in 2030 will be driven by software, robotics, and telemedicine, but on our way there I predict acute healthcare will further decentralize from large hospital settings to more distributed, localized care centers,” he said.

“Similar to ASCs [ambulatory surgery centers], these high-tech ‘care-pods’ will be equipped to handle most surgical procedures and non-life-threatening conditions, as well as accommodate multi-night stays.”

Indeed, software, as Chuang notes, will likely make it possible to decentralize everything — even entertainment.

Virtual is reality

“We can ask Alexa to deliver popcorn to the house and even watch the film with friends who are far away,” he wrote. “If you see something you like in the movie, you can buy it immediately — clothing, objects, whatever you see — and have it delivered right to your house. No more standing in line. No transport time. Reduced pollution. Better planet!”

Well, perhaps, if the human race can adapt to virtual instead of physical gatherings. And more significantly, as long as the software behind all this magical convenience is secure enough to prevent hackers from stealing your financial credentials, diverting your clothing order somewhere else or tampering with your order so you get a thousand pairs of pants.

Software clearly has the capability to create a utopian future. But just like a building, if the construction isn’t secure and the foundation is porous, it won’t stand.

And so far, the evidence is clear that we are a long way from building security into the software that in 2030 may indeed be the world.

--

--

I’m a security advocate at the Synopsys Software Integrity Group. I write mainly about software security, data security and privacy.