Tech’s Reliability Gap

It sounded like a reasonable response to the devastating attacks of September
11. Companies talked of reducing air travel, increasing their use of
technologies such as videoconferencing and collaboration software, and further
decentralizing operations through networks such as the Internet. In all of these
measures, there’s an assumption that technology is the key to making
businesses not only safer but more stable and resilient.

Boy, I’m not so sure. When is the last time you said, "Wow, I just can’t
believe how dependable my personal computer is!"?

There’s no doubt that computers, software, global networks, and the like
have made us more efficient as corporations and as individuals. Some security
measures, such as dispersing people and computers and using networks to connect
them, have made us even more dependent on information systems. But all too many
of these technologies are not only wide open to attack by hackers and fanatics,
they’re also absurdly unstable and unreliable. Relying on them still more,
without making huge improvements in how they’re designed and used, seems
certain to compound the disruptions we’ve already seen.

The root problem is the very nature of technology development, notes Richard
Pethia, director of the Computer Emergency Response Team Centers at Carnegie
Mellon University’s Software Engineering Institute. "Technology evolves
so rapidly that vendors concentrate on time to market, placing a low priority on
the security of their products," he said in recent testimony before a House
subcommittee.

Even more worrisome is the low priority placed on basic reliability. One of
the biggest challenges to distributed corporate operations may be bad software.
According to information technology consultant Standish Group International, bad
software last year cost about $175 billion worldwide in lost business due to
downtime, more than double the amount two years ago. It makes you wonder if
companies are ready to push more people into remote offices or even home to
telecommute, where technical support is shaky or nil. I can’t tell you how
many times my PC has inexplicably crashed, requiring on at least two occasions
that it be sent to techies across the country to fix.

To the Internet’s credit, key services such as e-mail and instant messaging
held up amazingly well in the hours after the terrorist attacks. But the very
strengths of the Internet may well increase the likelihood of widespread
disruptions in the future. The nearly unstoppable global connections it forges
among some 110 million computers online make it far easier to spread viruses and
software bugs from a few computers to millions in an instant. Private networks
may be better equipped to limit the impact of attacks and glitches. But even
there, remote and small-office setups often use PC technologies that are more
susceptible to viruses and just plain-old breakdowns.

This shaky situation suddenly makes cyber-attacks much less farfetched than
they once seemed. Viruses set loose by bored teenagers continue to bring
corporations to their knees. It’s not hard to imagine the havoc that a
dedicated group of fanatics could unleash on the systems that we intend to
depend on more than ever. Moreover, says Standish Group Chairman Jim Johnson,
disaster recovery plans at all but two of 56 companies he surveyed recently are
out of date, typically allowing them to return only 10% of their critical
software applications to operation quickly. Says Johnson: "Disaster
recovery is a disaster."

Most of these problems require big changes not only in technology, but in our
thinking. Companies must make technology reliability a top priority and demand
the same of their suppliers. Let’s not fool ourselves: None of this can be
fixed overnight. But I can’t think of a better time to start.

By Robert D Hof
in BusinessWeek. Copyright 2001 by The McGraw-Hill Companies, Inc