What do software subscriptions have to do with NIS2 or the Cyber Resilience Act?
To prevent misunderstandings: this is not an article that presumes to explain the aforementioned directives; there are already more than enough attempting to do so. This is about subscription services and the reasons why there will soon be no way around them. But why? What has changed since the days when one bought Windows 2.0, used it for decades, and installed it on the next generation’s first PC?
Manufacturer greed?
It was a long time ago when the necessary software for a computer was still supplied on floppy disks (remember those?) or CDs. Even then, a series of updates were usually required before commissioning, because all sorts of fixes appeared much more frequently than pre-packaged data media could be produced and distributed to retailers. Even then, customers sometimes complained about updates that felt like they took hours before one could finally get started with the new program. Improved software transmission options partially solved this problem, but new major versions were often only available for a fee, leading to occasional outcries from consumers regarding so-called forced updates.
In the meantime, subscription services have long since become a standard business model. Apple has been leading the way for consumers for many years: “The Apple bundle for you and your family.” Streaming services work in a similar fashion. In other industries, however, people were much more hesitant. In the automotive sector, for example, experiments with functions on demand only began in the early 2020s. BMW attracted a lot of attention—not all of it positive—with its subscription for a warm backside (2022, for 17 euros a month), while the Tesla group had already established itself as a pioneer, offering acceleration boosters via in-app purchase—for an additional 1,800 euros, for instance, going from 0 to 100 km/h in 4.4 instead of 5 seconds! This allows the manufacturer to install functions as standard that the consumer can only use upon making a corresponding special payment.
What was initially unfamiliar and sometimes viewed critically as a rip-off does, however, bring advantages, and not just for the manufacturer. For example, when buying a car, the customer does not need to worry extensively about optional equipment, just as with modular software. Features required later can be activated as needed. The younger generation of consumers has long since taken subscriptions for granted, and this triumph is continuing with even greater momentum in the corporate environment. There, the goal is often to outsource as much effort as possible that does not concern the core business—and in addition to software and/or computing power, this increasingly involves security and liability issues.
The digital transformation of crime
What is happening in cybercrime today could be called the flip side of the digital coin. How euphoric we were in the late 90s: no more phone books, no thick folders with masses of paper, fast and increasingly boundless communication with employees, friends, and relatives. Working wherever you want, and preferably wireless—that was how we imagined the brave new world.
And today? On the whole, all of that has come true, but cyber-villains have benefited at least as much as the average consumer. Exploits are the name given to the malicious attack codes that serve as tools for criminals to exploit vulnerabilities in operating systems, apps, and browsers. Anyone familiar with the subject knows that such exploits circulate briskly on the darknet, even as complete kits, as a service, and for very little money.
Depending on the prevalence of the affected software, the attack surface and potential for damage are considerable, with the attackers’ targets spanning the entire spectrum from spam to data or identity theft, ransomware attacks, espionage, fraud, or extortion. In 2022, for example, Microsoft recorded around 24 trillion threats per day in its systems worldwide, and the German BSI (Federal Office for Information Security) registers an increase of around 25% compared to the previous year, with nearly 70 new vulnerabilities in software products every day. It gets worse: there is also a clear upward trend in the potential damaging effect of these vulnerabilities.
The politicization of corporate due diligence
Sooner or later, this development was bound to summon legislation. There are now definitions for criminal cybercrime offenses, investigative teams specializing in internet crime, competence centers, reporting offices, and regular reports. Public relations work to educate the population is just as much a part of this as the involvement of providers of digital services or products.
And who should be liable for these risks? After all, your insurance also requires you to lock your car so as not to facilitate theft. In cybersecurity, this is regulated by EU directives such as NIS (Network and Information Security, 2016), and subsequently NIS-2 (2022). They apply to companies above a certain size that provide essential or important services. They are continuously expanded and improved.
The CRA (Cyber Resilience Act, 2023) holds manufacturers of digital products accountable, including everyone down to SMEs. For the actual goal of better withstanding the general threat situation in the economy and society, it is only consistent if as many players as possible, right down to the users, cooperate. Complaints about a regulatory frenzy will not protect us from cybercriminals, and even the strictest duty of care on the part of manufacturers will partially come to nothing as long as we do not consistently use trustworthy, continuously maintained software and update it regularly.
Accordingly, manufacturers must maintain expert teams for the maintenance and support of their products in the long term: employees for whom they also assume social responsibility and to whom they owe a duty of care and protection. One-off payments that include the cost of these resources are difficult to calculate. They would have to be very high or at least price the updates separately. Users would have to shoulder this burden: who wants to become a victim of hackers and, on top of that, be liable for damages to third parties due to neglected corporate due diligence?
The subscription solves this task much more elegantly, especially in connection with modular software. The pricing can be designed so that it covers no more, but also no less, than the required effort.
In the end, everyone is served: the manufacturer can fulfill its duty of care and maintain its product properly. The employed software developer can further develop their skills thanks to a secure and meaningful workplace. Customers and users can count on receiving prompt fixes for all emerging security gaps. Furthermore, in the case of complex software products, subscriptions often offer the advantage of not only continuously updated security but also all available improvements and innovations.
At IACBOX, it has been part of the company philosophy for two decades to provide all users with the latest product, including all enhancements and new features. The subscription model ensures that this service can be maintained in the future and in compliance with all new directives.