Why are secure programs so difficult to develop (for me)?

Question

Community Wiki Question

Every time I work on a project involving passwords or securing data I get mired down into obscenely complex APIs and issues. I have not had much formal training in developing secure applications but I have not had much formal training in database, GUI, and build processes either. Many other areas of programming feel more intuitive.

Is security just a far more complex area than many others? I tend to think that it is not. Are security infterfaces and systems less mature than others? I would tend to think that there is a great deal of pressure for those systems to mature. On UNIX the 'trusted environment' was the norm until somewhere in the 90s. Is UNIX just suffering from its roots in this area?

Technology changes fast. Since I have been in school the computing world has become far more distributed and critical. Has security been dragged along for the ride as an afterthough? Are any new technologies promising? Are you suffering the same way I am?

Answer 1

Good security is hard, very very hard.

Answer 2

I think that security is so hard because people feel inclined to do what they shouldn't, and try their best to overcome any barriers they find.

Only if this will power was used for something good...

Answer 3

Apart of the considerations from the other answer, it is also because security is a balance between effective protection and effective ease of use. A system that is too complex to use due to its stringent security will likely to fail the user, which will drop it. Your role as a designer/developer is also to find the proper compromise between these two opposing forces, something which tend to introduce even more trouble.