It just increases cost #
Posted Tuesday 30th June 2009 09:40 GMT
and bear in mind that most developers, especially those in the Windows World, don't see what they do as an art; closer to barbarism.
There are many tools, to help automate the checking of software, but really it starts from design, so you can have both a flaw in the design that leads to insecurity, or a bug that can be exploited.
The flaw is hard to find once the system is implementation, or it can even be championed by some deluded know it all, despite other people's best efforts to dissuade.
But, most of this pales in comparison to social engineered attacks, if the objective is to breech a target. Insecure software can fall victim to wide automated attacks, so there is an argument to sorting it out, but it increases the overall time to produce an application, and frankly there is just not the skills out there.