SE Radio 559: Ross Anderson on Software Obsolescence

Banking Challenges

Software maintenance in banking systems presents unique challenges, often leading to significant failures. Ross Anderson recounts a near-catastrophic incident at NatWest bank, where outsourcing maintenance to an inexperienced firm almost resulted in the bank's collapse 1. This highlights the critical need for reliable maintenance strategies and the risks of relying on outdated systems. He notes, "The body can help you a lot and there is going to be a market for tools for maintaining old stuff" 1. The dilemma of using off-the-shelf components versus building custom solutions also complicates maintenance, as companies must weigh the risks of obsolescence against the benefits of quicker market entry 2.

   

Maintenance Strategies

Effective software maintenance requires strategic planning and understanding the lifecycle of software projects. Ross Anderson explains that many large software projects become disasters due to their complexity, which grows exponentially rather than linearly 3. He emphasizes the importance of a software bill of materials, as mandated by a US presidential executive order, to track dependencies and mitigate risks like those seen in the SolarWinds incident 4. Anderson warns, "You can't just say, does this supplier get audited by a big four audit firm? Because, sure, they all do. That's a racket. It doesn't tell you anything" 5. This vigilance in supply chain management is crucial for maintaining software integrity.

   

Sustainability

Sustainable software use and addressing deprecation are vital for long-term functionality. Ross Anderson shares personal anecdotes illustrating the challenges of maintaining outdated systems, such as a car GPS that became nonfunctional due to discontinued updates 6. He stresses the importance of factoring in maintenance costs, which can constitute up to 90% of the total cost of owning software 7. Anderson notes, "The underlying engineering fact is that software needs to be maintained, which may mean small tweaks here and there, or it may mean refactoring" 8. This underscores the necessity for ongoing updates and strategic planning to prevent obsolescence.