Subscribed to Risk? Unpacking the Security Implications of Subscription-Based Software

Subscription options abound. Picking and
managing them can be a lot harder than it looks.

Leasing software is the norm. From Netflix and Spotify to Office 365 and Apple iCloud. That’s just the consumer side. Business software takes it to a whole new level. This prevalent model has transformed the software development industry by altering how software is developed, updated, priced, and supported.

Historically, software was purchased outright. Users owned a version and received a license. They were responsible for installing the software. Which usually meant sitting in front of the computer switching out disks multiple times. Updates were available under certain conditions, though acquiring them could be challenging. Sometimes, updates were only available for purchasing new software versions.

With the advent of the internet, distributing these updates became more straightforward. The migration to software as a service, made the move from software ownership to a subscription model inevitable.

This transition has not been without its complexities. Subscription models mean users are often juggling numerous agreements, which can be difficult to manage. Tracking renewal cycles, trial periods, cancelling and understanding feature sets increase the mental load on consumers. Of course, even picking the right subscription plan is a challenge. We’ll avoid the behavior psychology behind that conversation.

Interestingly, the gaming industry remains one sector where outright purchases are still common. Although subscription services are available for online play or content downloads, many games can be purchased once and played indefinitely.

The subscription model offers distinct advantages.

Software updates are delivered seamlessly, often utilizing feature flags and role-based access controls to provide new functionalities more rapidly than traditional models. This eliminates the need for users to endure lengthy waits for new versions or risk data loss during installations. Users are freed from the burdens of managing software installations or ensuring hardware compatibility. As long as they have access to a modern browser, the software should function, though mobile applications may require specific considerations.

Product teams also have to deal with the subscription pricing nuances.

While users benefit from rapid updates and reduced maintenance, product teams gained some advantages of their own.

Support is streamlined, as fewer versions require tracking, and browser-based delivery simplifies compatibility issues previously complicated by diverse operating systems and hardware configurations.

The ease of updating software can also encourage riskier behaviors within development teams. The pressure to rapidly deploy updates can lead to prioritization dilemmas, architectural compromises, and variable release quality. The mindset that “software is easy to fix” may expedite development but can also result in less thorough testing and quality assurance.

Then there is the privacy and security concerns. From a consumer perspective, subscription models typically require providing payment information and contact information across a variety of services. This increases the chances of information loss. Combine that with having to manage numerous username and passwords and there is a lot of opportunity for identify theft.

From a product development team perspective, rapid development times means having to rely more and more on third party services and libraries in order to expedite development. Managing and keeping these libraries up to date can be daunting.

Has the benefits of the subscription model run its course? Is the cognitive load too much for the consumer? Is the rapid deployment of features an advantage or disadvantage for product teams?

As with anything else, the question boils down to the goals of the organization and the consumer. There is no one right answer. It is however important for both sides to be aware of the risks and concerns.

Posted in Software Engineering and tagged , .