Green IT: sustainable software is secure software
Why maintainable, long-lived systems are better for the planet and for security.
When we talk about the environmental impact of IT, we usually think of data centres, electricity and the minerals in our devices. Those matter. But as an architect I see another, less visible source of waste: software that is built to be thrown away. And it turns out that the habits that make software sustainable are almost exactly the habits that make it secure.
Where the footprint of software comes from
- Hardware that is replaced too early. Most of a laptop's or phone's lifetime emissions come from manufacturing it. Bloated software that forces people to buy new devices every few years is an environmental problem.
- Unnecessary computing. Oversized servers running idle, forgotten test environments, data that is stored forever because nobody decided to delete it.
- Heavy websites. Megabytes of scripts, trackers and auto-playing video are transferred and processed on millions of devices.
- Rebuilds. When a system becomes unmaintainable, the only option left is to rebuild it, with all the energy and effort that takes.
Five habits that serve both the planet and security
1. Less is more
Every dependency, plugin and feature costs energy to run and is a potential vulnerability. Removing what isn't used is the cheapest emission cut and the cheapest security fix there is.
2. Build to last
Clear architecture, documentation and automated tests let a system be maintained and updated for decades instead of rebuilt. Software that is easy to update gets its security patches.
3. Right-size and switch off
Scale resources to real demand, and shut down test environments when they are not needed. Unused environments are also unmonitored environments, a favourite hiding place for attackers.
4. Minimise data
Data you don't collect doesn't need storage, backups or protection, and it can't leak. Data minimisation is a GDPR principle, a security principle and a sustainability principle at the same time.
5. Keep devices longer
Choose software and platforms with long support periods, so that devices stay secure and usable for longer. Security updates are what make an old device safe to keep.
This website as an example
When I replaced my old ASP.NET portal with a static website, the page weight dropped to a fraction, the server no longer runs application code for each visit, and there is no database or third-party tracking. It is faster on old phones, uses less energy, and has almost no attack surface. Sustainable and secure, from the same decision.