Schneier on Security

Davi Ottenheimer • May 2, 2005 11:43 AM

Eh?

“Security doesn’t work unless the users want it to work.”

That’s not a comment that helps security. It’s like saying government doesn’t work unless citizens want it to work.

The real and difficult questions are:

What happens when the people charged with security have to convince everyone else to use security? Do they compromise, do they succumb to the least common denominator, or do they resort to manipulation and refusal of balance of power? Who among the users decides what is acceptable security? Is there an election, an appointment…and how do they verify that their intentions are being met?

From a risk perspective, everyone has their own view of the value, the known vulnerabilities, and the criticality of assets. Saying that everyone must agree is naive.

So how to you convey the complexity of that formula, and the tradeoffs from associated judgements, to a large user base? It is a lesson in political science more than security, as you will end up designing a process for users to agree to and adopt like common law. In other words, when risk is shared, users either elect representatives or they elect to abide by an existing political system (leader).

A door was not locked? Buzzer disabled? We do not know if these gaps were because the business processes were incompatible and users were forced to make a tough decision about risks/reward, or whether select few user (out of step with the rest) were negligent in their duties. The latter is less a matter of “want” and more a matter of poor judgement. Since user desires and responsibilities are often weighted by level of experience and authority we also should ask at what level the decision was made — was it informal policy or at least common knowledge — and whether detective controls existed or assessments are performed to measure compliance. Or, from another perspective, what if all the users EXCEPT for the users with the keys to the door want it locked?

The bottom line is security has to facilitate regular business processes — it has to be justified in terms of risk and return — not just in raw terms of user popularity.

Davi Ottenheimer • May 2, 2005 2:20 PM

“the least amount of security needed to get the job done”

Yes, that would be ideal. It is an oft-repeated sales pitch to not oversell or overbuild, but that rarely happens in practice.

Moreover, take the situation cited by Bruce as an example of minimums. How much less security could the courts have had to get the job done? They only had a key lock and a buzzer. Even that was too much security by someone’s standard. But that’s not the point here. It’s not the sum of controls that are the issue, it is the relevance/fit of the controls to the business process. Would a better solution have been proximity cards and an actively monitored audit log/alarm?

People often disable alarms because they may be prone to false positives and annoy everyone or generate a form of immunity (cry wolf). But why put in a critical control and then allow someone to disable it? I say this points to a much larger issue than whether users want security. For all we know, users actually want more and better controls (e.g. it is not hard to explain a “safer” work environment), but due to a conflict between existing controls and their job duties, they have no choice but to select the latter over the former.