Schneier on Security

HJohn • March 30, 2010 2:09 PM

Not too surprising. I remember a study where better liars also tended to naturally be leaders of the pack, probably largely due to their above average charisma and ability to persuade. Seems to be their charisma and ability to lie/pursuade/manipulate is often a cause of their success, not necessarily a result of it.

Of course, higher up people tend to be held to less scrutiny as well. And also tends to be the recipient of pleasing behaviors (sort of like how even the worst jokes get big laughs when told by a boss or even a dictator). So that no doubt factors in, perhaps creatign a little more persuasion in the less charismatic and a little more ego in the already egotistical.

I’m chuckling at imaging some of the conclusions soon to be posted here.

HJohn • March 30, 2010 2:35 PM

@andyinsdca: “Maybe liars are attracted to positions of power in greater numbers than non-liars?”

I’m sure they are. They are also more willing to smear, step over others, downplay others, and exaggerate their own value, in order to get ahead.

That’s not to say that everyone who gets ahead is dishonest. I know many honest yet powerful people. It is to say that he who will do whatever it takes has an advantage over he who limits himself.

HJohn • March 30, 2010 3:49 PM

I’m sure most of us have worked with the types who belittle others, often so subtly that it goes unnoticed for what it is, while making sure the bosses know everything they do and how wonderful it (supposedly) is, then we all get steamed when they get the promotion.

I also think some people have a hard time distinguishing between arrogance and confidence. Sometimes, an arrogance of self is misinterpreted as confidence in what one is saying.

HJohn • March 30, 2010 4:21 PM

@Henning Makholm: “However, the research reported in the article was a RANDOMIZED experiment: Subjects were assigned leader/underling roles by coin tosses, and those who (by pure chance) ended up in leader roles turned out to be better liars.”

Excellent point. I do think this points to the certitude that comes with being having authority. The one who is more forceful and insistent is usually the one who has the power (be it a boss, or a bully, etc.)…and the confidence that somes with knowing you will get your way. A large biker would be more likely to have more certitude in his words than a small, frail bookworm. However, you put a gun in the hands of the bookworm and its amazing how the way they deal with each other changes.

I think it is a symptom of how people behave when faced with different options. For a business example, look at middle managers. The same person who is an intolerant, rude person to their staff may be the most patient, congenial person in the building when it comes to the CEO. Why? Because the boss may not always be right, but the boss is always the boss.

Options make the world go round. Interstingly, I’ve been writing several articles over the past few months about formulating security strategies in a way where the employee’s best interests are lined up with what’s most secure.

HJohn • March 31, 2010 8:49 AM

@Nathan Tuggy: Where might those articles be? Links, please? I’d love to read them.

I’m trying to get one of them on a local audit chapter’s web page currently, but none are available on the web at this point. Two went to print in a local advisory (one about keeping children safe online, the other about business security practices).

I’ll cite one business example I used, as to not take over Bruce’s post. In one, I argued with a sector standard that mandated a password minimum age of 15, with the rationalization that users would have to tell security admin if they thought their password was compromised. I contended that such a user would be more likely to keep his mouth shut and hope for the best rather than risk embarassment or reprimand, and play dumb if something happened. On the other hand, if they were permitted to change it, they would probably change it to avoid a possible compromise. In the latter, the best interest of the employee was more secure, whereas in the former the best interest of the employee was less secure. There are other examples (ID theft, timekeeping) is used, but its too much here, but that’s the jist.

I only mentioned it since my previous research agreed that people behave differently when their choices are different (Bruce wrote about something similar in Psychology of Security when he discussed the Prospect Theory). In regards to this post, the subjects in the study lied better when they were in power largely because they were faced with different options.

Best,
John