The SoapVox

Bruce Schneier has a new essay on his blog, which should give anybody working in security a lot to think about.

In Nonsecurity Considerations in Security Decisions, Bruce talks, briefly, about what security *is*, then goes into trying to define *how* decisions about security are made. Something that jumped at me when I read it was:

At its core are assets, which a security system protects. Security can
fail in two ways: either attackers can successfully bypass it, or it
can mistakenly block legitimate users [...] both users and attackers learn about the security and
its failings. Sometimes they learn how to bypass security, and
sometimes they learn not to bother with the asset at all.

Users “learn not to bother with the asset at all”…that’s what happens when you over-secure something. Yes, security is important…but the level of security must *not* be higher than the asset being protected is worth…if you enforce a 30 random character password, with a 30 minute session timeout, for protecting access to the schedule of a low level manager, his secretary is going to end up doing it all by paper and pen instead, because that information about that person isn’t worth the time and brainpower needed to do things “the right way”.

On the other hand, you shouldn’t under-protect things. A 5 character non-random password protecting the schedule of the President of a country who has been receiving dead threats is stupid…it’ll take a very short amount of time for an attacker to get to the schedule, and that can end up making things Really Bad.

Also, the diagram posted with the article is interesting, worth blowing up and printing, to be kept handy whenever you have to do a security assessment.

Technorati Tags: bruce schneier, security decisions, security

If you enjoyed this post, make sure you subscribe to my RSS feed!!