Hide that attachment I cannot bear to see

Security paradigms are sometimes curious. Not so long ago, I was attaching a file to an email. Outlook warned me that the file was potentially dangerous, based on its extension. No matter, I zipped the file and tried again. This time, Outlook let me do it. This process is within anyone's reach and doesn't require any “über 1337 skillz”.

Nothing like a real-life example to understand the implications. Take airport security checks. It's as if I tried to get through security with a prohibited item and simply wrapping it let me through without getting stopped. That's a pretty serious failure in a security control. Fortunately, airports have put much more sophisticated measures in place, which make it easy to spot concealed items.

You'll tell me there's nothing to it... And indeed there's nothing to it... Except that we are teaching users to knowingly bypass security measures because they get in the way of their work. Doesn't that undo everything we've been trying to put in place for years? Denying that we are teaching users to bypass the systems we put in place is terribly dangerous. Thinking that users can't find workarounds on their own means ignoring the existence of Google... On top of that, humans naturally love to get around limits. In a past life, a few users had caught wind of the workstations' administrator password. It didn't take long before every employee had that information... And that was back when the Internet wasn't yet in common use and Google was just a dream.

The issue in all this is that this Outlook feature was added in the late 90s, when worms like iloveu were spreading like wildfire... And it was a good thing at the time, helping slow down the spread of computer worms. We are now 10 years later... This measure is old, but still necessary, since users are still not fully aware of the risks they expose themselves to... But we're teaching them to bypass it. Actually, many security measures are broken, with no replacement solution.

There's a dose of trial and error in the process of putting security controls in place. Unfortunately, we don't take the time to look at other fields, like engineering or physical security, to learn from their mistakes and avoid falling into the same mistakes ourselves.