I Don't Give a D...

I just read an excellent post on the Veracode blog... Mobile Security – Users Just Don’t Care

The gist of it is that users want to be protected against common threats, but aren't willing to put in the effort needed to get there.

And that's the problem right there. Users have to make an effort to protect themselves beyond what seems reasonable to them. Since humans are fundamentally not very good at analyzing risk, users will downplay the scope of the real risk. That's also why we keep running into fear-based messaging trying to influence purchases or change behaviour.

In fact, that sums up the problem we face in security pretty well. Our fellow citizens outside the security world don't really understand why we get so worked up, and the only way we've managed to sell our projects is by pointing to doomsday scenarios. Has that served us in the long run? Looking at the general state of security, I don't think so. Groups like Lulzsec and Anonymous have gone through the security of large corporations like a hot knife through soft butter. There are serious questions to be asked about what we've actually accomplished as security professionals over the last 10 years.

I first got that shock in 2007 when I went to Blackhat/DEFCON, where the vast majority of talks covered Web 2.0 security issues that strangely resembled the problems we lived through in the 90s with buffer overflows… Goes to show that history repeats itself and that new generations don't learn all that much.

We live in a system that rewards cost cutting. Security is a cost. It's easy to cut security (right, Sony?). In general, there are few consequences to those cuts, managers get nice performance bonuses and the cutting cycle continues. The problem with security is that we never know when disaster will strike… And above all, how big the disaster will be. Since the lessons of the past have shown us that security cuts never had very serious consequences, nothing forces anyone to take security seriously. If Sony hadn't suffered such a security breach, the managers involved would have received their performance bonuses and everything would have carried on as usual.

That was the past. Now that we're dealing with activist groups that don't think twice about vandalizing and stealing information whenever they feel like it, the risk of becoming a public target keeps growing. Despite that, financial incentives will favour cutbacks to increase bonuses, often at the expense of good practices.

What will be interesting to watch over the coming months and years is how these two forces clash. Considering that companies don't have a great track record of applying good practices, I think lawmakers will have to step in and force companies' hands… As was the case with occupational health and safety laws or in the financial sector (a SOX that makes managers accountable for breaches?). Without guardrails, it's the Wild West :-S