Security Myth #1: "More Security Is Always Better!"

We all have the impression that more security never hurts. You can never be too protected! This notion is deeply rooted in our psyche… It even has a name: loss aversion.

This trait shapes our perception and pushes us to over-protect information against every possible threat and vulnerability. In doing so, organizations spend fortunes protecting assets that sometimes have marginal value, or whose sensitivity doesn't call for that much effort. The more you ramp up security efforts, the smaller the return on investment gets. You have to find the "sweat spot" where the investment provides maximum protection at the best possible cost, and where the residual risks are at a level the organization can accept. By that logic, we wouldn't protect an office chair with the same intensity as the secret recipe or the customer list.

I'll use an example to highlight how disproportionate security measures can get. When the army moves an object, it is required to use a protocol appropriate to the sensitivity level of the object being moved. If, for example, it wants to move a military satellite, which is a top-secret asset, the army must put in place whatever measures are needed so that it cannot be accessed by an unauthorized third party, under any circumstances. So the convoy carrying the satellite will be escorted by a very large number of people, will be under active surveillance, and will never be left unattended at any point. The strategic value of the asset justifies the protocol and the associated costs. The problem comes when the satellite has to be set down on a table. According to the rules, that table must be classified at the same level as the satellite that will sit on it. You can imagine that moving that table is going to be fairly expensive (we're generally talking about more than $100k!). As absurd as this may seem, it is justified in the army's operating context. Once we step outside the military context, we can afford a bit of flexibility, which lets us make decisions that allocate resources better. The Pareto principle (80/20) is an excellent example of this, where 80% of the results come from 20% of the effort. The remaining 80% of the effort will only produce a meagre 20% improvement, meaning diminishing returns the more you invest in security.

On top of that, you also have to consider that security is a set of imperfect measures which, put together, are more effective than the sum of their parts.

Reference:
(13 Security Myths You’ll Hear -- but Should You Believe?)