How to think about security – or any feature request for that matter

This five-step process works for any security measure, past, present, or future:

  1. What problem does it solve?
  2. How well does it solve the problem?
  3. What new problems does it add?
  4. What are the economic and social costs?
  5. Given the above, is it worth the costs?

When you start using it, you’d be surprised how ineffectual most security is these days. For example, only two of the airline security measures put in place since September 11 have any real value: reinforcing the cockpit door, and convincing passengers to fight back. Everything else falls somewhere between marginally improving security and a placebo.

Read the rest at in the Crypto-Gram newwsletter. via Cafe au Lait.

One thought on “How to think about security – or any feature request for that matter

  1. One thing that bothers me is how we hear how these security measures are of little cost to no cost of our freedoms.
    This couldn’t be any farther from the truth. I am reminded of something Cliff Stoll said in his book “The Cukoo’s Egg” about computer security – by putting more and more measures into place stymies the flow of free information.
    I compare this statement to security in general – the more measures you put into place, you stymie the flow of freedom.
    Bush and his republican minions strategically asked us, right after the 9-11 attacks, if we were willing to give up some of those freedoms for more security. We readily said yes. We looked for something that seemed warm in a time of cold without thinking about what we were truly saying yes to.
    What are we willing to give up in the name of “security” and then, are we really secure? Just because the front door is locked, doesn’t mean the burgler will give up and walk away.
    These are things to think about at the next elections and in 2004. Giving the current administration 4 more years, I think, will be disasterous.

Comments are closed.