What mind-set does security require?

So, I'm reading my copy of Information Security Magazine, when I read an article by Jay Heiser about "Military Madness".  Go read it yourself - I'll wait.

The article amused me particularly because my boss and one or two of my co-workers came out of the military.

I don't think the business mind-set really always helps all that much, either, sadly.

The most glaring examples are the "your data is now ours, and we can sell it to whomever" issues that have been plaguing various credit card processing companies for some time.

Where I work, in health-insurance, I've found the safest position to occupy is to view the member's data as belonging to the member, and held
in trust by us solely for the purpose of doing business on behalf of that member.

I think that a lot can be achieved simply by re-coupling benefit and loss, or risk.  Take credit cards, for instance, where the benefit accrues to the banks, and the loss accrues to the vendor and rarely to the customer.

Vendors can't tell credit card companies that they're going to go to an all-cash basis, and they won't get far by telling customers that their credit cards are too risky to take.  So, the banks cleverly lump all of the risk with the group least able to manage it - while at the same time making commercials that imply that identity theft is all the fault of those nasty vendors.

There's no feedback within the credit card system that allows or encourages it to self-strengthen.  Any strengthening measures are imposed from outside, such as the US law that limits a card-holder's liability to $50 - but even this is short-sighted, as it does not offer any protection to the merchant, who gets charged on the transaction coming in, the cost of any goods they send out as a result, a second charge on the refunding of the money to the card-holder, and often a $25 "chargeback fee" for having the temerity to accept the credit card in the first place, despite not having any reliable way to verify that the card is in the possession of the card-holder.

Published Tue, Mar 14 2006 21:16 by Alun Jones
Filed under:

Comments

# re: What mind-set does security require?

I am one of the former "military mindsets" that Alun refers to, namely the "boss".
Alun has it right on the mark with his concept of business being the trustee of the information. The owner is still the individual that we represent. They have merely trusted us to hold thier information for the purpose of doing business for them.
As far as the military mindset and the business mindset in security, I think there has to be both. The author of the article has a great concept about the business mindset in ensuring the transaction is genuine, but then doesn't that make the data we hold more valuable to the thief? So we still have to protect the data (the military mindset). Contrary to the author's statement, they are not opposite priorities, but rather complementary and both essential to providing security throughout the transaction (user to vendor to bank).
One of the important principles that security personnel sometimes forget is that we need the system to be usable, yet secure. The balance is essential to providing proper security. If a system is too secure and limits usability, it stops the user from being able to perform the functions they want to perform and they will circumvent the security thereby rendering the system insecure.
The secret of life (and security) is to maintain balance and look at an issue from as many angles as possible.

Wednesday, March 15, 2006 5:40 PM by Paul

# re: What mind-set does security require?

Definitely - security is always a balance, a risk management exercise, a compromise between usability and prevention.

Occasionally, the two sides come together, for instance when you can make an interface more secure by reducing its complexity, and simultaneously increasing its usability.

More often, you have to make a decision as to where on the sliding line you're going to mark your position - defensible, but usable; private but audited. This is why appropriate security depends on where you sit.

If you turn security into a black/white question of "is this secure?", the answer is always going to be "no" - you can always find a way to subvert the system.

The question always has to be "is this secure enough for my purposes?".

Wednesday, March 15, 2006 7:19 PM by Alun Jones

Leave a Comment

(required) 
(required) 
(optional)
(required) 
If you can't read this number refresh your screen
Enter the numbers above: