USENIX LISA: Security Theater Plays a Role - Bruce Schneier's Keynote
The opening keynote Thursday of the USENIX LISA conference in San Diego was by author and security expert Bruce Schneier. In his opinion "perceived security" should be an aspect of all security implementation.
The large conference room was packed at Schneier's presentation, "Reconceptualizing Security." In one of his first slides, he pointed out that security has always been one of the basic human instincts by showing the part of the brain known as the amygdala where the emotion of fear (and its opposite, security) is seated. Schneier joked that "the newer part of the human brain responsible for heuristics is still in beta." He undermined the discrepancy between subjective feelings and provable facts with a few examples. Deviating from his slides and presentation material, he relied mainly on his words and gestures. "Security is at one time feeling and reality," according to his thesis, "You can feel safe without actually being safe, and you can feel unsafe for no apparent reason."
Schneier applied his thesis to a phenomenon he called "security theater." As an example he used the safety screw cap, designed to quell any fear that the content of the bottle might have been tampered with. He could think of at least ten ways that the content could be compromised, mentioning a syringe for one. Nevertheless, tamper-proof bottles provide an objective sense of security, which proved a saving grace for the medication industry after some well known poisoning incidents. Schneier felt that "as technicians, we kid ourselves that the security for which we're responsible is reliabable. That isn't true. We forget that humans play a major role."
Ignoring the emotional part of security is wrong in Schneier's judgment, and he advises technicians to incorporate the "security theater" concept in their work. Responding to a question about statistics, he suggested that they have little effect: "People who know statistics think they work better, but they don't." According to him, security models should adhere closely to reality, while recognizing that reality is mutable. His conclusion: "It's only when the feeling and the reality of security converge that we have real security."
Issue 245/2021
Buy this issue as a PDF
News
-
GNOME 40 Beta has been Released
Anyone looking to test the beta for the upcoming GNOME 40 release can now do so.
-
OpenMandriva Lx 4.2 has Arrived
The latest stable version of OpenMandriva has been released and offers the newest KDE desktop and ARM support.
-
Thunderbird 78 is being ported to Ubuntu 20.04
The Ubuntu developers have made the decision to port the latest release of Thunderbird to the LTS version of the platform.
-
Elementary OS is Bringing Multi-Touch Gestures to the OS
User-friendly Linux distribution, elementary OS, is working to make using the fan-favorite platform even better for laptops.
-
Decade-Old Sudo Flaw Discovered
A vulnerability has been discovered in the Linux sudo command that’s been hiding in plain sight.
-
Another New Linux Laptop has Arrived
Slimbook has released a monster of a Linux gaming laptop.
-
Mozilla VPN Now Available for Linux
The promised subscription-based VPN service from Mozilla is now available for the Linux platform.
-
Wayland and New App Menu Coming to KDE
The 2021 roadmap for the KDE desktop environment includes some exciting features and improvements.
-
Deepin 20.1 has Arrived
Debian-based Deepin 20.1 has been released with some interesting new features.
-
CloudLinux Commits Over 1 Million Dollars to CentOS Replacement
An open source, drop-in replacement for CentOS is on its way.