Slashdot Mirror
Schneier Mulls Psychology of Security
bednarz writes "Cryptography expert Bruce Schneier says security decisions often are much less rational than one would prefer. He spoke at the RSA conference about the battle that goes on in the brain when responding to security issues. Schneier explains 'The primitive portion of the brain, called the amygdala, feels fear and incites a fear-or-flight response, he pointed out. "It's very fast, faster than consciousness. But it can be overridden by higher parts of the brain." The neocortex, which in a mammalian brain is associated with consciousness, is slower but "adaptive and flexible,"'"
Too bad the Department of Homeland Security doesn't have a neocortex.
I'm out of my mind right now, but feel free to leave a message.....
Bruce has more at his website.
http://www.schneier.com/essay-155.html
As he says, we really should have two different words for the "feeling of security" and "security".
There is always Anakin to the rescue.
Most thinking about security seems to be centered in the nullcortex.
much of left-wing thought is a kind of playing with fire by people who don't even know that fire is hot - George Orwell
Which is why "Don't Panic!" is such good advice.
spoonerize "magic trackpad"
That is why the real amygdala hides in the background pretending to be a mere attendant like the pitutary gland and communicates with a prominantly placed fake-amygdala using elaborate signals and esp communication. All these scientists have been fooled into studying the fake-amygdala. So they underestimate the real security of the brain. Let someone assassinate the fake-amygdala in a spaceport in Coruscant and suddenly you will see the real amygdala emerge from the shadows and assume the role as the rightfully elected Queen of Naboo.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Didn't we have an article about this already? Oh wait, that was about the fact that he was going to speak at the con, now we have an article about the talk he just gave?
Good lord, I want that guys press agent!
Tom
Someday, I'll have a real sig.
Is there something like "100% Security" for anything? I doubt it.
Wincopy
Just junk food for thought...
It seems unnecessary to incorporate impressive-sounding terms into a speech that, quite honestly, seems to be stating the obvious. Increasing or decreasing security is a response to fear; fear is an emotion and, therefore, decisions that use it as a base will not be purely rational, but will have emotional bias, like every other human decision. You don't need vague descriptions of brain "impulses", and such, to prove that.
People care more about problems that they can't control than ones they can prevent.
For example: Airplanes. How many people feel more secure behind the wheel of a car than on a long flight with turbulence?
Put your hands down, now the sheer probability of getting into a car accident in one's lifetime (if one drives) is a miniscule number below one. Death statistics are somewhere around 1 in 237 of a car type accident. The odds of an airplane death are like 1 in 5051 source
However, people are freakishly nervous about planes... So, by induction (the bane of an engineer's existance) we can extrapolate (another fancy bane) that security people will ignore the dangerous mundane and fixate on the extraordinary rarity.
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
I think that the true dichotomy of the situation that plays out in people's minds is 1) Spend the time and effort to secure this system the right way and stress out all the time 2) Be lazy and just do what will get us by and at least buy us some security even if it's security through obscurity.
Malcolm Gladwell's book "Blink" talks a lot about the differences between first impression and actual, thoughtful reaction to a situation, including some interesting studies on what happens when the two conflict and how measurement of the effects of those conflicts on reaction time can tell us a lot about how the brain is processing material. There's controversy around some of his conclusions but I strongly recommend the book and everything else Gladwell has written.
Nostalgia's not what it used to be.
More on this philosophy:
Its just a part of "General Semantics" http://en.wikipedia.org/wiki/General_Semantics/. Given a good boost by noted science-fiction writer A.E. Van Vogt who was later hounded by Scientology http://en.wikipedia.org/wiki/A._E._van_Vogt/
People like to go on and on about "feh the authoritees are stoopid", like all the ass-talking over the incident in Boston last week.
But the real world doesn't work that way, unless you live in Mensa-Fascist-Fantasy-World and fantasize the state killing those that don't behave with Klingon-like rationality. Basically, you have to take the stupid, irrational people into account. (Damn Customers!)
Many public (law enforcement) agencies have a motto: "Could You Explain It On 60 Minutes?" That pretty much sums it up. For example if I hear one more rich techie blowhard bitching about how they are inconvenienced by airport security I'll scream. But they are not in charge of hiring thousands of people for the oh so wonderful jobs involved in groveling through people's luggage and car trunks. And were we to implement a putative purely rational system, what would Mr Techie say to 60 Minutes in the even that someone got through?
Give a man a fish and you have fed him for today. Teach a man to fish, and he'll say "WHERE'S MY FISH, YOU IDIOT?"
A feeling of security is created by
-locking turrrrrsts (or people who just might be ones) into secret prisons and off-shore camps for an indefinite time
-wiretapping you
-taking away your basic civil rights
-manipulating the media
-bombing country X
-creating a color indicator for turrrrrr threat levels (to make you feel extra secure, they can flash orange every now and then)
-ridiculous airport safety checks ("those paper scissors are a big no-no, but the knife we give you onboard is completely safe!")
-reminding you how unsafe you'd be without all of this.
Burn karma, burn...
This may be a little off the point of TFA but I am not sure what the author means when he refers to the part of the brain that is related to "Consciousness". Neither am I clear on what the author means by the term "consciousness" here. Is consciousness, per the author, limited to the brain? What about the emotional, vital parts of a human being and what about that "inner voice" or daemon or feeling many people talk about? Are those not parts of consciousness? Coz then I would like to make them a part of the equation on which people base their fears, also.
Life is about being a Phoenix!
Too bad the Department of Homeland Security doesn't have a neocortex.
That's alright, they have a neoconcortex instead!
Sorry, couldn't help myself. You may now mod this post into oblivion...
Linux, you magnificent bastard, I read the fucking manual!
But, I wonder how much attention we would pay to a psychologist speaking on computer science. Is the only qualification to speak on anything non-technical, the ability to pick up a first year text book and leaf through it?
As much as I respect Schenier, I would no sooner trust his assertions on psychology, than I would trust those of Dr. Phil. If he had co-written a couple of articles with someone relevant and had them published in a proper journal things would be different. But after reading the (otherwise impressive) list of his publications it is clear that this is not the case.
So flame me, but Schenier has little authority when he speaks of psychology.
On a more serious note, though, I fully agree with your basic point that there is not much worse than people taking concepts from a discipline they know almost nothing about (in this case cognitive neuroscience) and then throwing them around as buzz words and making theoretical claims that make you cringe if you have some basic understanding of the material.
His view is far too complicated. The essence of security is: people think they are secure. They happily type their data into web sites without considering where it goes because in most cases, they have no clue what systems are in operation. Past the words "computer", "database", and "Internet (or Web)" the average person has no concept of how any of it works. Someone, their bank say, sends them a link to a website -- the first problem is, they really have no way to verify it is from their bank, other than going to their local branch and asking, which seems to be beyond anyone's capability. Now, once they've accepted that the link is "legitimate", whether it is or not, they plow ahead and begin banging on the keyboard and typing in their info. Screens come and go, they are admonished occasionally when they don't enter something right, and finally some message pops up thanking them and that's that. Whether the whole transaction was legitimate or not never enters into it.
"Security" is a misnomer -- you are no more secure against possible data theft or manipulation on the Internet than you are physically safe crossing the street in a crosswalk. The only security you can have is in being vigilant in what you do and following up everything you do to make sure it is legitimate. Past that, you're on you own.
GetOuttaMySpace - The Anti-Social Network
As someone who suffers with panic disorder and who is also a network security person by trade (CISSP consultant, unfortunately) I can attest to the irrationality of the "lower" brain. Persons with my condition frequently find it unbearable to do something as simple as stand in line or get in an elevator as even the smallest perceived loss of freedom is enough to send the heart rate soaring. On a particularly bad day I had to excuse myself from a post office line for 15 minutes to pretend to be filling out an address on an envelope as the impending "Next!" and being faced with some "official" was making my hands shake. For the rest of you there is no more mundane experience than mailing a parcel!
All that said, I think Schneider's comments about the amygdala are a bit misplaced. The horrendous waste of security resources in this country -- the 3oz limitation on liquids for example -- do not originate from a panicky, palm sweating reaction but rather a much more calculated, if reactive, decision to make the average person feel like something is being done. If you want to talk about the amygdala and security, talk about one's reaction to a stranger approaching you in the park at night with a "hey buddy, come here a second." Corporate and government security policies are hashed out in nauseatingly arduous sessions with many "expert" consultants who throw out their usual spiel to justify their oversized fee.
Bruce would do better to argue that we need to account for our tendency to implement security schemes which favor the perception of effectiveness rather than true scenario effectiveness. Then again, he is a cryptographer, we can't expect him to be an expert on all things security. Injecting bits of psychology is tempting but runs the risk of being disingenuous. He loses a little credence in my view.
That doesn't say anything to me. The fact is that if you get into a car crash, there are chances that you may survive. In an airplane, thats it! End of Story! No second chances! Maybe that is the cause of the fear, don't you think? And a legitimate one at that. Given a choice would you rather be in a car crash or a plane crash, the consequnces of both aren't disclosed to you yet?
The important measure isn't odds of death in a crash, it's odds of death per mile traveled.
If you drive from Boston to San Diego you're more likely to die than if you fly from Boston to San Diego. But coming back around to your point this measure even masks non-fatal injuries. Since most car wrecks don't result in death, it therefore figures that driving from Boston to San Diego you're much more likely to be injured or maimed than if you fly, by a factor of (car crashes / fatal car crashes).
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I couldn't find the -1 Oblivion mod. A little help here?
The primitive portion of the brain, called the amygdala, feels fear and incites a fear-or-flight response
Hire River Tam as your chief security officer.
Abstinence doesn't prevent unauthorized physical access. Besides, penetration testing is a vital part of security.
Now I need to go take a shower.
It's nothing but crumpled porno and Ayn Rand.
"The primitive portion of the brain, called the amygdala, feels fear and incites a fear-or-flight response, he pointed out. "It's very fast, faster than consciousness. But it can be overridden by higher parts of the brain."
But rarely is, in ninety-eight percent of the known cases, i.e., humans.
"The neocortex, which in a mammalian brain is associated with consciousness, is slower but "adaptive and flexible,"
Again, rarely - about two percent of the known cases at best.
Chimpanzees simply don't do well with the fear of death. You can blame evolution, but facts are facts.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
As a programmer I find (in regards to security) that fear is often overridden by laziness
That said, the side effects of global warming will likely result in a far higher death toll than terrorism. But at the same time, global warming is unlikely to cause as many human deaths as car accidents, HIV, cigarettes, swimming pools and all the other things that people commonly die from. Global warming is obviously an issue, but it's not going to cause climate change on the scale of Venus, because if the Earth's climate were that fragile, we wouldn't be here today.
How well do you know your Bruce Schneier Facts?
...the article is talking about!
OMG! We're gonna die!! Think of the children!!!! Baaaaaaaaaaaaaaaaaa!!!!!!!! Nacho grande!!!!!!!!!!!!!!!!
Okay, if you've got daemons in your head, then either:
1) Your brain runs on *nix, or
2) You need an exorcist