Slashdot Mirror

← Back to Stories (view on slashdot.org)

Schneier's Keynote At Linux.conf.au

Posted by kdawson on from the necessary-security-theater dept.

Stony Stevenson writes "Computer security expert Bruce Schneier took a swipe at a number of sacred cows of security including RFID tags, national ID cards, and public CCTV security cameras in his keynote address to Linux.conf.au (currently being held in Melbourne, Australia). These technologies were all examples of security products tailored to provide the perception of security rather than tackling actual security risks, Schneier said. The discussion of public security — which has always been clouded by emotional decision making — has been railroaded by groups with vested interests such as security vendors and political groups, he claimed. 'For most of my career I would insult "security theater" and "snake oil" for being dumb. In fact, they're not dumb. As security designers we need to address both the feeling and the reality of security. We can't ignore one. It's not enough to make someone secure, that person needs to also realize they've been made secure. If no-one realizes it, no-one's going to buy it,' Schneier said."

13 of 138 comments (clear)

  1. In other words . . . by base3 · · Score: 3, Insightful

    . . . Bruce has figured out the real money's in security theater, not in security, and he wants a piece of that action.

    --
    One CPU cycle wasted on digital restrictions management is ONE TOO MANY.
    1. Re:In other words . . . by ppanon · · Score: 5, Insightful

      No. What Bruce has realized is that, in the boardroom and the lunchroom (where almost nobody knows any better), security theatre often will kick the ass of real security practices because it's marketed by professional sales teams. It also often can be delivered for less (because it can be priced for what the market will bear).

      If you want real security to be provided, you have to learn to sell it at least as well as the snake-oil. You have to make it sufficiently visible, but non-impeding, that people feel safe.

      It's about understanding the human/political side of the equation that can make the difference between a successful deployment and a perceived failure.

      --
      Laissez lire, et laissez danser; ces deux amusements ne feront jamais de mal au monde. - Voltaire
    2. Re:In other words . . . by QuantumG · · Score: 4, Insightful

      It's an interesting theory but are you aware of anyone who thinks the bullshit we go through at the airport is for anything other than appearances? It's not just geeks and smart asses who know this, it is everyone.

      --
      How we know is more important than what we know.
    3. Re:In other words . . . by QuantumG · · Score: 3, Informative

      Uh huh.. I, unfortunately, spend a lot of time in airports.. I've never once seen someone taking off their shoes with a smile on their face.. there's only one thing you think when they tell you to take your shoes off: "oh my god this is bullshit." If your friend actually thinks there is a sensible reason to scan the shoes of flyers then I suggest you get him some psychological help.

      --
      How we know is more important than what we know.
    4. Re:In other words . . . by QuantumG · · Score: 3, Insightful

      I think you're laboring under the belief that:

      1. the sole of a shoe can contain any significant amount of explosive
      2. that walking on such a shoe would not cause the explosive to go off
      3. that airport scanner technology can tell the difference between explosives and leather

      None of which are the case. The only thing you could maybe fit in the sole of a very hard soled shoe would be a knife.. which hopefully people realize doesn't give a would-be hijacker any more of an advantage than being unarmed - if 50 scared passengers rush you, it doesn't matter that you have a knife. And that's what should have been the lesson of 9/11: if you allow yourself to be victimized you will die.. but if you step up and stop hijackers there is no way to hijack a plane.

      All in all, I wish the government would just let the market decide. There should be a "no security" terminal where people can catch a plane much as you catch a bus.. buy your ticket, get on the next available flight. If you want to be harrassed, go to the security theater terminal.

      --
      How we know is more important than what we know.
  2. love this line... by Serious+Poo · · Score: 3, Funny

    "tailored to provide the perception of security rather than tackling actual security risks." Isn't this also the mission statement for the TSA?

    --
    "There is nothing more unequal than the equal treatment of unequal people." - Thomas Jefferson
  3. CCTV - Worth its weight in gold by mungmaster2000 · · Score: 5, Interesting

    CCTV almost never captures what you set out to catch. In many organizations, it's a knee-jerk reaction to some kind of incident. ie) Something got pinched, someone received an ass-kicking, etc. Even if you do catch it, you'll never be able to identify/recognize/charge/convict the person based on the video image alone. 4CIF at 30 fps is pretty much as good as it gets right now in most feasible installations. All you'll be able to say is, "Subject is hatless...REPEAT...HATLESS!" (And that's even if he's in the frame). The PTZ will just pan around aimlessly on a tour program, or be pointed at the wrong thing. However, wide-spread deployment of CCTV systems is still not futile; you just usually end up catching something that were never really looking for in the first place. People and vehicular traffic movements, facility useage, or realtime video of an incident in progress that just happens to be going-on in front of the lens. You can establish time frames of entry or exit, or use it to clue-you-in to the right path to finding the real evidence you're looking for. From a security systems perspective, more CCTV is better, but not to mitigate direct and specific threats. Only general ones. Or sometimes you just luck-out and with a good booby shot in the atrium of an office building.

    1. Re:CCTV - Worth its weight in gold by warrigal · · Score: 5, Interesting

      Sometimes cameras can have a deterrent effect. I don't mean those lame dummy cameras, either.

      Just the rumor that we were putting a camera system in our school practically eliminated graffiti

      vandalism in a vulnerable area. The vandalism then took other forms, which were actually more of a problem.

    2. Re:CCTV - Worth its weight in gold by 0racle · · Score: 3, Interesting

      There is a slight difference between keeping a potential thief from doing anything and preventing a terrorist from doing something.

      Burglars choose easy targets. CCTV and alarms make the target more difficult so most move on. Experienced thieves require more then just a sign to keep them away but still, they are for the most part looking for the easy target.

      Terrorism is not a crime of opportunity. You can make the target appear as difficult as you want, all that does is make them plan a little more. The stupid restrictions at the airport do nothing to deter terrorists.

      --
      "I use a Mac because I'm just better than you are."
  4. Schnier's List by jakepmatthews · · Score: 4, Funny

    I think that would of been a catchier title...

  5. Electronic Voting Security Theater by r7 · · Score: 5, Interesting

    For many of the same reasons there is no semblance of a secure electronic voting platform on the horizon. The reason is not that such a platform would be difficult to design. The reason is that it would not be profitable.

    To be secure it would have to be open. In the case of voting platforms that means every line of code, every encryption algorithm, and all the hardware has to be open, published, and known. Nobody has yet figured out how to make enough money from such a system to outspend Diebold's lobbyists and earn considered from election officials.

  6. We nerds and geeks need to wake up to theater by mlwmohawk · · Score: 4, Interesting

    As a nerd and geek and long time hacker, it is perfectly clear to me that I've been missing the "theater" aspect of the technology that I love.

    Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.

    There are two sides to change of any kind. (1) The actual details of change. (2) The psychological affirmation that it is worth the effort. No matter how valid the argument presented by the first, if it does not provide the second, it will fail.

    If we wish to push Linux, we have to create theater around it.

  7. The Reality and Perception of Security by canterbury+rod · · Score: 4, Insightful
    In Bruce Schneier's keynote address at Linux.conf.au, he essentially admonishes that "security theater" is not only a necessity, it's a critical component that needs to accompany real security solutions. In the article, he states

    the best security solution will fail if it doesn't cater to both the reality and perceptions to do with security. He's affirming that sales in the marketplace will be driven when security theater and real security products are matched. That's when end-users will also experience a real sense of security.