Slashdot Mirror
Users Rejecting Security Advice Considered Rational
WeeBit writes "Researchers have different ideas as to why people fail to use security measures. Some feel that regardless of what happens, users will only do the minimum required. Others believe security tasks are rejected because users consider them to be a pain. A third group maintains user education is not working. [Microsoft Research's Cormac] Herley offers a different viewpoint. He contends that user rejection of security advice is based entirely on the economics of the process." Here is Dr. Herley's paper, So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users (PDF).
What dosen't make sense are the people who bitch and moan about what a hassle Linux is to set up and get figured out, while they waste hours and hours of their time and money cleaning out their Windows installs, setting up anti-malware programs that waste even more time in the form of annoying pop-up reminders and eaten CPU cycles, and even reinstalling their O.S.; if not bothering or paying somebody else to do it. I'd been toying aroung with Linux and Unix for years for business and personal use, but I finally switched for good when I realized that I was wasting more time with Windows than I would with a *NIX O.S.
Windows can be used safely and quickly without protection, but only by savvy users who don't do any "real-world" stuff like torrent or allow the occasional ingorant user to use their computer.
Would Linux be more safe if it had greater than or equal to the market share of Windows? Is any home O.S. really safe as long as the user keeps clicking "yes" or "ok"? That's a whole other debate. The fact is that Linux, now, is much less of a hassle than Windows.
I have a simpler conclusion... Most users are idiots!
Even simpler: most people are idiots.
http://michaelsmith.id.au
I agree with this assesment. I work at an IT company that supports many different companies and users of different size. We are a small operation (10 techs).
Most security recommendations are rejected due to the cost of implementation when dealing with corporate customers. Smaller businesses and individual users will reject them due to the lack of perceived risk.
Simple example is when a salon did not want to spend the 30 minutes in labor secure their wireless network because guests use it. We said no problem and offered to setup a guest network and secure their internal wireless network. No problems with their Cisco SA. They still did not want to do it. Their reasoning was not the $50 one time cost but, "who would want to go to the trouble of accessing our data? we have nothing sensitive"
They realized their customer databases were password protected within that application, understood they had nothing on their workstations or shares to hide, and basically said fuck it when we were offering a low cost, non-invasive, transparent to their customers solution.
That's just one example. Lots of these "dumb endusers" fully understand the security and the solution and the cost, but feel they are not a valuable enough target to worry about it.
I can still remember the Computer Security professor telling the class on the very first day that computer security is a matter of economics. How much does it cost to implement? How much do you stand to lose if your security is broken and your "stuff" stolen? At some point, you reach a point of diminishing returns and it is wasteful to spend more on security.
And in this context, time, effort, and inconvenience all have a significant cost that must be counted.
The average idiot computer user is not always as dumb as you think they are.
How about this one... At least in businesses...
Users in a business generally have very little if any incentive to follow any security policy that does not happen automatically, without any intervention on their part.
It is not their data, not their computer, and generally not their problem. If something goes wrong... they might have to move to another desk for a little while, while "the computer guy" "fixes" everything for them. They might even get a slap on the wrist for not following policy... But generally, the "users" have no reason to interrupt their busy day with any security policy that interrupts their busy schedule (of facebook and slashdot browsing). When malware hits, it is inevitably not their fault, but rather the fault of those same "computer guys" who have to go in and fix it.
Ain't reality a bitch?
Why does IT like Windows?
Two words: Job security
Blunt and brutal as it sounds, I'm all for Windows in a work environment, even though I don't want to be subjected to it in my private space. Hey, at home I need to be productive! At work, I need to be certain I still have a job tomorrow. And, bluntly again, that's more secure with a system that acts "weird" from time to time and keeps failing on the user than with a system you set up once and run 'til the end of time. For crying out loud, Linux even does generation changes without aid from IT, can you imagine what that would mean to your job? Imagine Linux being used in office, with the new versions quietly installing themselves while all the software keeps working!
Tell me you don't prefer a system that needs YOU to go there and install it, then breaks every kind of compatibility and keeps you busy and employed for ... well, at least 'til the next generation of system needs to be installed.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Blunt and brutal as it sounds, ... ... I've occasionally run across this reasoning told as a joke, shown it to friends whose business is supporting Windows, and told that it's no joke at all. The typical response is along the lines of: Hey, I've installed linux for a few customers. Each time, it only took me an hour or so, and that's all I got paid for. Then I never heard from them again until they wanted someone for another hour to do an install on a new machine. OTOH, with my Windows clients, I typically get paid for at least a full day to install anything, and then I get called back for half- or full-days whenever the system shoots itself in the foot. We'd be fools to advocate a system like linux when Windows produces two to three orders of magnitude more billable time for us. Of course, we all use linux and/or OS X at home, but that's not where the support business is.
As long as the suckers^Wclients continue to act like they do and fall for the "market leader" sales propaganda, this isn't going to change. It's been like this in the computing industry since at least the 1960s, so don't expect it to change during your lifetime.
Those who do study history are doomed to stand helplessly by while everyone else repeats it.