Slashdot Mirror
Schneier: We Need To Relearn How To Accept Risk
An anonymous reader writes "Bruce Schneier has written an article about how our society is becoming increasingly averse to risk as we invent ways to reduce it. 'Risk tolerance is both cultural and dependent on the environment around us. As we have advanced technologically as a society, we have reduced many of the risks that have been with us for millennia. Fatal childhood diseases are things of the past, many adult diseases are curable, accidents are rarer and more survivable, buildings collapse less often, death by violence has declined considerably, and so on. All over the world — among the wealthier of us who live in peaceful Western countries — our lives have become safer.' This has led us to overestimate both the level of risk from unlikely events and also our ability to curtail it. Thus, trillions of dollars are spent and vital liberties are lost in misguided efforts to make us safer. 'We need to relearn how to recognize the trade-offs that come from risk management, especially risk from our fellow human beings. We need to relearn how to accept risk, and even embrace it, as essential to human progress and our free society. The more we expect technology to protect us from people in the same way it protects us from nature, the more we will sacrifice the very values of our society in futile attempts to achieve this security.'"
Mitigate biggest risk and immediately something else becomes biggest. At some points you have to stop because every next risk is smaller and more has to be sacrificed for smaller piece of safety.
Bruce is right. Even if our society managed to put enough measures in place to mitigate all but the risks associated with an asteroid impact, you surely would not want to live in that society, as the term "living" would be a loosely defined term at best. It would be a society essentially devoid of free will.
Write failed: Broken pipe
3,000 lost lives have caused us to spend trillions on wars. A fraction of that invested in additional medical research would have saved far more.
A death in front of the cameras is worse more than a million deaths on a hospital bed...to a politician.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Though increasingly I start getting the impression that he's firing about a couple of "duh. You don't say..." statements. Or is it just 'cause I'm in the sec biz that it seems "duh" to me?
Why does anyone think security is in any way different from any other business? In EVERY business, every project, every goal you have, everything you do, the first 90% take 10% of the work, while the last 10% gobble up 90%. Be it 80/20 or 70/30 in yours, I won't split hairs, but that's how it is: A huge part of the project or goal is trivially implemented while a minimal part takes up the lion's share. I'd even go so far to say that in security, the ratio is 99-1.
The GOOD thing about security is that you can actually just do the first 99% and accept the risk for the rest, and get away with an incredible cost/benefit ratio. And you'll find that most companies actually use that strategy in their risk management and reach a security level of 95+ percent. Actually, the joke here is that most companies are, at least in my and I'd say "our" (yours too, I'd guess) definition of security standards, under-secured because of their IT-Governance and that "95% is good enough 'til everything is at 95%" rules. That's why trivial security mechanisms aren't implemented. We're already at 95 with sec. No need to throw money that way (and, believe it or not, most companies reach their "recommended" IT-Sec level easily. Simply because those 95% are SO dirt cheap, easy and painless to implement that they almost certainly ARE already in place, and if not a few pennies will do. You'll find the IT-Sec requirements usually in the "quick wins" quarter of the chart).
You see, companies already heed that advice. Mostly because they don't give a shit about customers complaining about shoddy security because, well, they'll still buy 'cause we're SO cheap. And yes, they do.
It's different with governments that won't just get a quick outcry when a security blooper happens (like a corporations would if they, say, lose every CC number of your customers). If a plane crashed anywhere into a building again, the press would have a field day. HOW could this happen? Didn't our law makers learn anything from 9/11? Did they simple ignore it and go on with their life? What do we have those useless twits for if they do not do ANYTHING? You may fill up here with statements of your choice, but one thing is certain: This administration is finished. Done. Nobody will give them credit for anything anymore. And you better forget about winning the next elections for at least half a decade. People tend to remember those things (and the other party will spend a lot of time and money reminding them of it).
So we need 100% security. Not because we really want it or need it. Not because the scenario is so dangerous to us, the people.
It's dangerous to them, and their place at the feeding trough.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Almost but not quite - when something goes wrong, a large proportion of people start looking for some way to shift the responsibility from their own actions to some other party. Not quite everyone is like this, but the number that accept responsibility for themselves is diminishing and when you see one person after another getting away with shirking their responsibility it makes it harder and harder to justify and not go down that destructive path yourself.