Stories
Slash Boxes
Comments

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Schneier's Keynote At Linux.conf.au

Posted by kdawson on Tue Jan 29, 2008 09:49 PM
from the necessary-security-theater dept.
Stony Stevenson writes "Computer security expert Bruce Schneier took a swipe at a number of sacred cows of security including RFID tags, national ID cards, and public CCTV security cameras in his keynote address to Linux.conf.au (currently being held in Melbourne, Australia). These technologies were all examples of security products tailored to provide the perception of security rather than tackling actual security risks, Schneier said. The discussion of public security — which has always been clouded by emotional decision making — has been railroaded by groups with vested interests such as security vendors and political groups, he claimed. 'For most of my career I would insult "security theater" and "snake oil" for being dumb. In fact, they're not dumb. As security designers we need to address both the feeling and the reality of security. We can't ignore one. It's not enough to make someone secure, that person needs to also realize they've been made secure. If no-one realizes it, no-one's going to buy it,' Schneier said."
+ -
story

Related Stories

This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • by base3 (539820) on Tuesday January 29 2008, @10:00PM (#22230442)
    . . . Bruce has figured out the real money's in security theater, not in security, and he wants a piece of that action.
    • by Anonymous Coward
    • by ppanon (16583) on Tuesday January 29 2008, @10:53PM (#22230812) Homepage Journal
      No. What Bruce has realized is that, in the boardroom and the lunchroom (where almost nobody knows any better), security theatre often will kick the ass of real security practices because it's marketed by professional sales teams. It also often can be delivered for less (because it can be priced for what the market will bear).

      If you want real security to be provided, you have to learn to sell it at least as well as the snake-oil. You have to make it sufficiently visible, but non-impeding, that people feel safe.

      It's about understanding the human/political side of the equation that can make the difference between a successful deployment and a perceived failure.
      • by QuantumG (50515) <qg@biodome.org> on Tuesday January 29 2008, @11:05PM (#22230848) Homepage Journal
        It's an interesting theory but are you aware of anyone who thinks the bullshit we go through at the airport is for anything other than appearances? It's not just geeks and smart asses who know this, it is everyone.
        • I know one person who really does think that. He's a fairly smart person, for the most part, but this one has always baffled me. Oh, true, he thinks that some of the measures are bullshit, but he fails to see that they're pretty much all bullshit... so he's in the same camp as the true morons, just a matter of degrees.
          • by QuantumG (50515) <qg@biodome.org> on Tuesday January 29 2008, @11:36PM (#22231014) Homepage Journal
            Uh huh.. I, unfortunately, spend a lot of time in airports.. I've never once seen someone taking off their shoes with a smile on their face.. there's only one thing you think when they tell you to take your shoes off: "oh my god this is bullshit." If your friend actually thinks there is a sensible reason to scan the shoes of flyers then I suggest you get him some psychological help.
            • I agree, it's stupid, but unfortunately, I can't force other people to see reason. If I could, we wouldn't have such bullshit things going on in this country in the first place. ;)
            • I've never once seen someone taking off their shoes with a smile on their face.

              I do.

              Mind you, I think it's bullshit. But the people at the airport are not the ones who caused the problem. The people around me have nothing to do with the decision making that went into it. The people it's appropriate to get mad at are nowhere around. A hostile reaction to the security theater while being subjected to it is itself an emotional, illogical response to the situation.

              So, why get worked up about it while there?

              • Re: (Score:3, Interesting)

                Remember how that guy was foiled without the help of scanning and so the scanning of the shoes is completely superfluous?
                • THAT guy was "foiled" because he was extra-special dumb. He was trying to light his shoe IN THE SEAT OF THE PLANE. All he had to do was go in the bathroom - worst case scenario, the smoke alarm goes off and they think he's smoking in there.
                  • by QuantumG (50515) <qg@biodome.org> on Wednesday January 30 2008, @12:28AM (#22231280) Homepage Journal
                    I think you're laboring under the belief that:

                    1. the sole of a shoe can contain any significant amount of explosive
                    2. that walking on such a shoe would not cause the explosive to go off
                    3. that airport scanner technology can tell the difference between explosives and leather

                    None of which are the case. The only thing you could maybe fit in the sole of a very hard soled shoe would be a knife.. which hopefully people realize doesn't give a would-be hijacker any more of an advantage than being unarmed - if 50 scared passengers rush you, it doesn't matter that you have a knife. And that's what should have been the lesson of 9/11: if you allow yourself to be victimized you will die.. but if you step up and stop hijackers there is no way to hijack a plane.

                    All in all, I wish the government would just let the market decide. There should be a "no security" terminal where people can catch a plane much as you catch a bus.. buy your ticket, get on the next available flight. If you want to be harrassed, go to the security theater terminal.
                    • All in all capitalism with it's "lowest common denominator" economics and decisionmaking is a poor tool against an irrational force like terrorism.

                      I don't see how terrorism is irrational. It is very rational. In fact, it is most rational thing some people can do. It's quite as simple as:

                      1. We meddle in other countries' affairs.
                      2. We tick the locals off.
                      3. The locals want to kill us.

                      It's as old as the "an eye for an eye." Are you saying that the oldest legal code in the western tradition is irrational? Are you saying that the Bible is irrational?

                      Well, maybe they are. But, if they are, then these terrorists are not any more irrational than the people h

                    • "Are you saying that the oldest legal code in the western tradition is irrational?"

                            I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
                            I don't know about western traditions - the Gauls or others
                    • The people didn't "allow" themselves to victimized. They went in with the expectation that this would be like any other hijacking up to that time.

                      And let them selves be a victim of it because they figured it would be over soon. In other words, they failed to take action because they believed no action was necessary.. but if they had always taken action then no hijackings, ever, would have occurred because hijackers would have known that airline passengers are not willing to be victims. As it is now, airline passengers are willing to be victimized before they even get on the plane!

                    • Re: (Score:3, Informative)

                      I think this comes from the Bible (The Old Testament). Its point of origin is known as the Middle East.
                      I don't know about western traditions - the Gauls or others

                      Egh. I was feeling lazy, but here is the Wikipedia page [wikipedia.org] about it. While most people may know it first from the Bible, I think it's the Codex Hammurabi that's often credited for having that written down first.

                      I am not a lawyer or a law student (so whatever I speak of "tradition of legal code" would be out of my arse), but this is the first written code of law to the west of China (and that's what I mean by "western"; like it or not, the Middle "East" and Muslims had frequent interaction with Europe, at leas

  • by Serious Poo (597509) on Tuesday January 29 2008, @10:03PM (#22230460)
    "tailored to provide the perception of security rather than tackling actual security risks." Isn't this also the mission statement for the TSA?
  • by mungmaster2000 (1180731) on Tuesday January 29 2008, @10:15PM (#22230552)
    CCTV almost never captures what you set out to catch. In many organizations, it's a knee-jerk reaction to some kind of incident. ie) Something got pinched, someone received an ass-kicking, etc. Even if you do catch it, you'll never be able to identify/recognize/charge/convict the person based on the video image alone. 4CIF at 30 fps is pretty much as good as it gets right now in most feasible installations. All you'll be able to say is, "Subject is hatless...REPEAT...HATLESS!" (And that's even if he's in the frame). The PTZ will just pan around aimlessly on a tour program, or be pointed at the wrong thing. However, wide-spread deployment of CCTV systems is still not futile; you just usually end up catching something that were never really looking for in the first place. People and vehicular traffic movements, facility useage, or realtime video of an incident in progress that just happens to be going-on in front of the lens. You can establish time frames of entry or exit, or use it to clue-you-in to the right path to finding the real evidence you're looking for. From a security systems perspective, more CCTV is better, but not to mitigate direct and specific threats. Only general ones. Or sometimes you just luck-out and with a good booby shot in the atrium of an office building.
    • Check out this article. [bbc.co.uk]

      These guys would NEVER have been convicted without CCTV.

      Absolute PROOF that CCTV works.
      • That's like having an employee who regularly screws up but their employer decides to keep them because of that one time when they did something right. Is there any actual proof (more than one) that even more monitoring will actually do anything good?
            • by 0racle (667029) on Wednesday January 30 2008, @11:28AM (#22235172)
              There is a slight difference between keeping a potential thief from doing anything and preventing a terrorist from doing something.

              Burglars choose easy targets. CCTV and alarms make the target more difficult so most move on. Experienced thieves require more then just a sign to keep them away but still, they are for the most part looking for the easy target.

              Terrorism is not a crime of opportunity. You can make the target appear as difficult as you want, all that does is make them plan a little more. The stupid restrictions at the airport do nothing to deter terrorists.
    • Well the obvious answer to that is to just put in more CCTV. We need more! THINK OF THE CHILDREN!
    • by warrigal (780670) on Tuesday January 29 2008, @11:16PM (#22230900)
      Sometimes cameras can have a deterrent effect. I don't mean those lame dummy cameras, either.

      Just the rumor that we were putting a camera system in our school practically eliminated graffiti

      vandalism in a vulnerable area. The vandalism then took other forms, which were actually more of a problem.
    • All you'll be able to say is, "Subject is hatless...REPEAT...HATLESS!" (And that's even if he's in the frame). The PTZ will just pan around aimlessly on a tour program, or be pointed at the wrong thing.
      In other words, you have crap ass cameras, or placement. I have NO idea on how this was rated +4 minus dumb ass mods.
  • by jakepmatthews (1142845) <jakepmatthews@NoSpAM.gmail.com> on Tuesday January 29 2008, @10:17PM (#22230564)
    I think that would of been a catchier title...
  • Around here, they're more like whipping boys. Now, if he'd started in on Linux security...

    • Around here, they're more like whipping boys. Now, if he'd started in on Linux security...

      Well yes, kinda difficult to think of any forum where this type of presentation would be considered 'risky material'. But that does not stop it being any less true or needing to be said.

      I do wish that Bruce would choose his targets a bit more carefully though. He has a tendency to come out with sweeping statements that sound good but don't mean quite what he intends them to mean.

  • by r7 (409657) on Tuesday January 29 2008, @10:28PM (#22230628)
    For many of the same reasons there is no semblance of a secure electronic voting platform on the horizon. The reason is not that such a platform would be difficult to design. The reason is that it would not be profitable.

    To be secure it would have to be open. In the case of voting platforms that means every line of code, every encryption algorithm, and all the hardware has to be open, published, and known. Nobody has yet figured out how to make enough money from such a system to outspend Diebold's lobbyists and earn considered from election officials.
    • Re: (Score:3, Interesting)

      For many of the same reasons there is no semblance of a secure electronic voting platform on the horizon.
      Does its support for using paper disqualify punchscan [punchscan.org] from being "electronic"?
      • The requirement that an algorithm be open has a lot less to do with Open Source as in Linux or BSD and lot more to do with the algorithm development process. This is the origin of the Obscurity is not Security mantra.

        Show us a modern closed encryption algorithm which does not have significant vulnerabilities. Off the top of my head I am not aware of one. However, there are plenty of examples of closed algorithms which are abject failures. Like what's used on DVDs, HD-DVDs, or Phillips' RFID tags. There
  • by mlwmohawk (801821) on Tuesday January 29 2008, @10:44PM (#22230754)
    As a nerd and geek and long time hacker, it is perfectly clear to me that I've been missing the "theater" aspect of the technology that I love.

    Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.

    There are two sides to change of any kind. (1) The actual details of change. (2) The psychological affirmation that it is worth the effort. No matter how valid the argument presented by the first, if it does not provide the second, it will fail.

    If we wish to push Linux, we have to create theater around it.
    • Take Linux for instance. I have had varying levels of success getting non-geeks to use it, but what is missing is the warm and fuzzies that make it psychologically comfortable to not be using Windows or a Macintosh.
      The warm and fuzzies is better known as Microsoft Office with Outlook.
    • Take Linux for instance.

      Don't you mean GNU/Linux? There is already a "theater" fo GNU/Linux: Freedom. We are not just fighting for technical superiority, we are fighting for the freedom of the people—just like a secure e-voting machine would, by the way of allowing fair and efficient election to be held.

      Why would you go looking for a "theater", when you have such a ready-made cause (one that's been around for over two decades, no less!) for you? All you have to do is join.

      • Why would you go looking for a "theater", when you have such a ready-made cause

        Yes, I used to have that attitude, but in the past few years, I have sort of changed my mind. When you think that half the people you meet are below average intelligence.

        Time and again, I've seen people too afraid or too unenthusiastic to use or stay with Linux. I've told them the arguments, they all say they agree, they all say they hate Windows, but they go back because they are comfortable with it. That's what "Cheerleaders" a
        • Re: (Score:3, Interesting)

          I guess it might be just me ... but some of those sound like those annoying popups these "security" applications have.

          A colleague of mine has something called "Comodo" on some kind of paranoid mode on his computer, and whenever I use his computer (we share it because in addition to being his office computer, it's also used for some common task), it's annoying. I think I usually see something around 1 popup a minute, like "pidgin.exe is writing to XXX", allow or deny? "blah.com attempted to connect to xxx.xx
        • Linux has its own security theatre ... the idea that "root vs user" DAC is sufficient to stop malware/viruses etc, when in reality it does no such thing (consider the permissions needed to do the things most botnets do). If I had a penny for every time I see a Linux user tell some hapless n00b that Linux is more secure than Windows because you don't have to run as superuser, I'd be a very rich guy.
  • by canterbury rod (1229414) * on Wednesday January 30 2008, @12:40AM (#22231330) Homepage
    In Bruce Schneier's keynote address at Linux.conf.au, he essentially admonishes that "security theater" is not only a necessity, it's a critical component that needs to accompany real security solutions. In the article, he states

    the best security solution will fail if it doesn't cater to both the reality and perceptions to do with security.
    He's affirming that sales in the marketplace will be driven when security theater and real security products are matched. That's when end-users will also experience a real sense of security.
  • It's Still Dumb! (Score:3, Interesting)

    by Jane Q. Public (1010737) on Wednesday January 30 2008, @01:28AM (#22231538)
    These "perception of security" things are still bad, because they create REAL threats to security, in the name of trying to make people feel more secure.

    I will take the reality over a false perception, any day.
  • Ah...NOW I get it! (Score:3, Insightful)

    by hyades1 (1149581) <hyades1@hotmail.com> on Wednesday January 30 2008, @01:51AM (#22231630)

    I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.

    You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security". And a lot of those "nervous old women", by the way, are male, in their 30's, and convinced that everything will be fine if we just forget all that due process nonsense and start trusting the cops to throw the right people in jail.

    • Re: (Score:2, Interesting)

      I guess this would explain why just about everybody in Canada thinks crime is on the increase, even though the numbers conclusively prove otherwise.

      You can't sell security hardware and convince nervous old women to throw away their rights if they know there's a long list of things more important than so-called "security".

      I often think about the political impact of the population ageing in Europe (where I live). There is a lot of political analysis about everything but never around the fact that, well, the population is getting on average older, and that older people tend to have a more conservative take on life, and IMO are easier to be made afraid of "different new stuff" (like having more non-Caucasians and/or Muslims living in their society).

      The other day I read about strong xenophobic language being used by politici

    • I'm sorry but what does RFID have to do with the "perception of security"?

      RFIDs have bugger all to do with security, but plenty of people are trying to push the perception that they can. Read this alarmist article [upi.com]. Check out its opening sentence:

      An associate of Osama bin Laden crawls into a container -- along with some new luxury cars -- in a shipyard in Hamburg, Germany. The goal -- shipping himself to the United States and evading the Department of Homeland Security,

      Lucky all terrorists are RFID-tagged!

      • That's okay, if the cargo container 6+ MeV x-ray inspection doesn't cook him, it should at least catch him.

        Might not do those RFID tags much good, either.
    • Re: (Score:3, Insightful)

      This is an argument I have to make with friends when I claim that Bush-Cheney is the most successful administration in US history. I agree with exactly ZERO of what they have done but as far as scaring the shit out of people, robbing us blind, and in general being dicks you cannot argue that they are unsuccessful.

      It's all about your frame of reference.

      I think of these things as kind of like an electric heater. Most people would argue that an electric heater is one of the most inefficient devices known
      • Put it this way: an electric heater is basically designed to waste power by transducing electrical energy into heat and spewing it into the immediate environment. A heater does this with virtually no losses.

        Have you heard of Heat pumps [wikipedia.org]? These things can put actually more heat into a house than the amount of electrical (anything other than thermal) energy spent.

        This is one of the reasons that one shouldn't use the word "efficiency" with any device that actually turns work into heat. The best thing to an accurately representative "efficiency" would be the ratio of heat output per work, with that of Carnot heat pump at the top and that of electric heater at the bottom.

        On the topic of the thread though, I do agre

      • A heater does this with virtually no losses. Therefore, an electric heater is almost 100% efficient, as long as there's nothing coming out of it that doesn't qualify as waste.

        I'm trying, but I can't imagine what might qualify as "waste" when all energy output is by definition the desired output. What are the things that you're thinking of that lead you to insert "virtually" and "almost" into the above?

      • I'm not sure I understand your point. Are you saying that if we had shoved an electric heating element up all the members of the Bush Administration ass's we get better efficiency from them. Or are you saying if we redefine success to mean something more along the lines of abject failure that we'd be seeing more successes from them? Or perhaps both?
    • In other words, he is an expert on publicizing what most serious researches already know about general security flaws and problems.

      And the problem with this is what? Given how badly people misunderstand computer security we don't have enough people doing this kind of job.