Schneier Mulls Psychology of Security

bednarz writes "Cryptography expert Bruce Schneier says security decisions often are much less rational than one would prefer. He spoke at the RSA conference about the battle that goes on in the brain when responding to security issues. Schneier explains 'The primitive portion of the brain, called the amygdala, feels fear and incites a fear-or-flight response, he pointed out. "It's very fast, faster than consciousness. But it can be overridden by higher parts of the brain." The neocortex, which in a mammalian brain is associated with consciousness, is slower but "adaptive and flexible,"'"

repeat?

[tomstdenis]

Didn't we have an article about this already? Oh wait, that was about the fact that he was going to speak at the con, now we have an article about the talk he just gave?

Good lord, I want that guys press agent!

Tom

Re:Just look to government....

[FooAtWFU]

Okay. I'll look to government. I'll even be bipartisan... or antibipartisan :)

We have two parties that have issues with threats to the world, after all. The Republicans have Terrorism, and the Democrats have Global Warming. Both are real and significant threats, but neither of them really gets addressed in the healthiest way possible. There's a lot of focus on OMG-deadly high-profile terrorist attacks, and on OMG-deadly consequences of global warming. Both parties have their people propose some ridiculously broad, sweeping changes to deal with the problem which would negatively impact everyday lives; fortunately, the more ridiculous ones are more likely to fail. And, of course, both parties are willing to throw money at people who claim to have some sort of solution to their problem, whether or not it's actually anything real, meaningful, or worthwhile (like the latest stupid XYZ antiterrorist technology rollout, or the latest bio-fuel legislation/subsidy).

No, they're not the same thing, but one can draw worthwhile parallels, and both parties would benefit by comparing themselves to the other, shaping their actions to avoid these excesses.

It must be said...

[Doctor Memory]

primitive portion of the brain, called the amygdala, feels fear and incites a fear-or-flight response

This should actually be fight-or-flight response. Fear is the stimulus, the amygdala merely chooses (or rather, "strongly suggests", as the article points out) the reaction to it.

Irritating.

[Elentari]

It never fails to annoy me when people take snippets of theoretical psychology and redistribute them as truth. Scientists' views of which parts of the brain are responsible for which characteristics of human life change on almost a daily basis, yet phrases such as "language centre" or "mammalian brain" are constantly being used in a way that presents them as definite fact.

It seems unnecessary to incorporate impressive-sounding terms into a speech that, quite honestly, seems to be stating the obvious. Increasing or decreasing security is a response to fear; fear is an emotion and, therefore, decisions that use it as a base will not be purely rational, but will have emotional bias, like every other human decision. You don't need vague descriptions of brain "impulses", and such, to prove that.

Re:Most people cannot define "security".

[Short Circuit]

As he says, we really should have two different words for the "feeling of security" and "security".

I thought we called that "comfort". As in, "I'm comfortable running Linux." or "I'm uncomfortable running Windows without antivirus software."

A point easily proven

[TinBromide]

People care more about problems that they can't control than ones they can prevent.

For example: Airplanes. How many people feel more secure behind the wheel of a car than on a long flight with turbulence?

Put your hands down, now the sheer probability of getting into a car accident in one's lifetime (if one drives) is a miniscule number below one. Death statistics are somewhere around 1 in 237 of a car type accident. The odds of an airplane death are like 1 in 5051 source [nsc.org]

However, people are freakishly nervous about planes... So, by induction (the bane of an engineer's existance) we can extrapolate (another fancy bane) that security people will ignore the dangerous mundane and fixate on the extraordinary rarity.

Difficulty Factor

[Bryansix]

I think that the true dichotomy of the situation that plays out in people's minds is 1) Spend the time and effort to secure this system the right way and stress out all the time 2) Be lazy and just do what will get us by and at least buy us some security even if it's security through obscurity.

Re:Security - 100%

[John Frink]

Like the rest of us learned in sex-ed, abstinence is the only way to have 100% security.

Re:Just look to government....

[mattkime]

>>Both parties have their people propose some ridiculously broad, sweeping changes to deal with the problem which would negatively impact everyday lives; fortunately, the more ridiculous ones are more likely to fail.

You can't get anywhere in politics if you allow the more radical elements to represent their party. Ignore them.

In the interest of bipartisanship you've equated the wholesale removal of civil rights with the suggestion that we shouldn't use so much oil.

Thats what I call Fair and Balanced.

Deaths per Mile

[bill_mcgonigle]

That doesn't say anything to me. The fact is that if you get into a car crash, there are chances that you may survive. In an airplane, thats it! End of Story! No second chances! Maybe that is the cause of the fear, don't you think? And a legitimate one at that. Given a choice would you rather be in a car crash or a plane crash, the consequnces of both aren't disclosed to you yet?

The important measure isn't odds of death in a crash, it's odds of death per mile traveled.

If you drive from Boston to San Diego you're more likely to die than if you fly from Boston to San Diego. But coming back around to your point this measure even masks non-fatal injuries. Since most car wrecks don't result in death, it therefore figures that driving from Boston to San Diego you're much more likely to be injured or maimed than if you fly, by a factor of (car crashes / fatal car crashes).

Re:It makes sense

[David Gould]

Some days his blog is nothing other than Bush bashing under the guise of writing about security.

It's true that some of Schneier's posts are very critical of the Bush Administration's security efforts. But, of all the statements that get attacked as "Bush-bashing", I'd say those posts are among the best cases for which to invoke the defense that:

"No, it's just that reality has an anti-Bush 'bias'."

Re:Just look to government....

[FooAtWFU]

Terrorism could cause a tiny handful of people to die. Warming could cause a mass extinction. Do you understand what I mean by mass extinction?

I appreciate that. But consider, from the text of the article itself:

... people "exaggerate risks that are spectacular, rare, beyond their control, talked about, international, man-made, immediate, directed against children or morally offensive," Schneier noted.

Okay. Mass extinction. Rare? Ehh, depends-how-you-define-it. Children? Eh, not so much ("our children will have to deal with it", but...) Man-made? Check. (Especially for The Environmentalists). International? Check. Morally offensive? Sometimes-check (greed/profit/industry/decadence topics). Talked about? Definitely-check. Spectacular? Oooh boy, helluva check.

Even the Libertarians are accepting global warming as pretty-much-fact these days. That's one thing. But to immediately bring up mass extinction as a topic of doom (presumably, imminent doom) is, I think, perhaps, maybe just a little bit of a display of the sort of irrationality the article discusses. Just a smidge.

Overridden by higher parts of the brain

[brownaroo]

As a programmer I find (in regards to security) that fear is often overridden by laziness