The security mirage - Bruce Schneier

[Music] [Applause] so security is two different things right it's a feeling and it's a reality and they're different you could feel secure even if you're not and you can be secure even if you don't feel it I me really we have two separate Concepts mapped onto the same word and what I want to do in this talk is to split them apart figuring out when they diverge and how they converge and language is actually a problem here there aren't a lot of good words for the concepts uh we're going to talk about so if you look at security from economic terms it's a trade off every time you get some security you're always trading off something and whether this is a personal decision whether you're going to install a Burg alarm in your home or a national decision whe you're going to invade some foreign country you're going to trade off something uh either money or time convenience capabilities maybe fundamental Liberties and the question to ask when you look at it a security anything is not whether this makes us safer but whether it's worth the tradeoff you've heard uh in the past several years the world is safer because Saddam Hussein is not in power that might be true but it's not terribly relevant the question is was it worth it and you know you can make your own decision and then you'll decide whether the invasion was worth it that's how you think about Security in terms of the tradeoff now there's often no right or wrong here some of us have a burglar Arm System at home and some of us don't and it'll depend on where we live whether we live alone or have a family you know how much cool stuff we have how much we're willing to accept the risk of of theft right in in politics also there are different opinions a lot of times these tradeoffs are about more than just security and I think it's really important now people have a natural intuition about these tradeoffs we make them every day at last night in my hotel room when I decid to double lock the door or you in your car when you drove here you know when we go eat lunch and decide the food's not poison and we'll eat it right we make these trade-offs again and again multiple times a day we often don't even notice them they're just part of being alive we all do it every species does it right imagine a rabbit in a field eating grass and the rabbit's going to see a fox that rabbit will make a security trade-off should I stay or should I flee and if you think about it the rabbits that are good at making that trade-off will tend to live and reproduce and the rabbits that are bad at it will get eaten or starve so you'd think that us as a successful species on the planet right you me everybody would be really good at making these tradeoffs yet it seems again and again that we're hopelessly bad at it right and I think that's a fundamentally interesting question I I'll give you the short answer the answer is we respond to the feeling of security and not the reality now most of the time that works right most of the time feeling and reality are the same certainly that's true for most of human prehistory right we've developed this ability because it makes evolutionary sense I mean one way to think of it is that we're highly optimized for uh risk decisions that are endemic to living in small family groups in the east African Highlands in 100,000 BC 2010 New York you know not so much now there are several biases and risk per a lot of good experiments in this and you can see certain biases that come up again and again I I give you four uh we tend to exaggerate spectacular and rare risks and downplay common risks so flying versus driving uh the unknown is proceed to be riskier than the familiar uh one example would be uh people fear kidnapping by strangers when the data supports uh kidnapping by relatives is much more common this is for children uh third personified risks are proceed to be greater than Anonymous risks so Bin Laden is scarier because he has a name and the fourth is people underestimate secur uh risks in situations they do control and overestimate them in situations they don't control so once you take up skydiving or smoking you you downplay the risks if a risk is thrust upon you terrorism is a good example you'll overplay it because you don't feel like gets in your control uh there are a bunch of other of these biases these cognitive biases that affect our risk decisions uh there's the availability her istic which basically means we estimate the probability of something by how easy it is to bring instances of it to mind so you could imagine how that works if you hear a lot about tiger attacks must be a lot of tigers around you don't hear about lion attacks there aren't a lot of lions around this works until you invent newspapers because what newspapers do is they repeat again and again rare risks and I tell people if it's in the news don't worry about it because by definition news is something that almost never happens right when something is so common it's no longer news where car crashes domestic violence those are the risks you worry about uh we're also a species of storytellers we respond to stories more than data and there's some basic enumer y going on I mean the joke 1 two 3 many is kind of right we're really good at small numbers one mango two mangoes three mangoes 10,000 mangoes 100,000 mangoes it's still more mangoes you can eat before they rot so one half one quarter one fifth we're good at that one in a million one in a billion they're both almost never so we have trouble with the risks that aren't very common and what these cognitive biases do is they act as filters between in reality right and the result is that feeling and reality get out of whack they get different and now we either have you know feeling you feel more secure than you are there's a false sense of security or the other way and there's you know a false sense of insecurity I write a lot about security Theater which are products that make people feel secure but don't actually do anything there's no real word for stuff that makes us secure but doesn't make us feel secure maybe it's what the CIA is supposed to do for us so back to economics if economics if the market drives security and if people make tradeoffs based on the feeling of security then the smart thing for companies to do for the economic incentives are to make people feel secure right and there are two ways to do this one you can make people actually secure and hope they notice or two you can make people just feel secure and hope they don't notice right so what makes people notice well a couple of things understanding right of the security of the risks the threats the countermeasures how they work me if you know stuff you're more likely to have your feelings match reality uh enough real world examples helps now we all know the crime rate in our neighborhood cuz we live there there and we get a feeling about it that basically matches reality right security theat exposed when it's obvious that it's not working properly okay so what makes people not notice well a poor understanding right if you don't understand the risks you don't understand the costs you're likely to get the trade-off wrong and your feeling doesn't match reality right not enough examples there's an inherent problem with low probability events if for example terrorism almost never happens it's really hard to judge the efficacy of counterterrorist measures right I mean this is why you you know you keep sacrificing virgins and why your unicorn defenses are working just great there aren't enough examples of failures also feelings that are clouding the issues right the cognitive biases I talked about earlier fears folk beliefs right basically an inadequate model of reality so let me complicate things right I have feeling and reality I want to add a third element I want to add model right feeling and model in our head reality is the outside world it doesn't change it's real right so feeling is based on our intuition model is based on reason that's basically the difference uh in A Primitive and simple world there's really no reason for a model right because it's feeling is close to reality you don't need a model but in a modern and complex world you need models to understand a lot of the risks we face you know there's no feeling about germs you need a model to understand them so this model is an intelligent representation of reality it's of course limited by science by technology right we couldn't have a germ theory of disease before we invented the microscope to see them uh it's limited by our cognitive biases but it has the ability to override our feelings where do we get these models we get them from others we get them from uh religion from culture teachers Elders couple of years ago I was in uh South Africa on Safari the tracker I was with grew up in Krueger National Park he had some very complex models on how to survive and it depended if you attacked by a lion or a leopard or a rhino and an elephant and when you had to run away and when you couldn't run away and when you had to climb a tree when you could never climb a tree I would have you know died in in a day right but he was born there and he understood how to survive right I was born in New York City I would could taken him to New York and he would have died in a day right because we had different models based on our our different experiences uh models can come from the media from our elected officials right think of uh of models of terrorism uh child kidnapping uh Airline safety car safety uh models can come from industry and two I'm following our surveillance cameras uh ID cards quite a lot of our computer security models come from there a lot of models come from science you health models are a great example think of cancer of bird flu swine flu SARS I mean all of our feelings of security about those diseases come from Models given to us really by science filed through the media right so models can change right models are not static as we become more comfortable in our environments our model can move closer to our feelings so uh an example might be if you go back a 100 years ago when electricity was first becoming common there were a lot of fears about it I mean there were people who were afraid to push doorbells because there was electricity in there and that was dangerous right for us we're very fossil around electricity we change light bulbs without even thinking about it right our model of of security around electricity is something we were we were born into you know it hasn't changed as we were growing up and and we're good at it right or think of the uh risks uh on the internet across Generations how your parents approach Internet Security versus how you do versus how our our kids will you know models eventually Fade Into the background you know intuitive just another word for familiar right so as your model is close to reality and it converges with feelings you often don't even know it's there so a nice example of this came from last year and and and swine flu when swine flu first first appeared the initial news caused a lot of overreaction now it was it had a name which made it scarier than the regular flu even though it was more deadly and people thought doctors should be able to deal with it so was there was that feeling of lack of control and those two things made the risk more than it was uh as as the novelty wore off the months went by there was some amount of Tolerance people got used to it right there was no new data but there was less fear uh by Autumn people thought the doctor should have solved this already and there's kind of a bifurcation people had to choose between sort of fear and and and acceptance actually fear and indifference that kind of choose suspicion and when the vaccine appeared last winter there were a lot of people a surprising number who refused to get it and is a nice example of how people's feelings of security change how their model changes sort of wildly with no new information with no new input this kind of thing happens a lot going to give one more complication and we have feeling model reality I have a very relativistic view of security I think it depends on the Observer and most security decisions have a variety of people involved and and stakeholders with specific tradeoffs will try to influence the decision and I call that their agenda and you see agenda this is marketing this is politics uh trying to convince you to have one model versus another trying to convince you to ignore a model and and and you trust your feelings marginalizing people with models you don't like right this this is not uncommon uh example great example is the risk of smoking and the history of the past 50 years the smoking risk shows how a model changes and also shows how an industry fights against a model it doesn't like right compare that to the secondhand smoke debate you know probably about 20 years behind uh think about seat belts when I was a kid no one wore a seat belt nowadays no kid will let you drive if you're not wearing a seat belt I compare that to the airbag debate probably about 30 years behind I mean all examples of models changing what we learn is that changing models is hard right models are hard to dislodge if they equal your feelings you don't even know you have a model and there's another cognitive bias uh called confirmation bias where we tend to accept data that uh confirms our beliefs and reject data that contradicts our beliefs I mean so evidence against our model we're likely to ignore even if it's compelling has to get very compelling before we'll pay attention uh new models that extend long periods of time are hard global warming is a great example we're terrible at at models that span 80 years know we can do to the next Harvest we can often do till our kids grow up but 80 years we're just not good at so it's a very hard model to accept you know we can have both models in our head simultaneously or that kind of uh you know that kind of problem where we have holding both beliefs together by the cognitive dissonance eventually the new model will replace the old model strong feels can create a model right uh September 11th created a social security model in a lot of people's heads also personal experiences with crime can do it personal health scare Health scare in the news you'll see these called flashbulb events by by psychiatrists right they can create a model instantaneously because they're very emotive so in the technological world we don't have experience to judge models and and we rely on others we rely on proxies I mean this works as long as it's to correct others right we rely on government agencies to tell us what Pharmaceuticals are are safe uh I flew here yesterday I didn't check the air airplane you know I relied on some other group to determine whether my plane was safe to fly we're here and none of us Fear The Roof is going to collapse on us not because we checked but because we're pretty sure the building coats here are good I mean we we it's a model we just accept pretty much by faith and that's okay now what we want is people to get familiar enough with better models right have it reflected in their feelings to allow them to make security tradeoffs now when you these go out of whack you sort of have you have two options one you can fix people's feelings right directly appeal to feelings it's manipulation but it can work the second more honest way is to actually fix the model right change happens slowly the smoking debate took 40 years and that was an easy one right some of this stuff is hard I mean really though information seems like our best hope and and I lied remember I said feeling re feeling model reality said reality doesn't change it actually does we live in a technological World reality changes all the time so we might have for the first time in our species feeling chases model model chases reality reality is moving they might never catch up right we don't know right but in the long term both feeling and reality are important and I want to close with two quick stories to illustrate this uh 1982 I know people remember this there was a uh a short epidemic of Tylenol poisonings in the United States it's a horrific story someone took a bottle of Tylenol put poison in it closed it up put it back on the Shelf someone else bought it and died this terrified people there were a couple of CopyCat attacks there wasn't any real risk but people were scared and this is how the tamperproof drug industry was invented those T proof caps that came from this it's complete Security theater you know as a homework assignment think of 10 ways to get around it give you one a syringe right but it made people feel better it made their feeling of security more match the reality Last Story a few years ago a friend of mine gave birth visitor in the hospital turns out uh when a baby's born now they put an RFID bracelet on the baby put a corresponding one on the mother so if anyone other than the mother takes the baby out of the Maternity Ward alarm goes off I said well that's kind of neat I wonder how rampant baby snatching is out of hospitals I go home I look it up it basically never happens but if you think about it if you are a hospital and you need to take a baby away from its mother out of the room to run some tests you better have some good security theater or she's going to rip your arm off so it's important for us those of us who design security who look at security policy or even look at public policy in a ways that affect security right it's not just reality it's feeling in reality what's important is that they be about the same it's important that our if our feelings match reality we make better security tradeoffs thank you