Sunday Security Maxim
Voltaire’s Maxim: The problem with common sense is that it is not all that common. Comment: Real world security blunders are often stunningly dumb. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
Sunday Security Maxim
Big Heads Maxim: The farther up the chain of command a (non-security) manager can be found, the more likely he or she thinks that (1) they understand security and (2) security is easy. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
Father Knows Best Maxim: The amount that (non-security) senior managers in any organization know about security is inversely proportional to (1) how easy they think security is, and (2) how much they will micro-manage security and invent arbitrary rules. Compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Schneier’s Maxim #2 (Control Freaks Maxim): Control will usually get confused with Security. Comment: From security guru Bruce Schneier. Even when Control doesn’t get confused with Security, lots of people and organizations will use Security as an excuse to grab Control, e.g., the Patriot Act. - as compiled by [Roger G. Johnston, Ph.D., CPP], Argonne National Laboratory
Saturday Security Maxim
Too Good Maxim: If a given security product, technology, vendor, or techniques sounds too good to be true, it is. And it probably sucks big time. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Bruce Schneier - Image by Geoffrey Stone
Sunday Security Maxim
Schneier’s Maxim #1: (Don’t Wet Your Pants Maxim): The more excited people are about a given security technology, the less they understand (1) that technology and (2) their own security problems. Comment: From Bruce Schneier. . - as compiled by [Roger G. Johnston, Ph.D., CPP], Argonne National Laboratory
Saturday Security Maxim
Low-Tech Maxim: Low-tech attacks work (even against high-tech devices and systems). Comment: So don’t get too worked up about high-tech attacks.. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Dr. Who Maxim: “The more sophisticated the technology, the more vulnerable it is to primitive attack. People often overlook the obvious.” Comment: Tom Baker as Dr. Who in The Pirate Planet (1978). - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
High-Tech Maxim: The amount of careful thinking that has gone into a given security device, system, or program is inversely proportional to the amount of high-technology it uses. Comment: In security, high-technology is often taken as a license to stop thinking critically. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Safety Maxim: Applying the methods of safety to security doesn’t work well, but the reverse may have some merit. Comment: Safety is typically analyzed as a stochastic problem, whereas the bad guys typically attack deliberately and intelligently, not randomly. For a discussion of the reverse problem, see RG Johnston, Journal of Safety Research 35, 245-248 (2004). - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
Weakest Link Maxim: The efficacy of security is determined more by what is done wrong than by what is done right. Comment: Because the bad guys typically attack deliberately and intelligently, not randomly.- as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Ignorance is Bliss Maxim: The confidence that people have in security is inversely proportional to how much they know about it. Comment: Security looks easy if you’ve never taken the time to think carefully about it. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
So We’re In Agreement Maxim: If you’re happy with your security, so are the bad guys. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Be Afraid, Be Very Afraid Maxim: If you’re not running scared, you have bad security or a bad security product. Comment: Fear is a good vaccine against both arrogance and ignorance. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
Arrogance Maxim: The ease of defeating a security device or system is proportional to how confident/arrogant the designer, manufacturer, or user is about it, and to how often they use words like “impossible” or “tamper-proof”. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Sunday Security Maxim
Thanks for Nothin’ Maxim: A vulnerability assessment that finds no vulnerabilities or only a few is worthless and wrong. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory
Saturday Security Maxim
Infinity Maxim: There are an unlimited number of security vulnerabilities for a given security device, system, or program, most of which will never be discovered (by the good guys or bad guys).
Comment: This is probably true because we always find new vulnerabilities when we look at the same security device, system, or program a second or third time, and because we always find vulnerabilities that others miss, and vice versa. - as compiled by Roger G. Johnston, Ph.D., CPP, Argonne National Laboratory