English subtitles

← Reconceptualizing Security | Bruce Schneier | TEDxPSU

Bruce Schneier is an internationally-renowned security technologist and author. Described by The Economist as a "security guru," he is best known as a refreshingly candid and lucid security critic and commentator. When people want to know how security really works, they turn to Schneier.

Get Embed Code
4 Languages

Showing Revision 5 created 01/23/2015 by Ivana Korom.

  1. So security is two different things:
  2. it's a feeling, and it's a reality.
  3. And they're different.
  4. You could feel secure
  5. even if you're not.
  6. And you can be secure
  7. even if you don't feel it.
  8. Really, we have two separate concepts
  9. mapped onto the same word.
  10. And what I want to do in this talk
  11. is to split them apart --
  12. figuring out when they diverge
  13. and how they converge.
  14. And language is actually a problem here.
  15. There aren't a lot of good words
  16. for the concepts
    we're going to talk about.
  17. So if you look at security
  18. from economic terms,
  19. it's a trade-off.
  20. Every time you get some security,
  21. you're always trading off something.
  22. Whether this is a personal decision --
  23. whether you're going to install
    a burglar alarm in your home --
  24. or a national decision -- where you're
    going to invade some foreign country --
  25. you're going to trade off something,
  26. either money or time,
    convenience, capabilities,
  27. maybe fundamental liberties.
  28. And the question to ask
    when you look at a security anything
  29. is not whether this makes us safer,
  30. but whether it's worth the trade-off.
  31. You've heard in the past several years,
  32. the world is safer because
    Saddam Hussein is not in power.
  33. That might be true,
    but it's not terribly relevant.
  34. The question is, was it worth it?
  35. And you can make your own decision,
  36. and then you'll decide
    whether the invasion was worth it.
  37. That's how you think about security --
  38. in terms of the trade-off.
  39. Now there's often no right or wrong here.
  40. Some of us have
    a burglar alarm system at home,
  41. and some of us don't.
  42. And it'll depend on where we live,
  43. whether we live alone or have a family,
  44. how much cool stuff we have,
  45. how much we're willing to accept
  46. the risk of theft.
  47. In politics also,
  48. there are different opinions.
  49. A lot of times, these trade-offs
  50. are about more than just security,
  51. and I think that's really important.
  52. Now people have a natural intuition
  53. about these trade-offs.
  54. We make them every day --
  55. last night in my hotel room,
  56. when I decided to double-lock the door,
  57. or you in your car when you drove here,
  58. when we go eat lunch
  59. and decide the food's not poison
    and we'll eat it.
  60. We make these trade-offs
    again and again,
  61. multiple times a day.
  62. We often don't even notice them.
  63. They're just part of being alive;
    we all do it.
  64. Every species does it.
  65. Imagine a rabbit in a field, eating grass,
  66. and the rabbit's going to see a fox.
  67. That rabbit will make
    a security trade-off:
  68. "Should I stay, or should I flee?"
  69. And if you think about it,
  70. the rabbits that are good
    at making that trade-off
  71. will tend to live and reproduce,
  72. and the rabbits that are bad at it
  73. will get eaten or starve.
  74. So you'd think
  75. that us, as a successful species
    on the planet --
  76. you, me, everybody --
  77. would be really good
    at making these trade-offs.
  78. Yet it seems, again and again,
  79. that we're hopelessly bad at it.
  80. And I think that's a fundamentally
    interesting question.
  81. I'll give you the short answer.
  82. The answer is, we respond
    to the feeling of security
  83. and not the reality.
  84. Now most of the time, that works.
  85. Most of the time,
  86. feeling and reality are the same.
  87. Certainly that's true
  88. for most of human prehistory.
  89. We've developed this ability
  90. because it makes evolutionary sense.
  91. One way to think of it
  92. is that we're highly optimized
  93. for risk decisions
  94. that are endemic to living
    in small family groups
  95. in the East African highlands
    in 100,000 B.C.
  96. 2010 New York, not so much.
  97. Now there are several biases
    in risk perception.
  98. A lot of good experiments in this.
  99. And you can see certain biases
    that come up again and again.
  100. So I'll give you four.
  101. We tend to exaggerate
    spectacular and rare risks
  102. and downplay common risks --
  103. so flying versus driving.
  104. The unknown is perceived
  105. to be riskier than the familiar.
  106. One example would be,
  107. people fear kidnapping by strangers
  108. when the data supports kidnapping
    by relatives is much more common.
  109. This is for children.
  110. Third, personified risks
  111. are perceived to be greater
    than anonymous risks --
  112. so Bin Laden is scarier
    because he has a name.
  113. And the fourth
  114. is people underestimate risks
  115. in situations they do control
  116. and overestimate them
    in situations they don't control.
  117. So once you take up skydiving or smoking,
  118. you downplay the risks.
  119. If a risk is thrust upon you
    -- terrorism was a good example --
  120. you'll overplay it because you don't feel
    like it's in your control.
  121. There are a bunch of other
    of these cognitive biases,
  122. that affect our risk decisions.
  123. There's the availability heuristic,
  124. which basically means
  125. we estimate the probability of something
  126. by how easy it is
    to bring instances of it to mind.
  127. So you can imagine how that works.
  128. If you hear a lot about tiger attacks,
    there must be a lot of tigers around.
  129. You don't hear about lion attacks,
    there aren't a lot of lions around.
  130. This works until you invent newspapers.
  131. Because what newspapers do
  132. is they repeat again and again
  133. rare risks.
  134. I tell people, if it's in the news,
    don't worry about it.
  135. Because by definition,
  136. news is something
    that almost never happens.
  137. (Laughter)
  138. When something is so common,
    it's no longer news --
  139. car crashes, domestic violence --
  140. those are the risks you worry about.
  141. We're also a species of storytellers.
  142. We respond to stories more than data.
  143. And there's some basic
    innumeracy going on.
  144. I mean, the joke
    "One, Two, Three, Many" is kind of right.
  145. We're really good at small numbers.
  146. One mango, two mangoes, three mangoes,
  147. 10,000 mangoes, 100,000 mangoes --
  148. it's still more mangoes
    you can eat before they rot.
  149. So one half, one quarter, one fifth
    -- we're good at that.
  150. One in a million, one in a billion --
  151. they're both almost never.
  152. So we have trouble with the risks
  153. that aren't very common.
  154. And what these cognitive biases do
  155. is they act as filters
    between us and reality.
  156. And the result
  157. is that feeling and reality
    get out of whack,
  158. they get different.
  159. Now you either have a feeling
    -- you feel more secure than you are.
  160. There's a false sense of security.
  161. Or the other way,
  162. and that's a false sense of insecurity.
  163. I write a lot about "security theater,"
  164. which are products
    that make people feel secure,
  165. but don't actually do anything.
  166. There's no real word
    for stuff that makes us secure,
  167. but doesn't make us feel secure.
  168. Maybe it's what the CIA's supposed to do
    for us.
  169. So back to economics.
  170. If economics, if the market,
    drives security,
  171. and if people make trade-offs
  172. based on the feeling of security,
  173. then the smart thing for companies to do
  174. for the economic incentives
  175. are to make people feel secure.
  176. And there are two ways to do this.
  177. One, you can make people actually secure
  178. and hope they notice.
  179. Or two, you can make people
    just feel secure
  180. and hope they don't notice.
  181. So what makes people notice?
  182. Well a couple of things:
  183. understanding of the security,
  184. of the risks, the threats,
  185. the countermeasures, how they work.
  186. But if you know stuff,
  187. you're more likely to have
    your feelings match reality.
  188. Enough real world examples helps.
  189. Now we all know the crime rate
    in our neighborhood,
  190. because we live there,
    and we get a feeling about it
  191. that basically matches reality.
  192. Security theater's exposed
  193. when it's obvious
    that it's not working properly.
  194. Okay, so what makes people not notice?
  195. Well, a poor understanding.
  196. If you don't understand the risks,
    you don't understand the costs,
  197. you're likely to get the trade-off wrong,
  198. and your feeling doesn't match reality.
  199. Not enough examples.
  200. There's an inherent problem
  201. with low probability events.
  202. If, for example,
  203. terrorism almost never happens,
  204. it's really hard to judge
  205. the efficacy of counter-terrorist
    measures.
  206. This is why you keep sacrificing virgins,
  207. and why your unicorn defenses
    are working just great.
  208. There aren't enough examples of failures.
  209. Also, feelings that are clouding
    the issues --
  210. the cognitive biases
    I talked about earlier,
  211. fears, folk beliefs,
  212. basically an inadequate model of reality.
  213. So let me complicate things.
  214. I have feeling and reality.
  215. I want to add a third element.
    I want to add model.
  216. Feeling and model in our head,
  217. reality is the outside world.
  218. It doesn't change; it's real.
  219. So feeling is based on our intuition.
  220. Model is based on reason.
  221. That's basically the difference.
  222. In a primitive and simple world,
  223. there's really no reason for a model
  224. because feeling is close to reality.
  225. You don't need a model.
  226. But in a modern and complex world,
  227. you need models
  228. to understand a lot of the risks we face.
  229. There's no feeling about germs.
  230. You need a model to understand them.
  231. So this model
  232. is an intelligent representation
    of reality.
  233. It's, of course, limited by science,
  234. by technology.
  235. We couldn't have a germ theory of disease
  236. before we invented
    the microscope to see them.
  237. It's limited by our cognitive biases.
  238. But it has the ability
  239. to override our feelings.
  240. Where do we get these models?
    We get them from others.
  241. We get them from religion, from culture,
  242. teachers, elders.
  243. A couple years ago,
  244. I was in South Africa on safari.
  245. The tracker I was with
    grew up in Kruger National Park.
  246. He had some very complex models
    of how to survive.
  247. And it depended on if you were attacked
  248. by a lion or a leopard
    or a rhino or an elephant --
  249. and when you had to run away,
    and when you couldn't run away,
  250. and when you had to climb a tree --
    when you could never climb a tree.
  251. I would have died in a day,
  252. but he was born there,
  253. and he understood how to survive.
  254. I was born in New York City.
  255. I could have taken him to New York,
    and he would have died in a day.
  256. (Laughter)
  257. Because we had different models
  258. based on our different experiences.
  259. Models can come from the media,
  260. from our elected officials.
  261. Think of models of terrorism,
  262. child kidnapping,
  263. airline safety, car safety.
  264. Models can come from industry.
  265. The two I'm following
    are surveillance cameras,
  266. ID cards,
  267. quite a lot of our computer security
    models come from there.
  268. A lot of models come from science.
  269. Health models are a great example.
  270. Think of cancer, of bird flu,
    swine flu, SARS.
  271. All of our feelings of security
  272. about those diseases
  273. come from models
  274. given to us, really, by science filtered
    through the media.
  275. So models can change.
  276. Models are not static.
  277. As we become more comfortable
    in our environments,
  278. our model can move closer to our feelings.
  279. So an example might be,
  280. if you go back 100 years ago
  281. when electricity was first
    becoming common,
  282. there were a lot of fears about it.
  283. I mean, there were people
    who were afraid to push doorbells,
  284. because there was electricity in there,
    and that was dangerous.
  285. For us, we're very facile
    around electricity.
  286. We change light bulbs
  287. without even thinking about it.
  288. Our model of security around electricity
  289. is something we were born into.
  290. It hasn't changed as we were growing up.
  291. And we're good at it.
  292. Or think of the risks
  293. on the Internet across generations --
  294. how your parents approach
    Internet security,
  295. versus how you do,
  296. versus how our kids will.
  297. Models eventually fade
    into the background.
  298. Intuitive is just another word
    for familiar.
  299. So as your model is close to reality,
  300. and it converges with feelings,
  301. you often don't know it's there.
  302. So a nice example of this
  303. came from last year and swine flu.
  304. When swine flu first appeared,
  305. the initial news caused
    a lot of overreaction.
  306. Now it had a name,
  307. which made it scarier
    than the regular flu,
  308. even though it was more deadly.
  309. And people thought doctors
    should be able to deal with it.
  310. So there was that feeling
    of lack of control.
  311. And those two things
  312. made the risk more than it was.
  313. As the novelty wore off,
    the months went by,
  314. there was some amount of tolerance,
  315. people got used to it.
  316. There was no new data,
    but there was less fear.
  317. By autumn,
  318. people thought
  319. the doctors should have solved this
    already.
  320. And there's kind of a bifurcation --
  321. people had to choose
  322. between fear and acceptance --
  323. actually fear and indifference --
  324. they kind of chose suspicion.
  325. And when the vaccine appeared last winter,
  326. there were a lot of people
    -- a surprising number --
  327. who refused to get it --
  328. as a nice example
  329. of how people's feelings of security
    change, how their model changes,
  330. sort of wildly
  331. with no new information,
  332. with no new input.
  333. This kind of thing happens a lot.
  334. I'm going to give one more complication.
  335. We have feeling, model, reality.
  336. I have a very relativistic view
    of security.
  337. I think it depends on the observer.
  338. And most security decisions
  339. have a variety of people involved.
  340. And stakeholders
  341. with specific trade-offs
  342. will try to influence the decision.
  343. And I call that their agenda.
  344. And you see agenda --
  345. this is marketing, this is politics --
  346. trying to convince you to have
    one model versus another,
  347. trying to convince you to ignore a model
  348. and trust your feelings,
  349. marginalizing people
    with models you don't like.
  350. This is not uncommon.
  351. An example, a great example,
    is the risk of smoking.
  352. In the history of the past 50 years,
    the smoking risk
  353. shows how a model changes,
  354. and it also shows
    how an industry fights against
  355. a model it doesn't like.
  356. Compare that
    to the secondhand smoke debate --
  357. probably about 20 years behind.
  358. Think about seat belts.
  359. When I was a kid, no one wore a seat belt.
  360. Nowadays, no kid will let you drive
  361. if you're not wearing a seat belt.
  362. Compare that to the airbag debate --
  363. probably about 30 years behind.
  364. All examples of models changing.
  365. What we learn is that
    changing models is hard.
  366. Models are hard to dislodge.
  367. If they equal your feelings,
  368. you don't even know you have a model.
  369. And there's another cognitive bias
  370. I'll call confirmation bias,
  371. where we tend to accept data
  372. that confirms our beliefs
  373. and reject data
    that contradicts our beliefs.
  374. So evidence against our model,
  375. we're likely to ignore,
    even if it's compelling.
  376. It has to get very compelling
    before we'll pay attention.
  377. New models that extend
    long periods of time are hard.
  378. Global warming is a great example.
  379. We're terrible
  380. at models that span 80 years.
  381. We can do to the next harvest.
  382. We can often do until our kids grow up.
  383. But 80 years, we're just not good at.
  384. So it's a very hard model to accept.
  385. We can have both models
    in our head simultaneously,
  386. right, that kind of problem
  387. where we're holding both beliefs together,
  388. right, the cognitive dissonance.
  389. Eventually,
  390. the new model will replace the old model.
  391. Strong feelings can create a model.
  392. September 11th created a security model
  393. in a lot of people's heads.
  394. Also, personal experiences
    with crime can do it,
  395. personal health scare,
  396. a health scare in the news.
  397. You'll see these called flashbulb events
  398. by psychiatrists.
  399. They can create a model instantaneously,
  400. because they're very emotive.
  401. So in the technological world,
  402. we don't have experience
  403. to judge models.
  404. And we rely on others. We rely on proxies.
  405. I mean, this works
    as long as it's to correct others.
  406. We rely on government agencies
  407. to tell us what pharmaceuticals are safe.
  408. I flew here yesterday.
  409. I didn't check the airplane.
  410. I relied on some other group
  411. to determine whether
    my plane was safe to fly.
  412. We're here, none of us fear
    the roof is going to collapse on us,
  413. not because we checked,
  414. but because we're pretty sure
  415. the building codes here are good.
  416. It's a model we just accept
  417. pretty much by faith.
  418. And that's okay.
  419. Now, what we want
  420. is people to get familiar enough
  421. with better models --
  422. have it reflected in their feelings --
  423. to allow them to make security trade-offs.
  424. Now when these go out of whack,
  425. you have two options.
  426. One, you can fix people's feelings,
  427. directly appeal to feelings.
  428. It's manipulation, but it can work.
  429. The second, more honest way
  430. is to actually fix the model.
  431. Change happens slowly.
  432. The smoking debate took 40 years,
  433. and that was an easy one.
  434. Some of this stuff is hard.
  435. I mean really though,
  436. information seems like our best hope.
  437. And I lied.
  438. Remember I said feeling, model, reality;
  439. I said reality doesn't change.
    It actually does.
  440. We live in a technological world;
  441. reality changes all the time.
  442. So we might have
    -- for the first time in our species --
  443. feeling chases model,
    model chases reality, reality's moving --
  444. they might never catch up.
  445. We don't know.
  446. But in the long-term,
  447. both feeling and reality are important.
  448. And I want to close with two quick stories
    to illustrate this.
  449. 1982 -- I don't know if people
    will remember this --
  450. there was a short epidemic
  451. of Tylenol poisonings
    in the United States.
  452. It's a horrific story.
    Someone took a bottle of Tylenol,
  453. put poison in it, closed it up,
    put it back on the shelf.
  454. Someone else bought it and died.
  455. This terrified people.
  456. There were a couple of copycat attacks.
  457. There wasn't any real risk,
    but people were scared.
  458. And this is how
  459. the tamper-proof drug industry
    was invented.
  460. Those tamper-proof caps,
    that came from this.
  461. It's complete security theater.
  462. As a homework assignment,
    think of 10 ways to get around it.
  463. I'll give you one, a syringe.
  464. But it made people feel better.
  465. It made their feeling of security
  466. more match the reality.
  467. Last story, a few years ago,
    a friend of mine gave birth.
  468. I visit her in the hospital.
  469. It turns out when a baby's born now,
  470. they put an RFID bracelet on the baby,
  471. put a corresponding one on the mother,
  472. so if anyone other than the mother
    takes the baby out of the maternity ward,
  473. an alarm goes off.
  474. I said, "Well, that's kind of neat.
  475. I wonder how rampant baby snatching is
  476. out of hospitals."
  477. I go home, I look it up.
  478. It basically never happens.
  479. But if you think about it,
  480. if you are a hospital,
  481. and you need to take a baby
    away from its mother,
  482. out of the room to run some tests,
  483. you better have some
    good security theater,
  484. or she's going to rip your arm off.
  485. (Laughter)
  486. So it's important for us,
  487. those of us who design security,
  488. who look at security policy,
  489. or even look at public policy
  490. in ways that affect security.
  491. It's not just reality;
    it's feeling and reality.
  492. What's important
  493. is that they be about the same.
  494. It's important that,
    if our feelings match reality,
  495. we make better security trade-offs.
  496. Thank you.
  497. (Applause)