Feeds

Security analogies: the key to educating laymen

Explaining tech concepts to the masses

Using blade systems to cut costs and sharpen efficiencies

Comment The following is a written version of a speech I gave at The Open Solutions Summit (AKA LinuxWorld NY) in New York City in February. It's long, but I think you will find it interesting. If you want to get to the website I announced, jump to the last section.

I'm not a sports guy, by any means. I leave that up to my brother, who's the equipment manager for the New York Jets. Even when we were kids, I'd much rather read than play sports, and watching them was sheer torture; my brother was of course the exact opposite. Anything sports-related was total heaven for him.

Never let it be said, however, that I can't find the truth in a sports anecdote. One of my favorite sports stories concerns Frank Layden, of the Utah Jazz, and his alleged comment about a former player. The story goes that Layden was having problems with this player, so he took him aside and said, "Son, what is it with you? Is it ignorance or apathy?" The player thought a moment and then replied, in all sincerity, "Coach, I don't know and I don't care."

I was thinking about that story a few months ago when I was asked during a Q&A why it is that people don't care about security very much. Oh, they might say they care, and profess actual concern, but the actions of most folks speak otherwise. There are many answers to that question, but two of the biggest culprits come down to the problems Layden raised: ignorance and apathy.

Ignorance

Keep in mind that ignorance doesn't mean stupidity. Instead, ignorance means lack of knowledge. If you don't know fire burns and you put your finger into a flame, that's ignorance; if you know fire burns but you put your finger into the flame anyway, well, that's stupidity (which brings to mind one of the best lines from a great movie, The Princess Bride: "Ha ha! You fool! You fell victim to one of the classic blunders! The most famous is never get involved in a land war in Asia, but only slightly less well-known is this: never go in against a Sicilian when death is on the line! Ha ha ha ha ha ha ha!").

As I've spoken to groups around the country and taught classes at Washington University in St Louis over the years, I've run into ignorance. Students have said things like "I had no idea there was such a thing as open source" and, "I learned that I need to take care of all the security problems on my computer". I don't condemn the people who said those things; they honestly didn't know that open source software existed, and they really didn't know what they needed to do to keep their computers safer. The important thing, however, is that they knew now, that they had been educated.

Indifference - or apathy - is an issue, but I believe Socrates was correct when he said "The only good is knowledge and the only evil is ignorance." In other words, Socrates believed that if a person knew the right thing to do, he more than likely would do it. To bring that maxim into the modern age, if someone knows that she should use anti-virus software, she's far more likely to do so; in fact, she probably will.

I've written many articles for SecurityFocus that try to educate Joe and Jane Computer user: "A Home User's Security Checklist for Windows". "Pass the Chocolate". "Time to Dump Internet Explorer". "Infected In Twenty Minutes". "The big DRM mistake". "Surprises Inside Microsoft Vista's EULA". I can only do so much, however. As I've pointed out many times, those who have knowledge about computers and security - in other words, you, yes, YOU, the person reading this column - need to educate the ignorant, which is everyone else.

"OK, great idea, Scott," I know some of you are saying right now. "But how?"

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.