Feeds

Security analogies: the key to educating laymen

Explaining tech concepts to the masses

The Essential Guide to IT Transformation

RMS and Linus use analogies

Besides, it's not as if luminaries in the open source movement, for instance, don't themselves use analogies. Richard M. Stallman often uses a highly effective analogy in explaining free software:

There are four essential freedoms that make the definition of free software...But these freedoms should not be strange to you. At least, not if you cook, because people who cook enjoy the same four freedoms in using recipes...The freedom to cook the recipe when you want...The freedom to study the ingredients and how it's done, and then change it...And then the freedom to copy it and hand copies to your friends...And then...if you cook your version of the recipes for a dinner with your friends, and a friend says 'That was great, can I have the recipe?' you can write down your version of the recipe and make a copy for your friend.

RMS' comparison of the four freedoms of software to those inherent in recipes helps take something people understand - recipes - and applies those concepts to free software, making it simple for almost anyone to grasp the foundations of the free software movement.

Linus Torvalds does the same thing, albeit with a bit more humour. One of his most famous pronouncements is that "Software is like sex; it's better when it's free". That's pretty clear! Even better, and more humourous, is the statement Linus made with tongue firmly planted in cheek when he was introduced at the fourth annual Linux Expo: "My name is Linus, and I am your God". You gotta hand it to the Finns: wry and clever makes a nice combination.

Some good analogies

So analogies can be an effective tool, perhaps an incredibly effective tool. What are some good analogies that we could use to explain concepts of information security to our non-expert friends and family? Flash back to the attempt by Steve Gibson to explain Denial of Service. Pretty bad. When I explain DoS to a class, I start by pointing at a student, and then I go into my shpiel:

Imagine that I decide that I want to make Aubrey's life extremely difficult. I ask all twenty of you to each talk to 20 friends, and spread the following plan: at exactly 10:02 p.m. tomorrow night, everyone call Aubrey's phone number over and over, as fast as you can, for an hour. If she picks up, hang up and dial again. If it's busy, hang up and dial again. Don't stop! Keep the calls going for an hour straight! Now, what's going to be the effect from Aubrey's perspective? Her phone is going to be completely useless. She's going to be so busy responding to her phone ringing that she won't be able to do anything else, and she sure won't be able to make any calls. We'll have completely tied up her phone.

Now imagine if I controlled hundreds or even thousands of computers, and I commanded them all to make requests to another computer at the same time. But unlike humans, which are pretty slow, I could tell these computers to make thousands, tens of thousands, or even hundreds of thousands of requests each second. What would the effect be on that computer trying to field all those requests? About the same effect that all our calls made on Aubrey's phone: it renders it effectively useless. That, in essence, is a Distributed Denial of Service attack. Any questions?

When it comes to explaining why it's not a good idea to have everyone in an organization using Windows, I use an analogy to a biological monoculture. That's not my original idea; Gene Spafford forcefully articulated the idea years ago. But it's a concept people can wrap their minds around. Remind them what the potato blight did to cause the Irish potato famine, and then talk about the effect a new virus or worm could have on a company's network of Windows machines. You can see the lights turning on above their heads.

Finally, if you want to explain what the root user does on a Linux box (and by extension, the Administrator on a Windows machine), read David Baker's well-written and very smart "Root 101: If you don't 'get it,' you probably haven't got it". Baker explains the difference between unprivileged users and root by comparing them to people who live in different kinds of homes. Unprivileged users are like apartment dwellers, while root is like a building superintendent. That's the start of it, and it really is worth reading so you can nick his analogy and use it with your Mom or Dad the next time you're trying to explain why they shouldn't run Windows as Administrator.

SecurityAnalogies.com

Inspired by these analogies and others, I want to announce a new website I've started that's aimed at helping security pros and knowledgeable computer users explain complicated (and even not-so-complicated) concepts to the masses: Security Analogies. Located at http://www.securityanalogies.com, it's a wiki, so any of my readers are free to add, edit, or delete content on the site. With the help of a few friends, I've seeded it with some content already, but it needs more. My readers are smart people, and I'm excited to see what you come up with.

Analogies are powerful tools, and if we work together, we can help build a repository of them that we can all use when we want to explain concepts about computers, networking, and security. To really succeed, however, it will take coordinated teamwork from as many people as possible. My idea may succeed and it may fail, but I think it's worth trying. If people benefit, then it's been worth it. We're not ignorant, so let's not be apathetic. Instead, if you think you can help, join the team and help pitch in.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.