Security analogies: the key to educating laymen
Explaining tech concepts to the masses
Comment The following is a written version of a speech I gave at The Open Solutions Summit (AKA LinuxWorld NY) in New York City in February. It's long, but I think you will find it interesting. If you want to get to the website I announced, jump to the last section.
I'm not a sports guy, by any means. I leave that up to my brother, who's the equipment manager for the New York Jets. Even when we were kids, I'd much rather read than play sports, and watching them was sheer torture; my brother was of course the exact opposite. Anything sports-related was total heaven for him.
Never let it be said, however, that I can't find the truth in a sports anecdote. One of my favorite sports stories concerns Frank Layden, of the Utah Jazz, and his alleged comment about a former player. The story goes that Layden was having problems with this player, so he took him aside and said, "Son, what is it with you? Is it ignorance or apathy?" The player thought a moment and then replied, in all sincerity, "Coach, I don't know and I don't care."
I was thinking about that story a few months ago when I was asked during a Q&A why it is that people don't care about security very much. Oh, they might say they care, and profess actual concern, but the actions of most folks speak otherwise. There are many answers to that question, but two of the biggest culprits come down to the problems Layden raised: ignorance and apathy.
Keep in mind that ignorance doesn't mean stupidity. Instead, ignorance means lack of knowledge. If you don't know fire burns and you put your finger into a flame, that's ignorance; if you know fire burns but you put your finger into the flame anyway, well, that's stupidity (which brings to mind one of the best lines from a great movie, The Princess Bride: "Ha ha! You fool! You fell victim to one of the classic blunders! The most famous is never get involved in a land war in Asia, but only slightly less well-known is this: never go in against a Sicilian when death is on the line! Ha ha ha ha ha ha ha!").
As I've spoken to groups around the country and taught classes at Washington University in St Louis over the years, I've run into ignorance. Students have said things like "I had no idea there was such a thing as open source" and, "I learned that I need to take care of all the security problems on my computer". I don't condemn the people who said those things; they honestly didn't know that open source software existed, and they really didn't know what they needed to do to keep their computers safer. The important thing, however, is that they knew now, that they had been educated.
Indifference - or apathy - is an issue, but I believe Socrates was correct when he said "The only good is knowledge and the only evil is ignorance." In other words, Socrates believed that if a person knew the right thing to do, he more than likely would do it. To bring that maxim into the modern age, if someone knows that she should use anti-virus software, she's far more likely to do so; in fact, she probably will.
I've written many articles for SecurityFocus that try to educate Joe and Jane Computer user: "A Home User's Security Checklist for Windows". "Pass the Chocolate". "Time to Dump Internet Explorer". "Infected In Twenty Minutes". "The big DRM mistake". "Surprises Inside Microsoft Vista's EULA". I can only do so much, however. As I've pointed out many times, those who have knowledge about computers and security - in other words, you, yes, YOU, the person reading this column - need to educate the ignorant, which is everyone else.
"OK, great idea, Scott," I know some of you are saying right now. "But how?"
The wrong way to explain concepts
The answer boils down to language. We have to learn to speak to normal people about computers and security in a manner they can understand and that will inspire them to act in a responsible manner. This really hit home for me when I was reviewing a podcast to see if it would be suitable for my students. The podcast was number eight in the Security Now! series by Leo Laporte and Steve Gibson, and its subject was Denial of Service attacks. A few minutes in, this dialogue takes place:
Leo: Let's first explain what a simple denial of service attack is.
Steve: Well, the idea is, any kind of packet traffic which can cause problems for the receiving end can create what's called a "denial of service," you know, the term meaning, of course, that whatever service you are trying to get is being denied you by someone, for whatever reason, who wants that to happen. So, for example, in the old days, websites used to have their web servers brought down by people doing something called a "SYN flood," S-Y-N. A SYN packet is the first packet of a TCP connection. When a user's browser, for example, wants to connect to a web server, it'll send a SYN packet. The web server allocates some resources to get ready for this connection, sends back what's called a SYN/ACK packet, and then a final ACK packet is returned to the server. What that does is that verifies the communication path between these two endpoints, the user's browser and the server, and sort of establishes the communication.
As I listened to this, I thought, "There is no frickin' way my non-technical students are gonna understand a word he's saying! SYN? ACK? Packet? TCP? Forget it!" I abandoned the podcast and thought about how I always explained DoS to my students successfully in the past. And then it hit me: I used an analogy. The more I thought about how I successfully communicated ideas to my students, the more I tabulated the analogies that I used. I realised that analogies are key in educating your average computer user about security, just as they are the most effective way to explain to any of us a concept that comes from outside our field of study, or realm of expertise.
The centrality of analogy
Analogies are basic to how humans use language. Many of us got used to them from standardised tests in school, in which an analogy was presented with one key factor left out, which we then had to choose from five choices. For instance, this might be understood by the American football-loving computer guys out there:
Rex Grossman : Football :: Windows : ???
Analogies aren't just limited to tests taken with a number two lead pencil, however. Lots of branches of human understanding utilise analogies, from philosophy to physics, engineering to law, and literature to political science. Thomas Hobbes' famous Leviathan, a monumental work of political analysis from 1651, contained this illustration as its frontispiece:
The image illustrates graphically Hobbes' point about the makeup of a well-governed society, in which it is composed of the mass of people together, each performing their function willingly and harmoniously. Hobbes himself perfectly annotates the drawing above in the following passage from the Introduction to the Leviathan:
For by art is created that great LEVIATHAN called a COMMONWEALTH, or STATE (in Latin, CIVITAS), which is but an artificial man, though of greater stature and strength than the natural, for whose protection and defence it was intended; and in which the sovereignty is an artificial soul, as giving life and motion to the whole body; the magistrates and other officers of judicature and execution, artificial joints; reward and punishment (by which fastened to the seat of the sovereignty, every joint and member is moved to perform his duty) are the nerves, that do the same in the body natural; the wealth and riches of all the particular members are the strength; salus populi (the people's safety) its business; counsellors, by whom all things needful for it to know are suggested unto it, are the memory; equity and laws, an artificial reason and will; concord, health; sedition, sickness; and civil war, death.
You may not agree with Hobbes (few today would, in fact), but you have to admit that the drawing of the Leviathan, coupled with Hobbes' words, make his idea crystal clear and easy to fathom. But it's not just in the areas of human study that analogies are used. The human mind seems almost hard-wired for analogies, using them to create and augment perception, problem solving, decision making, explanation, communication, and memory.
This last is especially interesting and resonant in the hands of the brilliant Argentine novelist Jorge Luis Borges (who I last wrote about in "A List of Security Essentials: From Mermaids to Suckling Pigs") and his amazing short story "Funes the Memorious" (which you can read online - go do it!).
In the story, a young man suffers an injury that prevents him from forgetting anything. This might sound cool to computer people, but it actually proves to be a kind of curse to Funes. Since he cannot forget anything, he cannot generalise, and generalisation is what allows us to function in the world. As my Psych professor, Dr.Green, explained it to our class, if every dog you saw was perceived as an entirely unique creature, how would you be able to generalise to even form the concept of "dog" in the first place? Borges explains this same concept in "Funes the Memorious", writing
He was...almost incapable of general, platonic ideas. It was not only difficult for him to understand that the generic term dog embraced so many unlike specimens of differing sizes and different forms; he was disturbed by the fact that a dog at three-fourteen (seen in profile) should have the same name as the dog at three-fifteen (seen from the front). His own face in the mirror, his own hands, surprised him on every occasion. Without effort, he had learned English, French, Portuguese, Latin. I suspect, nevertheless, that he was not very capable of thought. To think is to forget a difference, to generalise, to abstract.
Objections to analogies
Of course, not all analogies work, and many are annoying. If I ever hear "Life is like a box of chocolates... blah blah blah" again, I'll hunt down Tom Hanks and throttle him. And I know that many of you are already protesting that no analogy is perfect, which thereby invalidates the entire idea of analogies in the first place. Chandler Howell put this best when he said "Security is like an analogy. It only works up until the point that someone considers an angle or aspect that you haven't previously considered and accounted for."
Howell is correct. But a good analogy can still serve its purpose, and it can still enlighten people who hear it. Of course no analogy is perfect - but most listeners will grasp the essential similarities regardless. It's the experts, who know the subject of the analogy inside and out, who will see, and focus upon, the imperfections. But analogies aren't for experts; they're for normal folks who are trying to learn from the experts.
Experts also commonly bring up another objection to analogies: that users should learn the authentic concepts first, and analogies merely get in the way. The problem with that assertion, however, is that the vast majority of users simply won't learn the authentic concepts. It's just too difficult in many cases to throw users into the pool and expect them to sink or swim. Remember the purpose of an analogy: take something familiar and relate it to something unfamiliar, and thereby give insight into that unfamiliar idea. When it comes to networking, computers, and security, we're talking about things that are all too often abstractions, and abstractions are easier to understand with analogies.
RMS and Linus use analogies
There are four essential freedoms that make the definition of free software...But these freedoms should not be strange to you. At least, not if you cook, because people who cook enjoy the same four freedoms in using recipes...The freedom to cook the recipe when you want...The freedom to study the ingredients and how it's done, and then change it...And then the freedom to copy it and hand copies to your friends...And then...if you cook your version of the recipes for a dinner with your friends, and a friend says 'That was great, can I have the recipe?' you can write down your version of the recipe and make a copy for your friend.
RMS' comparison of the four freedoms of software to those inherent in recipes helps take something people understand - recipes - and applies those concepts to free software, making it simple for almost anyone to grasp the foundations of the free software movement.
Linus Torvalds does the same thing, albeit with a bit more humour. One of his most famous pronouncements is that "Software is like sex; it's better when it's free". That's pretty clear! Even better, and more humourous, is the statement Linus made with tongue firmly planted in cheek when he was introduced at the fourth annual Linux Expo: "My name is Linus, and I am your God". You gotta hand it to the Finns: wry and clever makes a nice combination.
Some good analogies
So analogies can be an effective tool, perhaps an incredibly effective tool. What are some good analogies that we could use to explain concepts of information security to our non-expert friends and family? Flash back to the attempt by Steve Gibson to explain Denial of Service. Pretty bad. When I explain DoS to a class, I start by pointing at a student, and then I go into my shpiel:
Imagine that I decide that I want to make Aubrey's life extremely difficult. I ask all twenty of you to each talk to 20 friends, and spread the following plan: at exactly 10:02 p.m. tomorrow night, everyone call Aubrey's phone number over and over, as fast as you can, for an hour. If she picks up, hang up and dial again. If it's busy, hang up and dial again. Don't stop! Keep the calls going for an hour straight! Now, what's going to be the effect from Aubrey's perspective? Her phone is going to be completely useless. She's going to be so busy responding to her phone ringing that she won't be able to do anything else, and she sure won't be able to make any calls. We'll have completely tied up her phone.
Now imagine if I controlled hundreds or even thousands of computers, and I commanded them all to make requests to another computer at the same time. But unlike humans, which are pretty slow, I could tell these computers to make thousands, tens of thousands, or even hundreds of thousands of requests each second. What would the effect be on that computer trying to field all those requests? About the same effect that all our calls made on Aubrey's phone: it renders it effectively useless. That, in essence, is a Distributed Denial of Service attack. Any questions?
When it comes to explaining why it's not a good idea to have everyone in an organization using Windows, I use an analogy to a biological monoculture. That's not my original idea; Gene Spafford forcefully articulated the idea years ago. But it's a concept people can wrap their minds around. Remind them what the potato blight did to cause the Irish potato famine, and then talk about the effect a new virus or worm could have on a company's network of Windows machines. You can see the lights turning on above their heads.
Finally, if you want to explain what the root user does on a Linux box (and by extension, the Administrator on a Windows machine), read David Baker's well-written and very smart "Root 101: If you don't 'get it,' you probably haven't got it". Baker explains the difference between unprivileged users and root by comparing them to people who live in different kinds of homes. Unprivileged users are like apartment dwellers, while root is like a building superintendent. That's the start of it, and it really is worth reading so you can nick his analogy and use it with your Mom or Dad the next time you're trying to explain why they shouldn't run Windows as Administrator.
Inspired by these analogies and others, I want to announce a new website I've started that's aimed at helping security pros and knowledgeable computer users explain complicated (and even not-so-complicated) concepts to the masses: Security Analogies. Located at http://www.securityanalogies.com, it's a wiki, so any of my readers are free to add, edit, or delete content on the site. With the help of a few friends, I've seeded it with some content already, but it needs more. My readers are smart people, and I'm excited to see what you come up with.
Analogies are powerful tools, and if we work together, we can help build a repository of them that we can all use when we want to explain concepts about computers, networking, and security. To really succeed, however, it will take coordinated teamwork from as many people as possible. My idea may succeed and it may fail, but I think it's worth trying. If people benefit, then it's been worth it. We're not ignorant, so let's not be apathetic. Instead, if you think you can help, join the team and help pitch in.
This article originally appeared in Security Focus.
Copyright © 2007, SecurityFocus