Security threats Toolkit

Schneier: Perceptions of security are flawed

Munir Kotadia, Chris Duckett and Liam Tung ZDNet Australia

Published: 18 Feb 2008 10:46 GMT

While the media bombards consumers with frightening stories, discussions about security are thwarted by the failure of language to separate the "feeling" and "reality" of security, according to Bruce Schneier.

Schneier, author of Applied Cryptography and, most recently, Beyond Fear, said there is a fundamental problem with the way we think about security, and its roots can be traced back to a failure of language.

"'Security' is a complicated word," Schneier told ZDNet Australia at the linux.conf.au conference.

"You can feel secure and there's the reality of security — how secure you are. And they're different things. You can feel secure, even though you're not, and you can be secure, even though you don't realise it," Schneier said.

The problem in today's media-intensive world is that consumers are repeatedly bombarded with coverage of out-of-the-ordinary or newsworthy events, such as kidnappings and terrorism. This ultimately distorts people's view of the world, according to Schneier.

"When something rare happens, it's talked about endlessly. It's repeated again and again, so our brains are fooled into thinking it's common because it's what psychologists call "available" — the memories are more available. And one of our mental shortcuts is to think of things that are more available as more common," Schneier said.

Although the media's treatment of events could be held responsible for this confusion between perception and reality, there is another element at play: language, or rather its failure to accommodate for the difference between the "feeling" and "reality" of security.

"In effect, we have two very different concepts mapped on the same word. And this makes a lot of conversations about the feeling and reality of security hard to have because our language fails us," Schneier said.

Credit: Schneier: Bad news is good news, not so for security from ZDNet Australia

Did you find this article useful?
16 out of 18 people found this useful

Post a comment

Full Talkback thread

1 comment

Erm ... What he said .. as usual Andrew Meredith

More In Security threats

Company/Topic Alerts

Create a new alert from the list below:

Featured Talkback

On the contrary, if vendors were forced to stand behind their products it should increase innovation. It would force more, and better , testing before hitting the sales floor, resulting in fewer updates and less downtime for the consumer. At present the EULA removes responsibility from the vendor, and moves it to the user, which is a step backward. Make the vendor responsibility for their code.