Remembering the 4 Es

Bruce Schneier has come out saying that Security Awareness training isn’t worth the money, and I couldn’t disagree more. Specifically, Schneier has said:

I personally believe that training users in security is generally a waste of time and that the money can be spent better elsewhere. Moreover, I believe that our industry’s focus on training serves to obscure greater failings in security design.

Bruce’s statement and belief reflect the fallacy and overconfidence of the engineer. I saw this discussed once in a seminar on highway safety, where the highway engineers talked about how they once believed that they could eliminate traffic fatalities solely by engineering better highways and better cars. They soon learned that wasn’t enough — they they needed the four Es:

1. Engineering
2. Enforcement
3. Education
4. Emergency Response

Engineering highways — or security — is only part of the picture. You still need to have policies and enforce them. You still need to teach users to be aware of threats and to know how to response. And you need emergency response to ensure your systems are not killed by the attacks — that they are resilient and can recover.

Awareness training is a vital part of this. Yes, you can engineer away some of the problems. But you can’t get rid of them all, and you certainly need to educate about social engineering attacks.

Bruce — I’m surprised at you for this statement.

(and now it is off to the shower before I go to work….)

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)

An Unnecessary Tragedy in Northridge

This morning, before I left for work, I posted a link to an article about the death of 14-year old Aria Doherty in Northridge. As I eat lunch, I’d like to expand on the article. Aria was an honors student at Nobel Middle School [FB] (a few blocks away from our house, and the middle school our daughter attended).  She died Monday night, after “huffing” from a can of compressed air used for cleaning dust out of a computer. According to KNBC, she’d been home alone for a couple hours when she inhaled the duster. Her older sister found Aria in bed with a can of compressed air still attached to her mouth, her nostrils taped shut. A plastic bag was found nearby. The “huffing” had sent Aria into cardiac arrest. Her parents Richard and Carolyn Doherty said they were caught completely off-guard. The Doherty’s kept no dangerous weapons in their Porter Ranch home, stored prescription drugs under lock and key, and recently purged their home of all alcohol. They talked to their teen daughters about the dangers of substance abuse. They had never found any evidence that she had huffed at all; they believe this was her first time. Doherty was a straight-A student, ambitious and very active at her school. She was active in the drama department; we had seen her in at least 3 productions in small roles.

Those of us in the broader Nobel community — parents, students, alumni, parents of alumni, teachers — are spreading the word about this tragedy so it does not happen again. Parents and children need to understand inhalant abuse, what huffing is, what products can be used, and most importantly, how to prevent it.

Trolls are also out there referring to the students that do this as stupid, or to the parents as stupid, and blaming everything under the sun for the problem. They are doing this just to incite comments. Ignore them. Stupidity is not involved.

Here are a few key points, as I see it:

• This is not a “ban the products” situation. Far too many products useful to society can be used to “huff”, from air freshener to compressed air to correction fluid. It is not practical to ban or limit them.
• Stupidity is not involved. Immaturity is a different question. We forget that middle-school and high school students are not yet mature. In fact, the human brain often does not finish maturing until the 20s (or even later for men). They may look mature and have mature bodies, but they do not always make mature judgements. Even if our young people are educated about the facts and the dangers, they may still make the wrong risk decision and try this.
• Peer pressure — to do right or wrong — is often important. Fitting in both in behavior and look is important at this age. Often, but not always, friends can provide clues.
• The most important thing you can do is to keep the lines of communication open. This is hard for parents of teens, where your child often wants to push away to establish their own identity. Make it clear that you are always there to discuss a risk decision, and indicate that you won’t be judgemental. You will present them with all sides of the issue, and trust that their judgement will make the right decision (moreso as they get older and demonstrate they make the right decisions).

With this tragedy, parents will be holding their children a little closer tonight, grateful they are there. We can’t for a few more days, as ours is still off in Berkeley. So I’d like to publically note that I’m proud of our daughter with respect to her decisions. Although we don’t always agree with them, at least she talks to us about them and considers what we have to say before making her final choice.

This entry was originally posted on Observations Along The Road (on cahighways.org) as this entry by cahwyguy. Although you can comment on DW, please make comments on original post at the Wordpress blog using the link below; you can sign in with your LJ, FB, or a myriad of other accounts. There are currently comments on the Wordpress blog. PS: If you see share buttons above, note that they do not work outside of the Wordpress blog.

(Click Here to Comment)