Originally posted by Snowhog
View Post
As Feathers astutely observes, one must always make trade-offs. You connect your computer to a network not because there exist risks but because there exists rewards -- rewards that, presumably, outweigh the risks. You can further alter the risk:reward ratio by taking appropriate steps to minimize the risk; these have the nicely coincidental benefit of likely helping to maximize the rewards as well.
In 2007, I delivered a talk at the various Microsoft TechEds around the world on exactly this topic: security trade-offs. It got some press coverage. Not all commenters on the various pieces expressed positive reactions. Nevertheless, I stand by my assertions. Security decisions always involve trade-offs. It doesn't matter whether you're trying to protect a computer from an attacker, an airplane from a jihadist, or a nation from its enemies -- the requirement to balance risks, threats, rewards, and access always applies. Those who argue otherwise do so from bias or emotion, not from rational assessment.
http://arstechnica.com/information-t...rity-overkill/
http://apcmag.com/too_much_security_..._microsoft.htm
http://blogs.msmvps.com/alunj/2007/0...ley-at-teched/ -- I agree with Alun's mild rejoinder
http://www.theinquirer.net/inquirer/...y-is-bad-thing
http://slashdot.org/story/07/08/08/1...r-is-overblown -- such a variety of reactions; most people get off the rails
http://www.crn.com.au/Tools/Print.aspx?CIID=24546
Comment