Hoff

Hoff at Rational Security blog is giving a helping hand - as long as it is not to someone fighting against the Norton Pop-ups. Must admit, I am willing to fight the Norton Pop-ups anytime - and replace them with something a little more subtle. Something that knows its place on the computer - and do not bother the user with messages that not even the best of security worker can understand. 

So - the Hoff story.  

I like the fact that it is possible to exchange a security lesson with bowling. 

But - the fact that even ATM vendors are neglecting security is not a good deed at all. They really should know better.  I mean, we are no longer in the 1980! No wonder why companies in not-so-secure industries are having a hard time understanding. 

Christofer Hoff is ranting about security people who act like the security guard and still expect to be treated like security pros.

He is right on the spot. If your security officer hides away in the bunker and asks for more cash to spend on security, it is time for you to up the requirements. Security is not rocket science. It is about managing risk - just as you do every day, and has been doing every day since your birth.

Take a kid learning to ride a bike. As a parent, you prefer not to look. Still you know the kid has to try, and actually fall. Not once. Not twice. But many times. Why? So the kid himself can learn and relate that bicycling is dangerous, it does hurt to crash, and thus the action taken must be adopted to the possible pain. 

In other words - learning to ride a bike is learning to relate risk (possible pain) with action (possible outcome - riding the bike). You know that by mastering the bike, and adopting the approach, you reduce the risk for getting hurt. But as kids are stubborn, and need to experience pain in order to understand it, you have to let them try.

It is the same thing when you grow up and start working. As a manager, you have your targets, actions and risk. As with the bike, you have to adopt your actions to reduce the risk, while maximizing the outcome.

And your security officer is supposed to actually help you maximize the outcome by managing the risk. If he do not realize that, get rid of him. If you do not realize it, it is time to wake up - he is there to serve the company.

Read the Hoff rant, and make sure you send it to your security people as well!