Truth About Computer Security Hysteria
Computer security means nothing to Joe SixPackRob Rosenberger, Vmyths co-founder
Sunday, 19 December 2004
I GAVE THE opening keynote at a CERT conference in 2002 — and I stunned the audience.
What did I do? Well, I simply told the truth. The title of my keynote: "You mean nothing to Joe SixPack."
I started out with a string of humor. I talked about grandmothers on social security, steel workers in Pittsburgh, auto workers in Detroit, and farmers in the midwest. The audience laughed at how little the real world cares about their heroic efforts to stop crime and terrorism on the Internet.
The laughter started to fall away when I described how little computer security means to a stock broker in New York City. Oh, it started out with humor — but then I talked about how those brokers ran in terror from a massive wall of dust barreling down on them.
Laughter went down the tubes when I told the audience they mean nothing to an Al Qaeda terrorist. "He doesn't want to kill you with a hard disk, he wants to kill you with a knife. That's what he really wants to kill you with. He wants to feel that slide into you and he wants to watch your eyes glaze over." (Listen for the klik of my tactical knife at the 25sec mark. I opened it on stage to drive my point home.)
Then I brought up a photo of a victim who fell to her death from the World Trade Center. The CERT audience greeted me with stunned silence as I stated the obvious:
This is a picture of a woman [who jumped from a WTC tower]... SPLAT! Nine seconds to die. Not once did she think about you. Not once did she think about "wow, what's happening to all my computers on the 78th floor as I plummet to my death?" Not once did she care. Not once did the people who were watching this care about you. That's what's really sad here. And what you want to do ... is you want to take billions of dollars away from people who watched the towers collapse. Who ran from a 25mph 20-story-tall billowing wall of smoke. You want to take billions of dollars away from them and you want to put it into a cyber-terrorism pot. And you want to take money out of that, and you want to protect them from electrons.
I wrapped up with a simple observation. "Joe SixPack doesn't know that I'm representing him here. He doesn't care about me, either. He doesn't know this conference exists and he'll never care in the slightest."
Not once did the audience think about computer security. Not once did they think about "wow, what's happening to all my computers while this guy is telling his jokes?" Not once did they care...