Re: Are users right in rejecting security advice?

[Michael Sinatra <michael () RANCID BERKELEY EDU>]

On 3/17/10 7:30 AM, Vik Solem wrote:
> Isn't the real issue one of accurate communication of risk?  In the 15
> months I've now spend with an educational institution, it seems to me
> that communicating risk effectively is more important than specifying
> policies and procedures. As long as a user understands the risk of
> something (e.g. surfing the web from an Administrator-level account)
> then they can make a valid determination about how they should (or
> perhaps should not) change their behavior.

I agree completely that it's more useful to communicate risks than to
have rigid policies.  That allows the users to put in compensating
controls that fit their needs.

However, the point of the article runs deeper than that.  There are
clear, rational, economic disincentives to follow some of the typical
top-down security policies that campuses have.  Rather than create more
policies, it may be useful to attempt to monetize the externalities that
users create through their own bad security practices and fold them back
into the "market."

michael