Computer Security vs the World

Information is the currency of the Information Age. And just like bank robbers and safe crackers of the past, there are those with criminal tendencies who will strive to gain access to information they should not have. So we secure our computer systems and information stores, trying to protect our hoards from prying eyes and illegal downloads. The real problem lies in finding a balance between securing a system and keeping a system usable. Systems need to be secure to protect the information they contain and to prevent misuse. But if the security becomes overbearing, even legitimate users are likely to turn it off or find ways to bypass it. Figure 1 shows one of Windows Vista's UAC (User Account Control) prompts, which seemed to pop up for every choice on the operating system. Many people turned UAC off completely because the prompts became so annoying.

Figure 1 - Windows Vista User Account Control Prompt

In The Cuckoo's Egg, Clifford Stoll recounts the tale of how he discovered and tracked a computer hacker through his system back in the early days of interconnected computers. Many of the security holes the hacker used were there because System Administrators had not secured their systems correctly. They left default accounts active, or used software with bugs that created security loopholes. Often the reason for the security blunders was to make access for legitimate users more convenient. Unfortunately this also had the side effect of unlocking the door for intruders as well.

So what can be done? Where is the balance between usability and security to be found? A Google search for security vs usability gives 1,730,000 results, none of them giving a real definitive answer. People are thinking about it though, so at least we're moving in the right direction.