4 ms·
The difference between security thinking and free-floating paranoia is the threat model. Are you protecting against an actor with goals and capabilities, or are
by msla 6y ago
The difference between security thinking and free-floating paranoia is the threat model. Are you protecting against an actor with goals and capabilities, or are you trying to make yourself feel better? In the first case, you can make it harder for that actor to use their capabilities to get what they want than they're capable of justifying. In the second case, eat some chocolate. It won't make you any more secure, but it might help you feel better.
- skissane 6y ago> Are you protecting against an actor with goals and capabilities, or are you trying to make yourself feel better? It is difficult to protect against state actors. But a lot of attackers are not state actors. They are private actors (whether lone individuals or groups) going after the low-hanging fruit. Protecting against this threat is a lot easier. And for a lot of enterprises, the second category is a bigger threat than the first. Even if the NSA steals all your data, they are unlikely to release it to the general public or use it for extortion. The later group are much more likely to do things like that. If the NSA hacks you, you quite possibly will never know they've done it. If the later group hacks you, they'll make sure you know they've done it by the pain they'll cause. (Of course, I realise how for companies in certain sensitive industries, such as defence, aerospace, semiconductor fabrication, etc, the threat of state-sponsored cyber-espionage from competing international powers is a real threat – however, I think in those cases one's own country's three-letter agencies are often keen to be helpful.)