5 ms·
The effectiveness of a security program cannot solely be measured by penetration tests under controlled circumstances. Aspects of deterrence and standardizatio
by snake_doc 3y ago
The effectiveness of a security program cannot solely be measured by penetration tests under controlled circumstances.
Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus.
This is the very fundamentals of mixed strategy calculations in game theory.
- ethanbond 3y agoIt is absolutely bonkers how many otherwise pretty reasonable people miss this glaringly obvious fact.
- tqi 3y agoWe are all vulnerable to confirmation bias
- snake_doc 3y agoA common analogy is to think about traffic lights. If you run a penetration test, asking an individual to run a red light. You will achieve near 100% success. However, when the traffic lights change actors’ behaviors to stop (at some probability such that it results in less collisions), most actors will stop according to the traffic lights.
- RiceRichardJ 3y agoThat's not a good analogy at all. The incentives and motivations are completely different. Many drivers would at one point or another consider running a red light in order to save some time. I don't think you can say the same about passengers wanting to hijack a flight.
- CamperBob2 3y ago"Aspects of deterrence and standardization required by the program fundamentally changes the threat actors’ calculus." “By your logic I could claim that this rock keeps tigers away.” “Oh, how does it work?” “It doesn’t work.” “Uh-huh.” “It’s just a stupid rock.” “Uh-huh.” “But I don’t see any tigers around, do you?” “Lisa, I want to buy your rock.”
- tadfisher 3y agoFear will keep the local systems in line. Fear of this battle station.
- ethanbond 3y agoDo you believe there aren’t people who wish to use air travel for nefarious purposes? Do you believe that none of those people are factoring in the presence of identity checks, x-rays, backscatters, bomb dogs, and metal detectors into their risk/reward calculation or the techniques by which they’d commit nefarious acts?
- gaganyaan 3y agoThey're probably factoring in strengthened cockpit doors and passengers' willingness to fight back, because those actually work. The rest is security theater.
- tmpX7dMeXU 3y agoIf you are going to resort to “it is because it is”, leave and let someone else argue your side.
- majormajor 3y agoAnd on the opposite side of the stupid-examples spectrum: any tech company that hasn't had a computer security breach should fire their security team. All they're doing is spending a lot of money to make their developer's lives a lot harder. Anyone with clean floors should fire their janitors. Etc... Those don't mean every security spend is worthwhile and justified; but Simpsons quotes also don't mean that no security spend has any effect.
- deleted 3y ago[deleted]
- yowzadave 3y agoHow do you propose measuring the effectiveness of the program?
- 13of40 3y agoI was going to suggest comparing it to other developed countries' practices vs their rate of high profile terrorist attacks, but then I realized it correlates the other way. Spain and Italy hustle you through an old-school metal detector, but going into Israel I thought I was about to be beaten down with a rubber truncheon when I forgot the piece of paper I had in my pocket.
- andrewflnr 3y agoYeah, the number of people targeting you matters, too.
- janalsncm 3y agoChina’s is surprisingly easy. Just a metal detector and an X ray of your carry on. Didn’t even take my shoes off. Singapore’s is the best. The security is right at the gate so the timing is a lot more predictable and you don’t have to worry about missing your flight.
- freeone3000 3y agoChina’s is done as you’re transiting. My luggage was sniffed, my hands wiped for explosive residue, and I was x-rayed, all without having to stop for more than a few seconds.
- tmpX7dMeXU 3y agoIsrael’s methods are incredibly interesting and something that you just wouldn’t get away with in the US. I say this as a non-American non-US-resident, which I think is important because my comment sounds like American exceptionalism.
- wordsarelies 3y agoTruth, the primary impact was the ability to arbitrarily inflate the cost of soft goods dramatically inside the terminal. It's such a good racket Hudson News...a little news stand company inside a few dozen terminals was able to go public on the NYSE... The public perception that security is "doing it's job" is non-existent since everyone knows it's at best a jobs program and in practice another group of people measurably stealing travellers things.
- snake_doc 3y agoHudson News is a brand for its Swiss parent company, Dufry. Dufry existed prior to the invention of the airplane…
- devilbunny 3y agoWhile this is true, the method of 11 September 2001 worked for less than two hours. It is effectively impossible to hijack an airplane now, because the passengers will assume that they're dead either way and will do anything they can to stop you. You can still blow them up a la Lockerbie, but that's about it. I really don't see a meaningful reason for most of "security screening" anymore. It just slows things down.
- master_crab 3y agoTrue, and even two hours maybe pushing it. The crash in PA on 9/11 was a direct result of passengers attacking the cockpit after they found out what happened to the other planes.
- nelsondev 3y agoOr being shot down by a fighter jet.
- qchris 3y agoIt might be worth doing some reading on the actual events of that day. For example, "being shot down by a fighter jet" wasn't an option; the fighters weren't armed when they were put up in the sky. The pilots in them went up knowing that if a plane needed to be taken out, they were going to be using themselves to do it. And none of that is to mention the passengers the parent comment was referring to, who made the conscious, heroic decision that their plane wasn't going to be used as a weapon like two previous ones had been, whatever the cost. I don't mean to assume bad faith, but this was, at best, a throwaway comment that minimized the bravery and sacrifice of a lot of good people. Either way, I'd like to recommend you educate yourself a bit more. The Wikipedia page has some excellent detail, and if narrative structure is your thing, the book The Only Plane In The Sky is a masterpiece on the subject.
- gatlin 3y ago> weren't armed when they went up How has this claim been authenticated?
- canjobear 3y agoClassic example of the Lucas Critique.