4 ms·
> It was all about the illusion of security, Correct. The "IT security" group was practicing what I've termed "checkbox security". They have a long list of "
by pwg 2y ago
> It was all about the illusion of security,
Correct. The "IT security" group was practicing what I've termed "checkbox security".
They have a long list of "requirements" and beside each is a check box. If they can check the box by reading the marketing brochure for product X, then they are "secure". In this case one of their check boxes was "screen shots disallowed". So they turned off screen shots, and were able to "check the box" and therefore they were "secure" (at least by their definition, which is "if the box is checked, we are secure"). The fact that trivial workaround exist make no difference to the IT security checkbox specialist.
- hyperman1 2y agoI've seen the term checkbox security in docs from the 1980's. Vendors delivered an insecure products, e.g. with default passwords. It turns out nobody knew how to secure these products, so vendors reacted by blame shifting: Provide lists about how to secure your products, and niw blame your customers for the insecurity. Customers didn't want to be blameable so did anything to check all boxes. All in all, I think it's a step up from what came before. A security problem is invisible until you get attacked. Then random unrelated people get caught up in the fallout. Checkbox security moves the pain to inside the company, where internal forces will provide pushback if a requirement is too onerous. That pushback is exactly what happens for this overly onerous requirement here.