Education in Computer Security

It's hard to stand against education. Education means improvement and broadening of the mind. It is an incontestable good. Opposing education is like opposing democracy, equality, progress, and all of the other moral taproots of Western civilization.

So it is with computer security. Consumer education is one of the most frequently recommended antidotes to Internet security problems. It's hard to argue that consumers shouldn't be educated. But when I read advice on consumer education, I feel that someone's trying to pull the wool over my eyes.

The National Consumers League recently issued a collaborative report on phishing (a scourge to e-commerce). The top recommendation: greater consumer education. EPCglobal Inc., a major organization spearheading RFID (i.e., wireless microchip) deployment, has chosen a similar remedy to inflammatory consumer-privacy issues. Among EPCglobal's four policy guidelines are consumer notice and consumer education. (Does "education" teach someone how to understand "notice?")

Consumer education is everywhere. It's easy to find Internet sites educating consumers on an array of topics: art appreciation, medical safety, automobile safety, sustainable fishing practices, the benefits of low-fat/high-carb diets, the benefits of high-fat/low-carb diets, the benefits of cotton, the benefits of hemp, and so forth. What often goes unacknowledged is that consumers are not infinitely educable. Mindshare is a scarce resource; "educators" (and advertisers) are competitors for the consumer's stretched and limited attention. A policy that relies upon successful education presumes victory on a fierce and ever fiercer battleground.

In many cases, the goal of education is to inculcate consumers with simple messages of fundamental and enduring value, to teach lessons that save natural resources and lives. Such education is worth a little mental clutter.

Consumer "education" in security is altogether different. It is not about fundamental knowledge or betterment. It is really the practice of teaching consumers short-term tricks to navigate a broken system, of spreading guerilla tactics for the as-yet untamed jungle of the Internet.

The educated consumer, we are told, does not click on a link in a piece of e-mail unless certain of its authenticity. (See, e.g., the FTC guidance and that of service providers like Yahoo.) At the same time, people receive daily e-mail from their banks, brokers, etc., that offer the option of clicking on a link. Few people--even security specialists--are really confident in the authenticity of most e-mail. Even if consumers are ultimately "educated" to combat phishing, the phishers will turn to more sophisticated scams like spear phishing and pharming, as they are already doing. That's why computer-security education is a stopgap measure.

In stark opposition to the number-one recommendation of the National Consumers League report is its number-two recommendation: the user experience must be secure by design. In other words, security architects and educators need to educate themselves to build systems that don't require consumer "education" at all.

In the end, therefore, there's no reason to oppose computer-security education. But perhaps the most important goal is to educate the educators first.

Post A Comment

Your Name
Your Email	Publish email?: Yes No
Your Blog
Subject
Comment
Verification Word