Blame Game

Don’t click on attachments. Never write down your password. Update your virus definitions religiously. How many times have you found yourself reminding co-workers of these simple rules for safe computing? Probably too many. The confused colleague is an easy target-for hackers to hit, and for you to blame in the aftermath of that hit. But some experts say security executives should be demanding more secure products from vendors and spending less time and energy on training workers.

Usability guru Jakob Nielsen, for one, says security education or awareness training simply doesn’t work. Nielsen says it’s not realistic for everyday computer users, even those in the enterprise, to keep up with the sophisticated methods of hackers. For instance, he says, it’s wise to tell employees not to open attachments from unknown sources, but what if the e-mail appears to be from a colleague? Nielsen would like to see technology that makes it easier to:

1. Encrypt all information at all times, except when it is being displayed on the screen.
2. Digitally sign all information
3. Turn on all security settings by default, and modify these settings as needed.
4. Automate all updates
5. Improve the user interface

Nielsen’s opinions echo those of other security-savvy experts who criticize Microsoft and other vendors that would rather blame users, instead of their products, for security shortcomings.

This school of thought runs in contrast to the conventional wisdom of safe computing – that the technology is only as good as its weakest link, which is, of course, the user. As Symantec CEO John Thompson has said, a lock is useless if you don’t lock it. Nielsen might argue that a lock is also useless if no one can figure out how to lock it.

Tell us what you think. Does Nielsen have a point, or does he live in a user-centric fantasyland? Is it time to stop pointing the finger at users, and take a harder look at technology?