Why Security Isn’t Invisble (and lifehacking: dreams)

When security isn’t constantly annoying you, you forget to pay for it. As some major antivirus companies have learned.

That right there ought to explain a lot about the state of security today.

It’s one of those things that doesn’t have to be bad, even if it currently plays the moral hazard. Complacency is horrible for security.

Dreams: Turns out they have all kinds of uses. They can be kind of like, well, using the bathroom, except with respect to information.

From a German-language book: “information which is perceived by the subconscious mind but not processed by the conscious shows up in dreams… in some cases, people who were exposed to advertising with embedded subliminal messages “dreamed out” that subliminal content at night.” (“Die Subliminal-Methode,” Taylor, 1989)


” Yet one of the things that will inevitably get in the way of building security into everything is how it impacts the existing multibillion-dollar security industry. The short answer is dramatically. The jobs that you and I do daily will probably go away if security is just there. There will be a need for security knowledge, but not necessarily security specialization. You can bet that multibillion-dollar industries do not go quietly into the night. And there is a definite disincentive for these incumbent security vendors to fade into the background.

Let me give you a little example of what I’m talking about. I worked a few lifetimes ago with a fellow who spent time as a product manager for a major antivirus company. Yes, when antivirus kind of worked. He told me the story about how the company decided to silence the notifications of signature updates since it was kind of annoying to the customers. The product updated silently when necessary and the user would be none the wiser. Win-win, right?

Actually, it was a big loss for the vendor. The customers loved it. They were no longer pestered by useless notifications. But the vendor saw a measurable negative impact in its product renewals. Since users no longer saw the updates happening, they thought the product wasn’t doing anything. So they didn’t renew. Makes perfect sense in hindsight. The AV vendor turned notifications back on, and renewal rates went back to historical levels. Amazing how that worked.

It’s unfortunate, but if no one thinks security is there, they’ll forget to continue paying for it. And getting funding for those key projects will get harder and harder. In fact, most security practitioners feel this pain every day. In the aftermath of a breach, they get whatever they want. No matter the cost. They need to fix the problem, and senior management certainly won’t let money get in the way. Not when there is a perp walk hanging in the balance. “

%d bloggers like this: