The biggest consequence of the lack of security policy is that users do not know how to react to typical
and atypical situations.
In a way we shift the responsibility for the decision onto others.
But they can't really make such a call because they do not know the working principles of computer systems.
In the slide you can see one of the older solutions which was created to protect users from a piece
of malicious software called a key logger
bloggers tracked the keystroke on a keyboard and remember the sequence.
They act like a virtual copy of a real keyboard.
The solution presented here doesn't seem to be thought through.
Every security solution must meet two criteria.
It must serve the specific purpose and it mustn't make it harder to use the program or system it's installed
on.
The purpose of the solution presented in the slide is to prevent a key logger from tracking a user's
keyboard input.
This input may then be used to hijack a session to make online shopping at the user's expense.
Or disbands users virtual money.
The truth is however that this solution doesn't really protect the user from any of these threats it
offers protection against tracking keystrokes only.
For example the computer used to log into my pay may be infected with malware that doesn't track keystrokes
but is able to hijack the system.
So the solution presented in the slide is complicated and yet unreliable.
Another example of an unfortunate security solution is a PC smart card reader with a PIN pad a smart
card or a chip card.
It's based on a digital key which both protects and authenticates the identity of the card holder.
To be able to use the digital key you need to know the cards PIN number one manufacturer introduced
a small device for personal computers that look like a credit card reader.
The idea was to use the pin pad not the keyboard to enter the PIN numbers so that the key logger couldn't
record it.
Supposedly it made it safe to use PC smart cards even if the computer was infected with a key logger.
However the solution was complicated impractical and inconvenient.
In reality it failed to eliminate real threats.
Actually to know the PIN number is not enough to attempt an attack.
Use a smart card you have to know the PIN number but you also have to possess the actual card
otherwise the attack is impossible.
A security policy should help you to design smart security solutions.
Solutions which won't be annoying and inconvenient.
For example a virtual keyboard which requires the user to enter the password by clicking on the symbols
with the mouse cursor is inconvenient and will ultimately make the user change the password to a shorter
one.
So in reality it makes the system less secure.
Recently as a consequence of this shift in the approach to the issue computer security has been viewed
as a process where continuum
in security process should consist of at least four elements protect detect react restore.
First you should define the resource you would like to protect.
Then you should detect actions that violate the security policy such violations may turn out to be user's
errors or real attacks.
You also have to react accordingly.
Remember that a system is never secured.
It can only be protected to a certain extent.
You have limited time to take action.
If you use it properly you can counter a successful attack or even completely stop it.
If you fail to use the time you have all you will be able to do is record the attack
the last elements of an effective security process is recovery strategy.
What you can do to restore the system after a failure or an attack
the goal of a security process is not to guarantee that the attack is impossible.
Sooner or later the attack will occur.
Thanks to a security process you will be able to detect it Schneier who is a computer security guru
and a data encryption expert used to say security is a process not a product.