Marcus Ranum (one of the inventors of the Firewall) has puslished an article on the top six dumbest ideas in computer security. #2 is Enumerating Badness - the practice of trying to come up with all the different ways someone could hack a system, then going about trying to protect against those various ways.

Problem is, that doesn’t work. You can’t think of everything someone will try. How many times did we hear “Who ever thought of Terrorists using planes as weapons?” after 9/11? (It turns out several people did - but that is beyond my point). Trying to anticipate how people will attack us then putting in place measures to guard against that attack doesn’t work.

But we still do it. Manly because we have a media that is shallow and focused on attention grabbing headlines, and politicans who govern by press-release.

Politician: “Something bad is happened. Congress must pass a law!”

Our esteemed(sic) Governor tried that recently when he instituted price controls after there was a media induced panic over fuel supplies. Any economist to the right of Karl Marx will tell you that rises in price are the market’s natural way of reducing demand, but being a politican, Perdue had to do something. Letting problems work themselves out naturally isn’t allowed when there are press-releases to be issued.

This stupid reliance on movie plot threats is the reason we have to take off our shoes before boarding a plane, but no one has worried about security the large fleet of trucks no one thinks twice about being parked in front of buildings. You can’t take nail clippers on a airplane, yet less than one percent of the cargo containers are screened. Last time I entered the Empire State Building I had to turn over my leatherman - apparently there were worried someone would hijack the building and fly it into some airplanes.

Of course all the attacks I just mentioned — suitcase nukes in cargo containers and hijacked delivery truck bombs — are just more movie plot ideas. For every billion dollars we spend on prevention there is another bad USA Networks movie of the week.

Maybe we should focus our efforts on detection and mitigation, and leave the disaster scenarios to Hollywood.