Rational Horoscopes and Protection

Rational Horoscopes and Protection

An abbreviated document authored by John Kelsey and myself for the Rossfest Festschrift is titled “Rational Horoscopes and Protection“:

Designers have an alternate non-security course to invest their security funds: on streamlining their own routines. Numerous of these belong to what has been labeled sensible astrology. Initially recognized by Randy Steve Waldman [Wal12], this phrase refers to something individuals treat as operational, usually for social or organizational motives, even when there is scant evidence of its efficacy—­and occasionally despite significant proof that it is ineffective.

[…]

Both security spectacle and sensible astrologies might appear illogical, yet they are sensible from the viewpoint of those deciding on security. Security show is frequently motivated by information asymmetry: individuals who lack comprehension of security can be comforted with superficial or emotional measures, and every now and then that reassurance is crucial. It can be dissected better by contemplating the myriad non-security functions of a security infrastructure. A surveillance bracelet system matching new moms with their infants might resemble security theater, considering the extremely rare incidents of infant abductions from hospitals. Nevertheless, it is justified as a security system intended to allay the anxieties of new mothers [Sch07].

Sensible astrologies in security emanate from two considerations. The first is the principal-agent issue: The objectives of the individual or entity deciding on the security are not always synchronized with those of the users of the system. The well-being of the user may not carry as much weight on the developer’s mind as the challenge of persuading his supervisor to take a risk by disregarding an obsolete security regulation or experimenting with new technology.

The second consideration that can result in sensible astrology is when there is a societal or institutional necessity for a resolution to a predicament for which there is truly not a particularly strong solution. The establishment needs to reassure regulators, clients, or perhaps even a judge and jury that “they did all that could have been done” to prevent a certain issue—even if “all that could have been done” was not particularly impactful.

Tags: cybersecurity, psychology of security, security theater