In a way it’s to be expected I guess, Security needs to be a balance between security and convenience, and the more that balance is tilted towards security the more people will be unhappy with it, possibly to the point of becoming counterproductive.

@Laurie

Indeed it is; the ‘we have to see and check everything with no compassion or concessions’ does have that 1984 ring to it. If it is really all necessary is an interesting question as well.

@Sophie

Thanks. That is indeed what I am trying to do here – have people think about the two sides of security. Security itself and its cost on convenience.

@Liv

It’s true that a security professional will tend to go towards security rather than towards convenience and that’s a natural reaction, because as a security professional your responsibility is to ensure the security not to make life as easy as possible. However, that being said, generally, a security professional is not the only party involved in a project and there will be others whose main priority it is to make the system as easy to use as possible. These two disciplines will generally find an acceptable middle ground.

@Kathryn

I am afraid that in truth it’s actually more complicated than that. A pilot can bring down a plane without needing to smuggle in a gun, FACT. But if it’s known that pilots are not subject to security checks because logically they don’t need to be then whoever wants to smuggle in a gun can pretend to be a pilot, thus eliminating an unnecessary security check which has still resulted in a security risk. Worse yet, indirectly this has created a security risk to the pilot himself who might find himself blackmailed by someone to get prohibited items through security. I don’t mean to say that pilots need to be subjected to the same kind of security as everyone else, but what I am saying is that if you look hard enough there is a reason to implement security everywhere, but then again is it cost effective? The correct procedure here is for people with knowledge and experience to weigh the risk mitigation with its cost and to see what procedures are worth implementing and what can be safely discarded.

I guess the difficulty in a statement like this, most especially in the context of a security industry that’s as volatile as ours; it’s hard to pinpoint exactly what is necessary and what isn’t. Surely, the example of the pilot is an easy case to make, but how does it apply to the IT industry?

Most of the time, and with good reason, we apply the measures we do today because we don’t know what kind of threats there will be tomorrow.