Fixing Securitys Biggest Problem

Yesterday I was talking with a VP of a large bank and he asked me what I thought was the biggest problem facing security professionals today. I didn't even have to think hard to come up with my answer. User awareness. Then he asked me how we fix this problem. I had to think a little longer, but then it hit me. This is not a new answer by any means. I've talked about it in the past and I've read what others have said on it also. The answer, at least part of it, is that we, as security professionals, have to take the time to explain security to users.

This isn't easy for many in the tech community. We tend to do better with machines than people. We tend to get irritated when users do stupid things. We don't like it when we try to explain something to them and they give us the "deer in the headlights" look so we give up and walk away. We pass up opportunities to pass some of our knowledge on to others. If we will just come out from the depths of our security lairs and take a little time to figure out how to explain security at a layman's level then we will put see drastic improvements in how users view and practice security.

As I say this I'm thinking about how this ties in perfectly with one of my goals in joining the Security Catalyst Trusted Catalyst Community. As Michael and I talked about the community and what we would both like to see come out of it this one a goal that both of us shared. I'm excited to see what will come from this. Something that we can all use to help educate users is sorely needed.