Glacial Erratics

I think formalized, overwrought security policies are the product of a fearful environment where through action and inaction what's important has been obscured by lack of foresight and good planning. People write security policies in an effort to make a stand against the lack of foresight. As the policies rarely get actively read and are time consuming to enforce they are rarely successful in their bid to counter lacks elsewhere.    (0001EN)

Like many of my attitudes I think that successful security comes from removing doubt and removing choice. Being able to remove doubt and remove choice comes from having foresight, then identifying goals and sticking to them (wheels within wheels).    (0001EO)

Computers are tools which, when they have well defined tasks, are easy to maintain. Easy maintenance leads to better security. A tool which is poorly described leads to stopgaps, confusion, too many choices, and plenty of doubt: all holes for error.    (0001EQ)

People are not tools, primarily because that's gross but also because it is diversity of choice that makes people human. An effective human is one that is able to make good, informed choices from among several, with little doubt. People make good choices by being informed. Information flows through communication and experimentation.    (0001ES)

Abuse of tools comes about when the tools provide handles for experimentation to people who have not been provided with enough information (through implicit or explicit means) to make good decisions about appropriate use of the tools.    (0001EU)

Security, then, comes down to three things: providing focused and well-defined services, controlling exposure of handles and keeping users informed.    (0001EV)