July 11, 2016 By Rick M Robinson 2 min read

The summer travel season is upon us. In an age of terrorism and other threats, this means that everyone is talking about airport security lines and the Transportation Security Administration (TSA).

Yes, everyone hates standing in line at airports and taking off their shoes. But as you wait, cybersecurity professionals can take some consolation from their user’s-eye perspective on a familiar conundrum: Seeking to combine maximum security with minimum inconvenience. Risk-based security is one solution to this challenge, but it comes with challenges of its own.

A Matter of Inconvenience

Before looking specifically at risked-based security, everyone needs to acknowledge a fact: Good security is inherently inconvenient. The whole point of security is to throw obstacles, complications, difficulties — in short, inconveniences — into the path of the malicious actors who pose security threats.

Take one familiar object of hate: the password. Strong passwords are a pain because they are tricky to remember. They are difficult to remember because, to be strong, they need to be hard to guess. Some user pain is all but unavoidable.

One basic way to improve security and reduce user pain and inconvenience is to concentrate efforts on the actors we are trying to stop. This is what risk-based security is all about: The more we can zero in on the potential threats, the more we can avoid hassling everyone else.

Waiting in Line to Bypass the Line

Honing in on cybercriminals requires identifying and assessing risks, which is not always an easy process. How do you identify a potential terrorist in an airport line or a potential attacker online?

The very idea of quantifying risk factors can be dicey because, as security specialist Rick Doten told Teri Robinson of SC Magazine, “Security is an emotion and risk is a calculation.” Assessing and prioritizing risks is always going to be a fraught and demanding task, albeit a necessary one.

Risk calculation can go in two directions. The more familiar seeks to identify users who are potentially high-risk and target them for protective action. The TSA’s famous — or infamous — No-Fly List is a measure of this type. But an equally important component of risk-based security works in the opposite direction: Identify low-risk, trusted users and allow them to speed through security checkpoints.

The TSA’s version of a trusted user program is its PreCheck. But as The New York Times reported, this has its own complications. Prospective trusted users need to be identified and vetted to ensure that they do in fact deserve to be trusted. This has created a bottleneck. Requests for PreCheck status have been much greater than expected, leading to long lines for PreCheck applications and approval.

Risk-Based Security Requires Work

Enterprises can do this screening organizationally, meaning that the trusted users can be selected and screened by others and might not even be told they have reached the trusted status. Someone still needs to do the work, but the individual user doesn’t need to know about it.

The bottom line is that someone needs to do the work. Real security has costs, including unavoidable user inconvenience. Budget constraints can add further inconveniences such as delays in granting users a “trusted” status. User complaints are inevitable.

Cybersecurity professionals putting their shoes back on at the airport should use the experience as a lesson in perspective. In a world of risks, security is indeed worth some inconvenience.

More from Risk Management

Digital solidarity vs. digital sovereignty: Which side are you on?

4 min read - The landscape of international cyber policy continues to evolve rapidly, reflecting the dynamic nature of technology and global geopolitics. Central to this evolution are two competing concepts: digital solidarity and digital sovereignty.The U.S. Department of State, through its newly released International Cyberspace and Digital Policy Strategy, has articulated a clear preference for digital solidarity, positioning it as a counterpoint to the protectionist approach of digital sovereignty.What are the main differences between these two concepts, and why does it matter? Let’s…

A decade of global cyberattacks, and where they left us

5 min read - The cyberattack landscape has seen monumental shifts and enormous growth in the past decade or so.I spoke to Michelle Alvarez, X-Force Strategic Threat Analysis Manager at IBM, who told me that the most visible change in cybersecurity can be summed up in one word: scale. A decade ago, “'mega-breaches' were relatively rare, but now feel like an everyday occurrence.”A summary of the past decade in global cyberattacksThe cybersecurity landscape has been impacted by major world events, especially in recent years.…

It all adds up: Pretexting in executive compromise

4 min read - Executives hold the keys to the corporate kingdom. If attackers can gain the trust of executives using layered social engineering techniques, they may be able to access sensitive corporate information such as intellectual property, financial data or administrative control logins and passwords.While phishing remains the primary pathway to executive compromise, increasing C-suite awareness of this risk requires a more in-depth approach from attackers: Pretexting.What is pretexting?Pretexting is the use of a fabricated story or narrative — a “pretext” — to…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today