The summer travel season is upon us. In an age of terrorism and other threats, this means that everyone is talking about airport security lines and the Transportation Security Administration (TSA).
Yes, everyone hates standing in line at airports and taking off their shoes. But as you wait, cybersecurity professionals can take some consolation from their user’s-eye perspective on a familiar conundrum: Seeking to combine maximum security with minimum inconvenience. Risk-based security is one solution to this challenge, but it comes with challenges of its own.
A Matter of Inconvenience
Before looking specifically at risked-based security, everyone needs to acknowledge a fact: Good security is inherently inconvenient. The whole point of security is to throw obstacles, complications, difficulties — in short, inconveniences — into the path of the malicious actors who pose security threats.
Take one familiar object of hate: the password. Strong passwords are a pain because they are tricky to remember. They are difficult to remember because, to be strong, they need to be hard to guess. Some user pain is all but unavoidable.
One basic way to improve security and reduce user pain and inconvenience is to concentrate efforts on the actors we are trying to stop. This is what risk-based security is all about: The more we can zero in on the potential threats, the more we can avoid hassling everyone else.
Waiting in Line to Bypass the Line
Honing in on cybercriminals requires identifying and assessing risks, which is not always an easy process. How do you identify a potential terrorist in an airport line or a potential attacker online?
The very idea of quantifying risk factors can be dicey because, as security specialist Rick Doten told Teri Robinson of SC Magazine, “Security is an emotion and risk is a calculation.” Assessing and prioritizing risks is always going to be a fraught and demanding task, albeit a necessary one.
Risk calculation can go in two directions. The more familiar seeks to identify users who are potentially high-risk and target them for protective action. The TSA’s famous — or infamous — No-Fly List is a measure of this type. But an equally important component of risk-based security works in the opposite direction: Identify low-risk, trusted users and allow them to speed through security checkpoints.
The TSA’s version of a trusted user program is its PreCheck. But as The New York Times reported, this has its own complications. Prospective trusted users need to be identified and vetted to ensure that they do in fact deserve to be trusted. This has created a bottleneck. Requests for PreCheck status have been much greater than expected, leading to long lines for PreCheck applications and approval.
Risk-Based Security Requires Work
Enterprises can do this screening organizationally, meaning that the trusted users can be selected and screened by others and might not even be told they have reached the trusted status. Someone still needs to do the work, but the individual user doesn’t need to know about it.
The bottom line is that someone needs to do the work. Real security has costs, including unavoidable user inconvenience. Budget constraints can add further inconveniences such as delays in granting users a “trusted” status. User complaints are inevitable.
Cybersecurity professionals putting their shoes back on at the airport should use the experience as a lesson in perspective. In a world of risks, security is indeed worth some inconvenience.