Originally Posted by The Article

When does too much security become, well, too much? According to Steve Riley, senior security strategist at Microsoft, it becomes too much when the cost of mitigating the risk outweighs the cost of that which you are trying to protect.

Steve's approach to security spans all horizons, not just information technology. He elaborated on this theory in an afternoon session today at Microsoft Tech.Ed entitled "Making the Tradeoff: Be Secure or Get Work Done".

The cost of securing an asset is not simply the absolute cost of purchasing an enterprise firewall or business-wide malware software, according to Riley. It's measured against the current cost of leaving things as they are - if a couple of machines go down every week because of security vulnerabilities, that is a cost which can be measured and taken into consideration. However, if the cost is actually less than the cost of removing the problem, bizarre as it may sound, it might not actually be worth it.

<snip>

And this goes all the way up to the US's so-called "War on Terror". According to Steve, are any of us really made safer by taking our shoes off to go through metal detectors? Surely X-ray scanners which can see right through people's clothing is an unacceptable breach of privacy? At the very least, do we want to live in a society where this is the accepted norm?

Regardless of the answer to these questions, go back to his approach with children and strangers - recognise the methods of attack, rather than focus on stopping the tools. Why did the September 11 terrorists use planes to destroy the World Trade Centre? Because it was probably the easiest method at their disposal. If a terrorist wishes kill people at an airport, all the security in the world won't stop them from detonating the bomb while waiting in the security lineup.

These are sobering thoughts, and they do make you take a second look at the vast amounts of money and effort going into security "measures" which do much to remove personal liberty and intrude in our daily existence, yet prove remarkably ineffective at actually stopping anyone determined to succeed.