Stormy Weather and The Cost of Security

It's been a crazy couple of weeks, first last week with Tom off to TechEd (representing us both this time -- to all those I missed out on seeing, my regrets and hopes that next year I'll get a chance to be there too) me holding down the fort here. Then this week we've been battling Mother Nature, with the Dallas-Ft. Worth area being pounded by storms almost every night. We spent one evening couped up in our “safe room,” a small bathroom in the middle of the house downstairs, with tornado sirens going off around us and two very confused cats wondering what was going on. The next night, high winds had a live power line on our street dancing and sparking, and we lost our electricity. We were lucky, though -- there were over 200,000 people in the area who were without power for days instead of hours.

All of this started me thinking about how most of us, even we “security experts,” tend to take chances in at least some areas of our lives. I have my service packs installed on my computer, anti-virus running, an ISA server on the perimeter of the network -- but we haven't ever gotten around to having that underground tornado shelter put in or installing that generator. Why not? Well, we've had some close calls (like Tuesday night) but we've never been devastated by a twister. It's not so much the cost in money as the cost in time that's the problem -- we have work to do, and storm shelters and generators aren't our field of expertise.

The experience made me stop and think with a bit more sympathy toward all those net admins and individual computer users out there who just haven't gotten around to taking the steps that they need to take to protect their networks or systems. After all, they have jobs to do too, without adding security to the mix.

And that's why we need to work to build security into the operating systems and applications -- even if it causes some access problems, even if some people get upset about the inconvenience those built-in security measures can cause. If our house had come with a tornado shelter, we certainly would have used it this week. If a generator had been included when we bought the house, we might have grumbled about the inconvenience of buying fuel for it and having to learn how to use it, but we certainly would have appreciated it yesterday when our air conditioning, refrigerator, even [shudder] our computers were all rendered temporarily useless by the power outage.

Security comes with a price tag that's measured in more than dollars, and it just doesn't seem like a very high priority when you have “more important” things to do -- until you need it, that is. In that moment, the cost seems pretty minimal.