This essay reflects the context at publication. Laws, products, organizations, and technical capabilities may have changed since then.
The water is great, coming in for a swim?
What causes pause in your household? Nothing you say? A recent late night discussion between my wife and I about my chosen profession (security) and how it affects her each day was a wake-up call. My wife is an Apple user so her initial response to my query, “what concerns you about security outside of physical things like the home alarm system” resulted in a simple, “I use an Apple, I have no concerns” and was exactly what I expected. She is a fan of my email signature line, “Protection and security are only valuable if they do not cramp life excessively.” [Carl Jung] and she is convinced I lean on the paranoid side but I nonetheless pushed a bit further. I found the 2 points where security most concerned my free-spirited wife.
Concern 1-Medical Records Exposure
My complete medical records are available online if I simply “configure an account.” Our local provider, a large one, offers this as a “free service.” My wife has listened to me enough lamenting about security to realize her records are out there already, without her activating the free service(correct assumption)-and realized that the medical provider most likely has security that does not exceed levels used by the US Government, Major Manufacturers, and others. The same folks who have already had every bit of data on customers they consider their own and protected at the highest levels, slurped up by thieves like a plate of fried clams (okay, we live in New England and I am hungry, so apologies if the analogy does not resonate…)
Concern 2-Deleted Teaching Files
Her teaching files are deleted from her computer. A bit of background here is in order, we home-school and she spends a significant amount of time preparing lessons etc. Her fear here can be translated to her files being held hostage via malware or being simply deleted.
Missing home-school files caught me off guard as did the medical records concern because while they are concerns of mine in a broader sense, I did not expect her to even be aware of those risk areas (score one for informal security awareness training!).
The downside is that I am now implementing a more comprehensive disaster recovery plan and system of backups here on our home network because of this concern. If 2+ decades of marriage have taught me anything, it is that if my wife mentions something to me, it’s for a reason.
In addition, I am trying to figure out how to ensure the local medical provider stops “helping us” by putting our medical records and those of our children on the Internet so we can activate their cool new service feature-a feature I am about as thrilled about as I am their new reminder service which calls my cellphone repeatedly through 11pm local time the night before an appointment (for anyone in the family.)
As technology advances and our reliance on it becomes more commonplace, is our failure to implement adequate levels security and place security demands on the software/applications we use a result of our laziness? Or is it because it is simply too complex and we don’t even know what to be really concerned about?
Could it be that once new programs are coded up, that the business drivers don’t allow proper time to review the security of program and the marketers and sales teams are giving the green light to start pushing the product instead of the production process? …deemed to be of “releasable” quality when in fact they are not?
The answer might not be so simple and it is as likely to be as nearly complex as the code behind the software/app you have or should have concerns about, as it is the human "I just don't have time for this" factor.
As for around our place, we are not quite ready for the "don't have time for this" side of things and will still be keeping a watchful eye best we can.
Consulting: Need independent analysis or security support? See AI & Cybersecurity Consulting.