Security of any form is a system of trust. So what is trust? It involves delegation of authority - I allow you to act on my behalf - and it also implies an alignment of goals or interests, or at least an assumption of such. I believe that the actions you take on my behalf, or the actions you take that will affect me in some way, will be in my best interests, or at least will be a decent compromise I can live with.
Employers trust their employees to act as part of the company. Spouses trust each other to respect boundaries of online accounts or to treat shared finances with respect. Friends trust each other to keep private stories, pictures and other shared secrets private. In many cases, fear of social or professional repercussions are the limiting factor. If we violate this trust, we lose our friends, lose our jobs, put strain on our relationships.
A lot of the time, though, trust is a very difficult thing to codify into a computer system. Real-world trust can be very granular. I trust you in this area but not in that. I trust you only for about half an hour when left alone, and only if I lock up the petty cash. I don't trust either of you alone with these nuclear launch codes, but I trust you together to keep an eye on each other. What you can never account for is secret intent. If I have decided, on my own, that my employer of fifteen years is doing something corrupt and illegal, and that my best course of action is to take some evidence to outside authorities, how can you tell what I'm doing? If I normally copy certain documents every morning for work purposes, and today I'm copying similar documents in the same way but for untrusted purposes, the computer system won't know that, no matter how it is coded.
Mokalus of Borg
PS - Whistleblowers will always be a "threat" to corporations.
PPS - Personally, I think whistleblowers are a security feature for society.
No comments:
Post a Comment