If you have ever dealt with computer security for any group or business, you are probably very familiar with the never-ending battle between setting computers up for security or for usability. So which way do you go? Well, from the looks of a study done in Australia, it seems that both sides of the debate are losing the battle.

“Usability of security software is partly to blame for low protection levels in many computers, according to international security experts.

In a panel session at this year’s Australian Unix Users Group (AUUG) conference in Melbourne yesterday, software security developers gave reasons why the IT industry is still at the mercy of so many problems.

University of Auckland computer scientist Peter Gutmann said many security standards were written 10 years ago and have mostly just been tweaked since then.

“A lot of the security stuff is designed by crypto geeks [and] because of a lack of usability, people can’t apply them correctly,” Gutmann said, adding usability is just as important as “having a bunch of crypto and let people figure it out from there”.

Gutmann said the protocols were designed without usability and even if a user-friendly GUI could be put over it, it is unlikely the original developers would accept it.

“They would rather have 100 percent perfect software that’s unusable than 99 percent perfect software that is usable,” he said.

OpenBSD developer Ryan McBride, who works on packet filter and IPSec code, lashed out at intrusion detection systems, saying the technique has no way of detecting whether a virus is attacking a network.

“I do IDS work in a Fortune 50 company and it’s a case of ‘oh look, another box has a virus - go turn it off’,” McBride said. “It’s very hard to automate turning things off in security.”

McBride said IDS isn’t the place to solve the problem, but inside the software is.”

Read the rest of the article HERE.

This is always a difficult area to deal with for anyone in security. Unfortunately, it is not getting easier either. We believe the best avenue to approach in this manner is to find an optimimal balace of the both with the budget you have been allocated.

Tags: Computer Protection