Awareness: April 2006 Archives

In the April 2006 Information Security Mag (free subscription required) Marcus Ranum and Bruce Schneier have a Faceoff on User Education. Actually they dont have much of a faceoff since they both agree that security education has not helped.

Ranum, "Security practitioners have shouted themselves hoarse trying to educate users. But has it helped? Obviously, no: Phishing scams are still raking in money, viruses are still spreading, and countless users continue to use their cat's name as a password for their online bank account. In fact, it looks like the situation is getting worse rather than better."

Schneier, "I've met users, and they're not fluent in security. They might be fluent in spreadsheets, eBay, or sending jokes over e-mail, but they're not technologists, let alone security people. Of course, they're making all sorts of security mistakes. I too have tried educating users, and I agree that it's largely futile."

You'd think they've have a counterpoint from one of the security awareness companies.