Enormous effort goes into making people feel secure. However, do high-end technologies eliminate risk? Bruce Schneier, Chief Security Technology Officer for BT, explores how humans evaluate danger to feel safe.
Enormous effort goes into making people feel secure. However, do high-end technologies eliminate risk? Bruce Schneier, Chief Security Technology Officer for BT, explores how humans evaluate danger to feel safe.
With the global economic slump, increasing crime rates and terrorist threats, security has become a buzzword. Crime prevention has evolved from building a fence, wall or trench to something more advanced. Modern security solutions feature biometric access control, perimeter patrol through IR and thermal cameras and video analytics, all seamlessly integrated to protect assets. From fires built outside of caves to today's multibillion-dollar electronic security industry, security measures have changed over time, but the need for security remains the same.
In his speech "The Psychology of Security," Bruch Schneier, Chief Security Technology Officer for BT, argues that security is both a feeling and a reality. Only when security solutions fit reality can individuals feel truly secure.
Schneier cited burglar alarms as an example. Whether they are necessary depends on the homeowner's feeling of security and if they provide benefits such as lower insurance costs. Striking the right balance between feeling secure and being secure means not just safety, but business as well.
Trade-off
Security involves a balanced trade-off between feeling secure and being secure. Schneier said the best security trade-off involves evaluating the severity and probability of risk, the magnitude of costs, the effectiveness to mitigate risk and the balance between them.
Trade-offs involve money, time, convenience and liberties. Social, economical, biological and psychological factors impact how risks are evaluated. Inaccurate evaluations could put people in danger and waste resources, so correctly assessing security is essential.
Conventional Wisdom
People tend to base their security decisions on conventional wisdom, which does not always match reality. This is clear when the perception of risk does not match the actual risk. For example, people are often overly optimistic about their safety. In dangerous situations, they believe good outcomes are more probable than bad ones.
Schneier said people tend to underestimate risks they willingly take, while overestimating risks in situations they cannot control. He cited smokers who were less afraid of smoking threatening their health than they were of asbestos and other indoor air pollutants in their workplace. Similarly, people believe flying is riskier than driving, despite higher death rates caused by car accidents.
Risks exist, but an overall good feeling toward a situation leads to a lower risk perception. Because smoking, skydiving, snowboarding and surfing are pleasant, people tend to underestimate risks associated with these actions.
Furthermore, people are more afraid of new risks with high uncertainty compared to familiar ones, Schneier said. Since humans are creatures of habit, individuals are more likely to compromise security for something they are accustomed to — a 
lifestyle, a perception of security or some functionality in a product. This partly explains why new technologies meet with initial resistance, while proven technologies are more accepted.
Formation of Perception
In decision making, easily remembered data is given greater weight than something hard to recall. People are more easily persuaded by a vivid, personal story than by statistics and figures.
While imagining an outcome does not make it more likely to occur, it has to be within the scope of imagination. Therefore, events that have occurred are easier to imagine than hypothetical ones, resulting in the overestimation of certain events.
Security decisions are affected not just by experience, but by what people are exposed to, Schneier said. The modern media provides a steady stream of sensory inputs. While those events may not occur for most people, the impact they create could affect how security is assessed.
Conception and Reality
By understanding how security decisions are made, people learn to override their natural tendencies and not to be taken in by the mere appearance of safety. It is not only necessary to be protected but to feel secure as well. Schneier described the "security theater" of props, such as fake domes. While it may not make people more secure, it creates an illusion of safety. When applied correctly, the security theater could make someone feeling at risk less afraid.
However, this illusion of safety is no substitute for real security. If the security theater is used too much, individuals in great danger may not be aware of it. Only with real security does some well-placed security theater protect people and make them feel more secure.