Safecracking for the Computer Scientist

Matt Blaze of the University of Pennsylvania CompSci department compares physical security [PDF] of locks protecting safes to computer security of systems protecting information in this draft paper. He concludes that information security has a long way to go and lots to learn from the world of physical security.

"Physical security has been studied for far longer than information security, of course, and the tradeoffs between resistance to attack and the cost of protection are relatively well understood. The situation in computer security is quite different, with new mechanisms, attacks, countermeasures, and threat models being invented and made obsolete in a dizzyingly fast cycle that lacks the luxury of generations of hindsight.
There is much that information security can learn from physical security, and a careful study across the two disciplines should strengthen both of them."

For those who don't recognize the name, Blaze has one that irritates a lot of software vendors, for he has a knack of pointing out in gory detail, the vulnerabilities with their systems. With this latest paper, Blaze continues his foray into physical security and will annoy a new set of people by studying and publishing reports on their vulnerabilities. In fact, if you want to learn how to crack safes, this paper does provide the gory details. The point is however, not to annoy people, but fix the false sense of security that comes from "embracing the security through obscurity."