The Psychology of Security

Bruce Schneier has an essay exploring the psychology of security [PDF] posted on his site. In it, he points out that we're rather irrational beings who are driven by primitive motives buried in our psyche. Most of the time. we're unaware of our subconscious biases -- yet, those biases play a large role in the decisions we make on security -- security of our businesses and our computer systems. We can be driven by fear or the optimism bias. With fear, we tend to exaggerate the risks, and tradeoff freedom and flexibility, for more security. With the optimism bias, we tend to think that the worst would never happen to us, but rather to someone else, and tradeoff security, for freedom and flexibility. Being aware of the irrational responses to security is fairly important, in order to know when your fear or optimism bias are being manipulated by those driven by their own agendas. It's also important for you to know that you have irrational tendencies -- and perhaps, being aware, use facts and logic to dictate your response to security issues.

On a related note, check out this Wired article on how fears can be manipulated.