Security and Safety

My colleagues and I had an interesting debate on the difference between security and safety today. Security is the objective mechanisms to protect valuable asset from internal or external attacks. The attacks are intentional, not naive mistakes. Security mechanisms include security policies and security controls. Security controls can be preventive - block attacks from causing damage, or detective - identify attacks and the damage they cause. Safety is the subjective “feeling” of being protected. Someone feeling safe means that they feel they are protected from: 1. Internal or external attacks using security mechanisms. 2. Naive mistakes from themselves using safety measures. In a way, security is the mean and safety is the end. But feeling safe needs more than just security controls. For examples, when we put locks on our doors, that is a preventative security control; when we put video doorbell from ring.com on our doors, that is a detective security control. When we build handrails on our staircase, that is a safety mechanism. Handrails are built with reasonable height to prevent us from accidentally falling down the stairs. But handrails cannot prevent someone from intentionally jumping off the stairs. In information security, when we enforce certain mutations of a system must be done under a multiple-party quorum, where each party must sign the mutation commands with their digital signatures, this is a preventive security control. If we build the security system using Reference Monitor model, the multiple-party quorum control ensures that all mutations of the system must be authorized by the quorum, which are cryptographically verified. When we build “guardrails” in our tools for the mutations, we want to prevent ourselves from accidentally terminating the system, that is not a security control for preventing attacks, rather it is a safety control to protect ourselves from unintentional mistakes, and limit the blast radius of such mistakes. The important thing about security controls is: “We try to remove human judgment out of the security controls - because human is always the weakest link. Instead we rely on objective mechanisms that are enforced, cannot be bypassed, and can be independently verified.” Since “safety” is ultimately a subjective “feeling”, we have no choice but to leave some room for “human judgment”. To someone who have no clue of cooking, the kitchen in their house can be a really dangerous place, with all the knives and stoves. But most people feel quite safe in their kitchen, because they eventually figure out how not to cut their fingers with the knives. The moral of the story: When we introduce controls in our tooling and process, we need to articulate they are security controls to prevent intentional attacks, or safety controls to prevent unintentional mistakes. Human judgment plays very different roles in these two types of controls.