Does Airport Security Actually Prove Useful? Possibly (in a twisted way).

I read Bruce Schneier's work, alot. I especially savor his insights on the psychology surrounding security systems and how humans interpret and react to threats both big and small, and respond by building security systems to protect us; how we misjudge and overreact to the rare and extreme threats while ignoring the more common yet mundane threats.

One commonly cited example of this is the post-9/11 response to terrorism and the implementation of airport security which is not actually making us safer. The TSA security procedures, "backscatter" X-Ray machines, and knee-jerk reactions to specific threats (such as a single instance of a weapon hidden in a shoe) that create new hassles for legitimate passengers.

But, I've also been reading Bruce's latest book, Liars and Outliers, where he explains how the human species grew intelligence to compete against primarily other humans, and learned to place self-interests aside (for the most part) in order to cooperate with the interests of the group. This requires trust in one another, and at varying group sizes (starting small, and eventually growing larger and larger) requires social pressures to keep the defectors (those favoring the self-interest over the group-interest) to a tolerable level.

These social pressures come in various forms and work at various group sizes. As our society and group-sizes have grown larger and larger over the centuries, we have developed different methods of influencing human behavior to cooperate with one another and forgo the self-interest. And each time our group-size gets larger, our definition of "trust" takes on new meaning. In small group sizes, we trust the intentions of the individual; we know them at a more personal level. These are the Moral and Reputational pressures. As group sizes get larger, we become increasingly disconnected from the others whom we must place trust in; we are forced to trust their actions will be cooperative in the group-interest because we don't know their intentions. This is where Institutional pressures and Security Systems come into play.

To quote from 'Liars and Outliers':

The most important difference among these four categories is the scale at which they operate.

• Moral pressure works best in small groups. Yes, our morals can affect our interactions with strangers on the other side of the planet, but in general, they work best with people we know well.
• Reputational pressure works well in small- and medium-sized groups. If we're not at least somewhat familiar with other people, we're not going to be able to know their reputations. And the better we know them, the more accurately we will know their reputations.
• Institutional pressure works best in larger-sized groups. It often makes no sense in small groups; you're unlikely to call the police if your kid sister steals your bicycle, for example. It can scale to very large groups—even globally—but with difficulty.
• Security systems can act as societal pressures at a variety of scales. They can be up close and personal, like a suit of armor. They can be global, like the systems to detect international money laundering. They can be anything in between.

Therefore, going back airport security, we cannot trust the large majority of society on a global scale using moral or reputational pressures. Institutional pressures become ineffective since they are enforced on a largely national basis, and terrorists are not deterred by such pressures. We are left reliant on security systems alone to base our "trust" of the aviation system.

But... could this "security theater" at airports actually be preventing the complete breakdown in trust in the aviation system, even if it proves woefully ineffective as an actual security mechanism? If the majority of society lost trust in aviation safety, would there be a mass-exodus of passengers? Would the airline industry completely crumble?

Perhaps our government's post-9/11 anti-terrorism actions, including the ineffective security systems and procedures instituted by the TSA, actually DO serve a purpose after all. They keep passengers re-assured that they are reasonably safe while flying; they pacify our human minds which over-exaggerate the true risk of terrorist attack on airplanes. I'm not justifying these measures as making us safer, just keeping the industry afloat by managing public "perceptions" of airline security.

This is just something I've been pondering...

Cheers,
Andrew

Vendors Need To Focus on Creating Value for Customers and Making Great Products

Have you heard of ‘Maslow’s Hammer’? This phrase originated with Abraham Maslow in his book, The Psychology of Science, in 1966. The saying goes something like this:

If the only tool you have is a hammer, everything looks like a nail.

Sometimes, actually quite often, technology vendors seem to fall into this trap. A trap where they get so enamored with what they’ve already built, which filled a previous need, that they forget that customer need are always changing and their solutions need to continue to adapt. (BTW, I hate to throw around the term ‘innovation’ in such scenarios. I believe true innovation is rare, and the term gets used way too often. So, I’ve dropped innovation from my vocabulary… mostly.)

Often times this adaptation requires critical thinking and a fundamentally new approach in order to solve a new problem. But change is hard. Vendors who get stuck in this trap attempt to take the path of least resistance, which often means incremental improvement of existing products that only half-solve the problem. There could be any number of reasons for this: too few development resources, constraint of existing product (e.g. painted themselves into a corner), time to market, lack of expertise on staff to truly understand and solve the problem (which is ultimately just a failure to invest and hire additional resources), or possibly the worst one of all – market dominance where short-term sales likely won’t suffer. However, long-term sales will definitely suffer if this problem becomes systemic and they continue to lag behind competitors. For reference look at what happened to DEC, Xerox, IBM (twice), and what is currently happening to both HP and Microsoft if they don’t pull it together.

This quote from Steve Jobs – The Lost Interview touched on precisely this:

If you were a product person at IBM or Xerox, so you make a better copy or a better computer, so what? When you have a monopoly market share the company is not any more successful. So the people that can make the company more successful are sales and marketing people and they end up running the companies and the product people get driven out of decision making forums. And the companies forget what it means to make great products.

So how does this relate to Wi-Fi? The rapid market evolution and change is hard to deny in the network industry these days, and the rate of change is especially staggering in Wi-Fi. Demand for new solutions and capabilities to enable both businesses and consumers abound.

Unfortunately, some vendor features are shoe-horned solutions into existing products in ways that just don’t make sense for customers. Essentially, viewing the problem as a nail so they can use their existing hammer (instead of realizing the problem is really a bolt and they need to develop a bolt-driver). What do I mean? Here are some examples of late:

• Meraki  Layer 3 Roaming – using their MX firewall security appliances to facilitate Wi-Fi layer 3 roaming. Why would I want to hitch my WLAN architecture and design to a firewall appliance? They have completely different objectives and scope of deployment in the network. What this really does is allows Meraki to offer layer 3 roaming on a feature list, and try to sell more firewalls.
• Cisco Bonjour Support – relies on existing multicast support and VLAN Select to facilitate Apple Bonjour service discovery across subnet boundaries. There are many reasons why I don’t like this implementation approach, including: requiring multicast expertise to enable Bonjour in the network, limitation of a single Bonjour source VLAN rather than any-to-any connectivity across subnets (tell me, what organization can aggregate all Bonjour devices that should be accessed into a single VLAN? Very few small networks), lack of Bonjour protocol intelligence which means they can’t filter services or tie access to defined policy, and requiring all Bonjour subnets to flow through the controller which prevents all edge wired subnets throughout the network from accessing Bonjour services (and edge wireless subnets if using Cisco’s FlexConnect / H-REAP architecture).

Do these implementations add features that they can list in their product marketing material? Yes.

Do these implementations really address customer needs or create value for customers? Only partially, in my opinion.

Hopefully this post will enlighten customers on this issue and make clear the need to thoroughly examine vendor offerings and their approach to solving your needs. Don’t simply take vendor marketing material at face value. Sure, they may have a check box next to a feature buried in a laundry list of other features, but that abstracts how they implement the feature, how robust their capability actually is, and what caveats/drawbacks exist. This is NOT a land of black and white, folks. Lines are blurred, shades of gray exist, and deciphering all this and making an informed decision are tough.

As a customer, you will not be able to go into the depth required on every product feature to make a 100% informed decision. But you SHOULD be able to identify the critical features for your specific environment. Go into depth on those features, find out the nitty-gritty details, and make a decision that makes sense for your business. Vendors have various strengths and weaknesses, areas where they are leading the market and areas where they provide only the basics. Often a customer decision comes down to a few key features that really make a difference and create value for their business. Focus on those items.

My point here is NOT to call out any one vendor on this topic; I think every vendor is guilty of it to some degree. Rather it is to call on vendors to step up their game; to focus on creating value for customers rather than selling them a bill-of-goods. I don’t think this is always happening, and quite-frankly it’s frustrating to see poorly implemented solutions being sold on the market to customers. It’s likely that this will never be eliminated – market competition and dynamics dictate some level of this to continue happening. But customer influence and buying pressure can minimize the frequency.

In short :

Vendors –  let’s build great products!

Customers – let’s be informed to ensure the solutions purchased create value relative to the business needs!

Cheers,

Andrew vonNagy

Full Disclosure

Most of my readers should know that I work for a vendor now, Aerohive Networks. If you didn’t, now you do. Are we perfect? By no means. But I do think that Aerohive has a greater focus on creating value for customers and solving their business needs than most other vendors (e.g. Bonjour Gateway for BYOD, MDM integration for mobile device support whether BYOD or corporate issued, TeacherView for education, SIP2 integration for libraries).

Am I biased? Yes, partially. But I also believe that everyone is biased for or against certain products or companies based on their experiences.

Am I independent? Yes, partially. But I form my opinions based on my experiences as an engineer, not as vendor-drone who recites marketing material verbatim.

I only speak or write what I truly believe to be true based on my own personal analysis. I try to be as objective as possible, with sound evidence and engineering behind my positions. And I’m open to discussion, which I think is key. I will change my opinion of sufficiently convinced based on evidence (not conjecture). I will admit that I’m wrong. Heck, I’m wrong all the time. But that realization and openness to change on a personal level is why I still consider myself of independent thought. I hope you value my opinion, whether you agree or disagree with my positions. And if you disagree, let’s have a meaningful discourse on the topic.