Opinion: Better than locks: A security approach to 'free'

Comments

Related

Active Comments

Ed Gerck says: Geoff writes "We understand trust". But it does not look like it, at least for Geoff. Trust cannot be communicated...

Read the rest | Reply

Anonymous says: Your quip "Someone wants your data, and it won't hurt you? Fine, give it to them! Give it willingly, give...

Read the rest | Reply

All Comments (2) | Post New

• Too good to ignore: 6 alternative browsers
• 7 ways to cut your software costs during the economic downturn
• Major e-stores malfunction on Black Friday and Cyber Monday
• MIT researchers boost the power of solar energy
• Netbooks: small, cheap -- and fast?

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

May 30, 2008 (Computerworld) In January, Kevin Kelly wrote an essay entitled "Better Than Free" that explained which concepts held value on the Internet. This generated a lot of interest, mostly around the question of how best to make money out of these concepts. As a career security guy, I found myself wondering how on earth my field will respond -- how does security need to adapt to support business models based on these values? When we're used to locking everything down, how do we respond when people start calling for openness?

Kelly's essay set out one of those ideas that sound completely obvious once you've heard them: When something that can be copied comes into contact with the Internet, copies soon become freely available. And when copies become free, you need to sell something that can't be copied. That is, of course, a very brief summary of an elegantly stated argument; I urge you to go and read his original essay. It's a great read.

Kelly goes on to explain eight "generatives," things that can't be copied and so still hold value on the Internet: Immediacy, Personalization, Interpretation, Authenticity, Accessibility, Embodiment, Patronage, and Findability. You may not want to pay for that mp3 that you can download for free, but you might pay to be able to have it right now, to have a copy tweaked to sound best on your audio setup, to have the lyrics translated into your language, to know it's the real thing, and so on.

So what do we need to do? How does security adapt itself to these generatives?

The answer is that we need to do more than you might expect. Except for his principles of Embodiment and Patronage, that is: people may pay for a physical copy of something (embodiment), or for the joy of supporting a particular artist or designer (patronage), but there's little that security can do to help there except get out of the way. But in each of the other areas, security has a big part to play, whether to directly help generate revenue or as a supporting role. Let's take them one by one.

Trust. Kelly passes over trust briefly, and doesn't include it as one of his generatives. But he does acknowledge its importance and rightly so, because trust underpins most successful transactions. When buying online, I won't give my credit card details to a company I don't trust, and Paypal made a lot of money out of realizing that people feel that way. When buying financial products, I'll deal with a big bank in a regulated market that I trust rather than a niche company based in a small country that I can't find on a map.