Facebook Exec: Security Researchers Not Doing Enough

According to Facebook's head of security Alex Stamos, the security industry needs to do more to solve problems that affect ordinary people in their everyday lives. He says researchers are often too obsessed with technical detail because they lack empathy.

Stamos spoke at Black Hat, a conference that brings together security professionals, researchers, self-described hackers and those with an interest in the topic. (Source: bbc.co.uk)

He said the security community had proven justified in many of its warnings about flaws in systems and networks, but that it hadn't done enough to find solutions that made a difference to most people. (Source: ft.com)

Researchers Too Worried about Trying to Impress

According to Stamos, that's partly because researchers are too concerned with giving dramatic presentations to amaze their peers and that the emphasis is more about showing off their own knowledge and understanding, rather than it is dealing with everyday security issues.

In particular, Stamos argues, researchers concentrate on the most complicated and sophisticated hacking attempts carried out against organizations and even governments, rather than the more mundane threats.

Stamos says one reason for this is that many security researchers come from similar backgrounds and don't give much thought to the way the population at large uses technology. For example, Stamos says other security experts he has spoken to often blame ordinary users for making security errors and making themselves more vulnerable to attacks.

Solutions Should Work for Ordinary Users

In Stamos's view, researchers need to understand that most people don't share their level of interest or knowledge in technology. It's also not realistic to expect them to act properly to protect themselves online all of the time. Instead, he thinks more should be done to make security systems and tools easier to use.

He also suggested that the industry bring in more people from a diverse background: not just in terms of demographics, but also in seeking the views and ideas of people who aren't life-long 'techheads'. That could make it easier to both identify the security risks that affect people from day to day and to develop solutions that people could effectively use, even if they don't fully understand how technology works.

What's Your Opinion?

Do you agree with Stamos's arguments? What topics would you like security researchers to concentrate on? Could the tech industry offer better incentives to solve everyday threats rather than work on the most dramatic and technically impressive flaws and fixes?