Fort Knox with a Broken Fax Machine
The Ritual vs. Real Security
This is the theater of security. We build digital fortresses with moats of encryption and drawbridges of multifactor authentication, and then we forget to give the guards a working key.
The ritual of security becomes the goal, not security itself. The performance of safety becomes more important than actual safety.
And every employee who has ever sat on hold with a helpdesk, watching a deadline evaporate, knows exactly what this feels like. It’s the sensation of being treated like the enemy by your own defenses.
The Post-it Note Problem
“
I’ll confess, I used to be a zealot for this kind of thing. I once designed a password protocol for my team that I was immensely proud of. It required a 24-character minimum, a mix of four different character types, and a mandatory rotation every 34 days. I thought I was a genius. I had built an unbreachable wall.
– The Author
A week later, I noticed something. On the edge of nearly every monitor was a small, colorful Post-it note.
I hadn’t made the data safer; I’d just moved the point of failure from a server to a piece of paper, making it infinitely more vulnerable. The system was perfect. The humans, predictably, routed around the damage.
Zephyr D and the Real World
This is the fundamental flaw in our thinking. We design systems for a hypothetical, perfectly logical user who never gets flustered and always follows the rules. We don’t design for Zephyr D.
Zephyr is a bridge inspector. He doesn’t work in a climate-controlled office with stable Wi-Fi. He works out on the steel skeletons that span rivers and gorges, where the wind can steal a hardhat and the cell signal is a prayer.
His job is to find the hairline fractures, the corroded bolts, the subtle signs of metal fatigue that could lead to disaster. His work is tangible. The risks are real and measured in tons of steel and human lives.
One afternoon, he was 234 miles from the nearest office, standing on a catwalk beneath a major highway overpass. He needed to access the latest stress-test schematics, which were, of course, stored on the company’s secure server. He pulled out his ruggedized tablet, connected to his mobile hotspot, and tried to log into the VPN. ‘Please enter the code sent to your device.’ He waited. No code arrived. He was in a reception dead zone. He tried again. Nothing. He called the IT helpdesk. You know the story. Hold music. An estimated wait time longer than his remaining daylight.
So what does Zephyr do? Does he pack up and drive four hours back to the office, forfeiting a day of crucial inspection? Of course not. He has a workaround. In a locked case in his truck, he keeps a USB drive. On that drive are copies of all the schematics he might need for the quarter. It’s not encrypted. It’s not password protected. It’s a plain, simple storage device. It is a gaping security hole, a direct violation of company policy, and the only reason he can effectively do his job.
Our security policies created that USB drive.
(The ultimate workaround)
The Human Problem, Not the Technical One
We are so focused on preventing the front-door assault that we force our own people to dig escape tunnels. They aren’t malicious. They’re resourceful. They’re just trying to get the work done that we pay them to do. It reminds me of something a supposed master locksmith once revealed.
“
He said the most sophisticated maglocks and alarm systems are a fun challenge, but the easiest way into almost any corporate building is to walk in with confidence during lunch hour, holding a cardboard box and looking slightly annoyed.
– Master Locksmith (Supposed)
Security is often a human problem, not a technical one. We build technical walls to solve human challenges, and it rarely works.
Simple Solutions: Zephyr’s POE Camera
Zephyr’s frustration with the digital world has made him a purist when it comes to the physical one. He fought for months to get his superiors to understand that the complex, cloud-based surveillance system they wanted for his remote sites was a terrible idea. “Another password I’ll have to reset from a place with no signal?” he’d argued. Instead, he showed them how a simple, hardwired
pointed at a critical access hatch gives him a reliable, instant view without a login screen designed by a committee. It just works. It solves the actual problem-knowing if someone unauthorized is trying to access a restricted area-without creating four new ones.
A simple, hardwired connection for direct, reliable monitoring.
The Real Threat
We have to stop building these beautiful, impenetrable fortresses with broken fax machines inside. The fax machine is the outdated assumption that locking things down is the same as keeping them safe. It’s the belief that friction equals strength. But in reality, every bit of unnecessary friction we add to a legitimate user’s workflow is a design flaw. It’s an incentive for them to find a workaround.