Myth 6: "High Security" Is an End Goal for All Environments

High security, in the sense of the most restrictive security possible, is not for everyone. As we have said many times by now, security will break things. In some environments, you are willing to break things in the name of protection that you are not willing to break in others. Had someone told you on September 10, 2001 that you needed to arrive three hours ahead of your flight at the airport to basically be strip-searched and have your knitting needles confiscated, you would have told them they are insane. High security (to the extent that airport security is truly any security at all and not just security theater) is not for everyone.

The same holds true of information security. Some systems are subjected to incredibly serious threats. If they get compromised, people will die, nations and large firms will go bankrupt, and society as we know it will collapse. Other systems are protecting my credit card numbers, for which I am liable up to $50 if they get compromised. The protective measures that are used on the former are entirely inappropriate for the latter; however, we keep hearing that "high security" is some sort of end goal toward which all environments should strive. These types of statements are an oversimplification that contributes to the general distrust and disarray in the field of information security today.