"Complexity is inversely proportional to security"

We have really smart customers. Let me take up a blog post to point out one example.

A while back, Chuck Deaton, IT Security Manager at Humana, joined us for an SSPA webcast entitled “Remote Support: How Secure Are You?”

Among the nuggets of wisdom in that hour was this one from Chuck Deaton: “Complexity is inversely proportional to security.” Deaton goes on to explain that for Humana, often the security question is not about how to keep hackers out, but how to give authorized users the ability to perform authorized tasks.

Humana’s answer to the problem, at least in part, has been to simplify access and control as much as they can. Deaton says,

“. . . you can have the most hardened system in the world, but if it has too many moving parts and pieces, it won’t take very long for it to become unsecure or unreliable. And so therefore, we try to keep things - and remote control’s one of those - we try to keep those solution sets as simple as possible in terms of the moving pieces and parts, also in terms of the number of people and companies that are involved, so that we can maximize our security potential, not only initially, but also throughout - ongoing throughout the use of the technology by various user communities. So the - this whole idea of the ratio of complexity and security is really how we size up our ability to secure information assets or systems in general.”

Chuck Deaton, IT Security Manager at Humana

Here’s an example: You can set user permissions in one place, LDAP for instance, and have those permissions apply for various applications. Doing that will better enable you to maintain security over time. If user permissions are localized, rather than centralized, you’re likely to run into a security issue when one user’s overarching permissions fail to apply to a specific application.

Simple is better. One place to set user access and control permissions.

Deaton has, of course, taken a TON of other measures to ensure security. I just wanted to point out the simple-is-better approach as a stroke of genius.