Jan Schaumann on Security vs. Safety in Software

Great lesson from Jan Schaumann’s 2016 presentation at Velocity NY 2016.

A system is secure if it protects the user when used correctly. A systems is safe if it protects the user when used incorrectly.

. . .

When was the last time you started your automatic car while in gear? Or took the car keys out while the motor was still running? In most cars, you can’t. You have to be in ‘park’ and you have to have the break engaged to start the car. To take the keys out, your motor has to be off, and to turn off the motor, you have to be in ‘park’ or ‘neutral’.

This is how we should build software: safe defaults that make ‘incorrect’ use impossible. What’s even better about poka-yoke design: it shapes behaviour and builds habits. You probably don’t even think about putting your foot on the break to start the car, but you do it.

Changing undesirable habits is hard, but building new habits is not. Habits are your kick-ass lever to move your world. Habits are what build desire paths, and the habits you want to encourage will steer the people to walk the paths you designed for them.

Leave a Reply