Approaching Information Security Like Disease Prevention

This is an interesting article by Cory Doctorow that uses the analogy of teen sex and abstinence to explain why the traditional approach of information security just does not work.  My favorite quote:  "...you need to become an epidemiologist of your users' unsafe activity."

Like Teenagers, Computers are Built to Hook Up

He raises a good point that goes beyond the defense in depth model.  Just telling your users not to plug sensitive systems in to the internet doesn't work any better than telling teens not to have sex does.   They are going to do it (or not) for their own reasons, and expectations of blind obedience are naive at best.  

Computers (like teenagers) that are connected, but unprotected, will be at higher risk for unpleasant consequences.  The responsibility of the Information Security practitioners is to faciliate secure methods for people to get their jobs done.  In determining why people have connected these sensitive systems (and thus exposed them to the digital diseases found on the internet), better security can be achieved.