The CYA Application Security Model

The CYA Application SecurityModel is the practice of implementing so-called securityobstructions primarily to absolve the vendor from blame ifsomething goes awry during everyday operations. This model isusually sold under the pretense of improving user education,or encouraging safer application usage, but that’s of minimalactual concern (in reality the opposite outcome — more riskyapplication usage — is probable).

An example of the CYA ASM in action is one that pops up aseemingly endless stream of confirmation “Are you really sure you want to do that?“dialog boxes, warning the user against doing what should be completely normal, benignactivities.

This pestering, progress-inhibiting assault of a millionwarnings and confirmations application behaviour is certain to cause the user to enable a”turn off all security“mode (for instance adding every site to “trusted sites” in InternetExplorer), paradoxically making the security situation infinitely worse, but for the vendorthis often the desired outcome: At least then they can smirk andblame it on the userbase if what should be a harmless activitycompromises their machine.

Didn’t you heed the “The Internet could be harmful tosecurity!” dialog box when you attempted to connect to theinternet?