In the Science Fiction novel "The Puppet Masters" by Robert A. Heinlein, alien creatures with the ability to connect to humans nervous systems invade the Earth. This novel was made into a terrible, horrible movie so if you have seen the movie but not read the book, please go read the book. And burn any copies of the movie you can get to.

But back to the book. It's a pretty typical "alien possession" novel by current standards, but it was actually a significant publication in 1951. The aliens themselves are relatively small things with limited mobility (they are dubbed slugs), but can attach themselves to a victims neck and hang down the back. The "slug" can then control the human and tap into their memories, while remaining hidden under the clothing. As the novel progresses, the protagonists (Sam and Mary, who both work for a secret intelligence agency of the US) withdraw to the mountains. After being attacked by an alien slug, they return to the city to discover a law has been passed requiring full nudity.

Correct, the only way to tell if a human was possessed was to require full nudity. Heinlein established that even a naked woman carrying a purse was suspect because she kept her hand in her purse which allowed her to remain connected to the slug. Now, part of the reason Heinlein wrote this solution into his novel is because he was a big fan of nakedness (hardly any of his novels don't mention it). But also because it's the obvious, simple solution to the question "How do I know if you are really you?". The slugs were too big to not be visible and obvious when attached to a victim.

Now, the $1.69 question: Is this a reactive security measure, or a proactive one?

Thanks to Richard Reid, we now have to take our shoes off at many airports. And most likely, we'll have much more invasive body scans to look for hidden explosives (even though there's no evidence such a scan would have caught Nigerian Abdulmutallab's hidden explosives). These are reactive security measures. Why? Because even looking at a person stark naked, you cannot tell if he or she is a terrorist. "The Puppet Masters" has a specific threat that can be visually identified and is known to be hostile to humanity. So the nudity solution is actually rational, if socially awkward. No such test exists for humans that intend harm to other humans.

This does not stop the TSA and law enforcement to follow profiling methodologies, unfortunately. Many innocent citizens are taken aside because of their religious beliefs, skin color or "atitude". Timothy McVeighs', Richard Reids' and Umar Farouk Abdumutallab's lesson have not stuck: Terrorism is an action, not a kind of person, a belief system or a clothing style. Most of the security measures taken in airports and on airplanes since 9/11/2001 have been reactive, "security theatre" then actually proactively useful.

So what proactive security measures should be taken in the wake of the failed Christmas Bombing? Move security screening back to boarding gates. Improve the intelligence gathering and sharing community. Train more air marshals and put them on more flights. And most importantly, stop wasting resources on reactive measures.

Part of Information Security is not making assumptions. You don't assume that computer systems are safe, you check them. Even if they were safe when you checked them, you check them again months later to make sure they are still safe. This sort of regular assessment is no different than security guards making regular rounds in an office building late at night. Such as at a bank.

When something suspicious is discovered during a systems check or pentest, you investigate it in order to verify that what was found is what you think it is. Evidence of a server break-in needs to be checked carefully before one goes blurting out "We've been hacked!". Just like a bank doesn't say "We've been robbed" because some accounting numbers don't match-up.

Such verification and re-verification on a regular basis can sometimes seem like paranoia. But paranoia is the unreasonable sense of persecution. Banks have ample reason to be concerned about their security, as there is a long and rich history of criminals robbing banks. However, there is a point at which one may indeed have to ask oneself, "Am I being too cautious?"

Such is the case with the bank that Blue Moon Fiber Arts signed-up with for processing credit-card orders for their "Sock Club". A sock club is, for those of us who are ignorant of the textile arts, is a knitting hobby club where you pay a yearly fee in order to receive monthly kits. Yes, it is a sock subscription, and you have to assemble the socks yourself. For people who like to knit, this is fun (as I am told).

When Blue Moon Fiber Arts started their 2007 Sock Club, they needed a bank to process credit card orders (as doing it without a bank is much more expensive and complicated). The bank was suspicious (or maybe just initially surprised) at the volume of orders. The bank contacted Blue Moon, which explained the purpose of the orders and the business model ("Customer gives money, customer gets product!" I suspect sums it up). For whatever reasons, the bank decided that it was improbable for large numbers of people to be interested in knitting socks, never mind spend lots of money on it. So the bank refused to process any more orders, canceled all the existing charges and refunded the money.

I can only guess as to why the bank did not take this further and attempt to involve law enforcement. Without more details, I can only assume the bank just didn't feel like it was confident enough to involve the law, but was suspicious enough to pull-out of the situation entirely. In the end, Blue Moon Fiber Arts found a bank that would process the credit card orders, and all the Blue Moon folks had to do then was send out a letter explaining what happened.

The consequences of overzealous security in this particular case were trivial. One bank lost a customer and another bank gained a customer. Some people were forced to re-sign-up for a sock club and a lot of knitters got justifiably angry at the sheer stupidity of the situation. Yet the consequences can be much more severe. What if a person staked all of their savings on a new business venture, and the first week of business the bank decided no one could possibly want to buy the product or service, and yanked all ability to deal with credit? Someone could literally lose everything they owned, because a bank manager simply made some assumptions.

Banks are of course only one  entity that needs information security. Media companies must protect their copyrights, engineering firms have patents to guard and software shops are very much dependent on both copyrights and patents. Failing to enforce those rights could lead to rampant piracy, yet overbearing enforcement often leads to alienating fans, false accusations and some very nasty, drawn-out lawsuits. There are many cases on record where lawyers making assumptions have caused more harm than good for their corporate clients, including Microsoft, SCO, Intel, and another random bank.

 In the end, it is up to each organization to make its own judgements in these matters, as there can never be any absolutely objective method to measure the risk involved in not being cautious. And each organization should be prepared to face the possible consequences of their actions.

From this Yahoo! article:

He was sympathetic, but accepted the Transportation Security Administration's reasons for the ban.

"What are you going to do?" he said. "I guess you have to be safe."

Amanda Volz, a TSA screener in Minneapolis, said she hoped more travelers would take that attitude Friday.

"There's some moaning and groaning, and a few people who get angry, but once you explain it to them, they are more lenient about giving it up," Volz said. "You just try to make them understand that it's for their safety."