Security analogies: the key to educating laymen

As I've pointed out many times, those who have knowledge about computers and security - in other words, you, [YES - YOU] the person reading this column - need to educate the ignorant, which is everyone else. Some good analogies can be an effective tool, perhaps an incredibly effective tool.

Imagine that I decide that I want to make Aubrey's life extremely difficult. I ask all twenty of you to each talk to 20 friends, and spread the following plan: at exactly 10:02 p.m. tomorrow night, everyone call Aubrey's phone number over and over, as fast as you can, for an hour. If she picks up, hang up and dial again. If it's busy, hang up and dial again. Don't stop! Keep the calls going for an hour straight! Now, what's going to be the effect from Aubrey's perspective? Her phone is going to be completely useless. She's going to be so busy responding to her phone ringing that she won't be able to do anything else, and she sure won't be able to make any calls. We'll have completely tied up her phone.

Now imagine if I controlled hundreds or even thousands of computers, and I commanded them all to make requests to another computer at the same time. But unlike humans, which are pretty slow, I could tell these computers to make thousands, tens of thousands, or even hundreds of thousands of requests each second. What would the effect be on that computer trying to field all those requests? About the same effect that all our calls made on Aubrey's phone: it renders it effectively useless. That, in essence, is a Distributed Denial of Service attack. Any questions?

Read the entire article HERE.