Painted by John Taylor of the Painter-Stainers' Company in 1610
What have Shakespeare’s sonnets and InfoSec policy statements got in common? They are both written in impenetrable language. They are both often presented in a context outside the user’s understanding and therefore can appear largely irrelevant and are likely to be ignored. What is potentially worse is that parts may be repeated so often that they are learnt and operated in a rote way; just the way we did with Shakespeare at school. An example of this would be the oft quoted Sonnet 18, which I am sure we all know the first line.
“Shall I compare thee to a summer’s day?”
But who remembers the rest of the piece? Most people think The Darling Buds of May simply involved a young Catherine Zeta Jones and David Jason with a speech impediment. The danger here is that people assume as they remember the most repeated part of the policy, for instance password strength or change protocol, that they are not alert to the more complex and technical parts of the policy or what happens when policy changes and the implications of those changes. As mentioned above, if the language is unfamiliar, we will also run into comprehension problems, in Shakepeare this might be the use of words such as thou, hath or ow’st. In InfoSec policy this is the equivalent of overly technical language.
Awareness of InfoSec issues is not about rote learning or about tick box training. It is about engendering a state of mind in the user population for a state of eternal vigilance. To this end, firstly the policy wording must be clear, but secondly we also need to get the users to spot new and unusual behaviours and potential exploits and attack vectors as we struggle to keep up with a constantly shifting world. Initiatives such as the Analogies project attempt to breach this gap between policy and practice, between theory and understanding, between education and behaviour.
In an attempt to reinforce the point about impenetrable language, I have taken the original sonnet 18 and offered an alternative interpretation in more modern and accessible English. The goal of the Elizabethan social engineer may only have been to secure the lady’s hand and with it her virtue. I think today the stakes might be slightly higher even though the attack vector still employs flattery.
Sonnet 18
Shall I compare thee to a summer’s day?
Thou art more lovely and more temperate:
Rough winds do shake the darling buds of May,
And summer’s lease hath all too short a date;
Sometime too hot the eye of heaven shines,
And often is his gold complexion dimm’d;
And every fair from fair sometime declines,
By chance or nature’s changing course untrimm’d;
But thy eternal summer shall not fade,
Nor lose possession of that fair thou ow’st;
Nor shall Death brag thou wander’st in his shade,
When in eternal lines to time thou grow’st:
So long as men can breathe or eyes can see,
So long lives this, and this gives life to thee.
Sonnet 18 – revisited
Alright gorgeous, you really are something,
been on the TV? Or a soap maybe?
it’s spring and the temperature is rising,
You know how short our summer tends to be.
I guess you must get bothered quite a bit
by blokes who simply want to try their luck
and offer you the world; you have your wit
and your intelligence; if I could pluck
up the courage, together we could flee,
what is the worst that could happen; your face
will trend on twitter, immortality
is yours for the taking and no disgrace.
As I give all that passion can afford
Share with me your username and password.
