Security-Convenience Trade-off
Security measures impose friction by restricting access, adding checks, or slowing action. The useful question is not whether security is good, but whether a particular reduction in risk justifies its cost in convenience.
The uncomfortable rule is blunt: every attempt to increase security reduces convenience. The safer door is also the door that takes longer to open.
E1Protection works by making access harder
Security reduces risk by placing obstacles between something valuable and whoever might reach it. But those obstacles also confront legitimate users: more checks mean less speed, tighter restrictions mean less accessibility, and fewer trusted pathways mean fewer easy ones. Threat modeling identifies whose access should become harder; the security-convenience trade-off asks what that obstruction will cost everyone else. It is therefore a calibration problem, much like the trust-risk-trade-off: eliminating exposure entirely may also eliminate much of the system’s usefulness.
E1Friction is a cost, not proof of protection
The model does not tell you that every inconvenience produces meaningful security, or that the same burden is acceptable for every user. A uniform safeguard may impose especially high costs under differential vulnerability. You still have to compare the actual risk reduction with the friction created; otherwise inconvenience can masquerade as safety.
Price the safeguard in user steps
Before adding a security control, write down the specific access it blocks, then count the extra steps, delays, or exclusions it creates for legitimate users. Keep it only if that concrete reduction in risk is worth that concrete price.
Episodes that teach this
-
Cost Benefit Analysis Real Life Examples - Sensitivity vs Selectivity
· explained at 5:53
1,168 views
The transcript states: 'Anytime you try to increase security you are going to reduce convenience.'