IT Security and the Normalization of Deviance.¶
Schneier, B. (2016). IT Security and the Normalization of Deviance. Schneier on Security.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Normalization of Deviance
- In cybersecurity and software operations, expired certificates left in place, security exceptions extended past sunset, alert fatigue muting once-actionable signals, and "temporary" workarounds living in production for years all run the same ratchet.
This sourceExplicitly transfers Vaughan's normalization-of-deviance mechanism to information security and software operations, arguing that procedural shortcuts, ignored warnings, and accepted security lapses become invisible to insiders the more they recur, exactly the cybersecurity/software ratchet (expired certificates, extended exceptions, alert fatigue, lingering "temporary" workarounds) the marker asserts.
Supported in partVerified against the work's full text
Schneier carries normalization of deviance into IT security and notes false positives wearing down diligence, but never mentions expired certificates, extended exceptions or lingering temporary workarounds.
“normalization of deviance is a gradual process that leads to a situation where unacceptable practices or standards become acceptable”
- In cybersecurity and software operations, expired certificates left in place, security exceptions extended past sunset, alert fatigue muting once-actionable signals, and "temporary" workarounds living in production for years all run the same ratchet.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 1 of 1 citation: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:42b3c7d6758b · see in the full table