Is it secure, or is it an illusion?

A participating vendor shipped its equipment to our labs in a custom-built case with a padlock on the outside. At first, this looked like a problem because if there was a key at, it was likely tucked inside the case. In our eyes, testing the product was important, but not important enough to destroy the shipping container. So the firewall sat for a couple of days, locked up.

Until one of our intrepid testers noticed that the padlock was a cheap Master Lock padlock, easy to pick even for us amateurs. Indeed, it was a 30-second job to get the lock off and the firewall out without any damage.

This raised some interesting philosophical points. Many network managers buy firewalls, but a smaller proportion spend the time to implement a comprehensive security policy, preferring the appearance and illusion of security over the inconvenience of locking everything in the company down. Like the cheaply made padlock, the firewall would not stand up to even a mild attack.

On the other hand, the padlock, like a firewall of any kind, was enough to deter us from trying to open the case for almost a week. So perhaps there is value in the appearance of security, after all.