Earlier today, I saw this tweet go by, and it resonated loudly:

Why, oh why, oh why, do people assume the solution to any problem is to apply more permissions rather than investigate the issue!? And why start with the highest possible additional privilege rather than bottom up? pic.twitter.com/15LaaZjZ2m

— Mr83 (infosec.exchange/@cirriustech) (@cirriustech) May 21, 2021

I replied with the following:

There’s surely an eponymous law that covers this…

It’s basically desire paths applied to permissions. Humans will find the fastest path of least resistance to solve their time-bound problem, apply it, and never repair it with the proper approach. Because who has time for that? https://t.co/6bmhh3EHhP

— Wesley Miller (@getwired) May 21, 2021

Throughout the day, it’s gnawed at me a little bit, pondering if there is a law that would encompass this. Everything from Fitt’s Law to Hick’s Law, and then my mind wandered to Felten and Schneier’s quotes about the dancing pigs.

I circled back to my earlier tweet, where I noted that this phenomenon perfectly reflects a desire path, applied to computer security.

Over the years, I’ve had this conversation with countless people, about countless scenarios, all circling around this same topic:

1. I have a task I need to complete, using a piece of software
2. The software I need to complete the task is not functioning correctly, due to permissions
3. I do not have the time, patience, or skill to solve this in the ideal manner
4. A blunt hammer is applied to the problem, until the software will let me complete the task
5. I never go back to undo the “damage” my blunt hammer did, because the task is complete and the software is functioning.

This is, in essence, a desire path. It would be better if the user followed the walkway that has been built for them. But since they usually have this time-bound problem, they cannot deploy the correct fix, and instead must deploy the fastest one/one with the least friction. Every system has this same story. SQL Server and “SA”, “SA”, Unix and chmod 777, local admin on Windows or domain admin in Active Directory… it goes on and on.

In short, “A user will always apply the fastest approach to solve a security problem, and never repair the damage caused by doing so.“