The law of least resistance
As folk who heard me speak at Financial Crypto this year know, I am currently trying to develop laws of security usability. We have a significant quantity of raw information concerning usability of particular systems but few attempts to systematize and generalize from these data points to develop actionable design rules for designing usable systems.
As more details of the Societe Generale incident emerge, it begins to look like a usability problem. Dominic O'Connor at the Register presents an all to credible explanation of how the disaster might well have occurred: Controls were in place that should have detected the issue and may well have done so, but it appears that the usability of those systems was flawed. The managers followed the path of least resistance.
