Harm Reduction: A Framework for Effective & Compassionate Security Guidance

## Overview

In this presentation, Kyle Tobinier, head of security at a devops startup, outlines a framework for providing compassionate and effective security guidance adapted from harm reduction models in healthcare. Drawing parallels to ineffective fear-based programs from the 1980s and 1990s—such as "Every 15 Minutes," D.A.R.E., and "Scared Straight," which brought wrecked cars into high school auditoriums to curb underage drinking—Tobinier highlights that attempting to control behavior purely through fear or abstinence often fails and can even worsen targeted behaviors. Similarly, common cybersecurity vendor pitches and practitioner advice rely heavily on fear tactics and rigid prohibitions, ultimately alienating users and undermining security goals.

## Core Principles of the Harm Reduction Framework

To move away from fear-driven paradigms, the talk introduces a three-part harm reduction framework:

1. **Accept that risk-taking behaviors are here to stay:** Users will continue to engage in digital activities that carry inherent risks, making total elimination of these behaviors impossible. 2. **Prioritize the reduction of negative consequences:** Instead of trying to halt all risky actions, security programs should aim to minimize the severity and blast radius of potential bad outcomes. 3. **Embrace compassion when giving guidance:** Security professionals must abandon condescension, mockery, and punitive messaging in favor of empathetic, practical communication.

## Analysis of Common Ineffective Guidance ("Use Reduction")

Security professionals frequently practice "use reduction"—issuing blanket bans or demanding unsustainable compliance that people routinely ignore:

* **QR Codes and Links:** Following events like the bouncing Coinbase Super Bowl QR code advertisement, hundreds of infosec practitioners urged users never to scan QR codes or click links because they are "unsafe." * **Password Complexity:** Advising extreme password complexity rules frequently backfires. When users compensate by writing credentials down in a physical notebook, security teams often mock them rather than acknowledging the usability flaw of demanding impossibly complex, non-reused passwords. * **Social Media Restrictions:** Directives advising users or family members to stop using platforms like TikTok entirely because they are "bad" or "unsafe" are consistently ignored, rendering the advice ineffective.

## Takeaways for Security Practitioners

Whether communicating with thousands of employees at a Fortune 100 enterprise or helping a family member navigate the internet, security professionals must recognize that abstinence-based guidance fails. Security advice must meet users where they actually are, providing practical safeguards and compassionate support rather than relying on fear, uncertainty, and absolute prohibitions.