Introduction: A Journey Through Time
In the 1980s, as personal computers were just beginning to enter homes and workplaces, Professor Herschberg stood at the forefront of IT security, warning about the vulnerabilities inherent in digital systems. His analogy of a "colander" (vergiet) as a metaphor for cybersecurity was groundbreaking at the time.
Herschberg, who passed away in 1998, was one of the first in Delft to lecture on IT security—a visionary whose insights remain strikingly relevant today.
Cees's Discovery
Cees, a seasoned security veteran, recalls encountering Professor Herschberg's colander analogy early in his career. Though he joined KPMG later, after his company was acquired, Herschberg's teachings had already left a lasting impression on him.
The professor's analogy was deceptively simple: trying to secure a computer system is like attempting to transform a colander into a pressure cooker by soldering each hole shut, one by one.
"What struck me," Cees recounts, leaning back in his chair during our recent conversation, "wasn't just the elegance of the comparison, but how it's remained relevant through decades of technological transformation. The professor understood something fundamental about security that many still miss today."
Now retired from KPMG and advising government and industry on cybersecurity policy, Cees believes the colander principle has only grown more important in our interconnected world.
"The pattern of holes in a colander is predictable," he explains. "Once you've found a few, you know where the rest are. But in security systems? You don't know where the vulnerabilities hide until someone exploits them. That's what makes perfect security fundamentally unattainable."
Cees points to the current landscape of government regulations as evidence of this principle in action.
"Governments have failed to provide infrastructure and regulation for IT as they did with other technological developments," he notes. "Like with cars, planes, and medicines, there were standards and oversight. But in IT security, we've left it to the market—which has different interests than protecting users."
This regulatory gap has created a situation where organizations constantly chase vulnerabilities rather than building secure systems from the ground up.
Sophia's Generational Perspective
When I share the colander analogy with Sophia, the 23-year-old founder of an ethical AI startup, she immediately reframes it for her generation's experience.
"So it's like privacy settings," she says, fingers tapping rapidly on her tablet. "You think you've locked down your social media, but there's always another way your data leaks out that you hadn't anticipated."
Sophia's perspective reveals how the principle extends beyond traditional cybersecurity into data protection and privacy. "My generation doesn't separate physical security from data security—it's all just security to us. The colander isn't just about keeping hackers out; it's about controlling what flows in and out of our digital lives."
Her startup is building tools that help users visualize their "digital colanders"—mapping where their data flows and identifying potential leakage points they hadn't considered.
"The thing that bothers me most about the colander metaphor isn't the holes," Sophia adds. "It's who controls the filtering process. When you use a colander in your kitchen, you decide what gets strained out. But with our digital colanders, other people are making those decisions about our data."
This control dimension reveals why Sophia is so passionate about building consent-based systems. "Dynamic consent is our attempt to give people back control of their colanders," she explains. "Maybe we can't seal every hole, but we can decide what flows through them and where it goes afterward."
The Evolving Challenge
The conversation between Cees and Sophia highlights how the colander principle transcends generations while taking on new dimensions in today's data-centric world. For Cees, the focus remains on the inherent impossibility of perfect security—a technical challenge that requires constant vigilance. For Sophia, the emphasis shifts to questions of control, consent, and data governance.
What makes Professor Herschberg's decades-old analogy so powerful is how it transforms abstract security concepts into something tangible we all understand. Everyone has experienced the limitations of a colander—its very purpose depends on having holes.
The wisdom lies in recognizing that security systems serve multiple purposes too. They must keep certain things out while allowing legitimate access. Absolute security would mean absolute isolation—a system no one could use.
Herschberg’s insights remain relevant in modern cybersecurity frameworks like NIST and ISO/IEC standards.
As we navigate increasingly complex digital environments, the colander principle reminds us of an uncomfortable truth: perfect security remains unattainable. Yet rather than resignation, this realization can lead to more thoughtful approaches to protection, detection, and response.
In future posts, we'll explore how different stakeholders—from government officials to community organizers, from business leaders to continuous learners—approach this fundamental challenge from their unique perspectives.
For now, I invite you to consider: Where are the holes in your digital colander? And perhaps more importantly, who controls what flows through them?