Guarding the castle keep: teaching with the fortress metaphor

The computer security field is replete with metaphors - the original and most commonly used metaphor is the computer (or network) as a fortress, the walls of which must be guarded against potential breaches. This metaphor is useful, but like all metaphors, it is not precise. Understanding the differences, between the metaphor of a fortress and the realities of securing a system is crucial to students understanding the subtleties of computer security. We discuss the fortress metaphor as a pedagogical tool, both how it succeeds and how it fails to aid student understanding.