The New School of Information Security

by Shostack, Adam; Stewart, Andrew

• ISBN13: 9780321502780
• ISBN10: 0321502787
• Edition: 1st
• Format: Hardcover
• Copyright: 2008-01-01
• Publisher: Addison-Wesley Professional

Summary

It is about time that a book likeThe New Schoolcame along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out." --David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems Why is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It's about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don't just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether yours"re a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises. Better evidence for better decision-making Why the security data you have doesnrs"t support effective decision-making--and what to do about it Beyond security "silos": getting the job done together Why itrs"s so hard to improve security in isolation--and how the entire industry can make it happen and evolve Amateurs study cryptography; professionals study economics What IT security leaders can and must learn from other scientific fields A bigger bang for every buck How to re-allocate your scarce resources where theyrs"ll do the most good

Table of Contents

Observing the World and Asking Why
Spam, and Other Problems with Email	p. 4
Hostile Code	p. 7
Security Breaches	p. 9
Identity and the Theft of Identity	p. 11
Should We Just Start Over?	p. 14
The Need for a New School	p. 15
The Security Industry
Where the Security Industry Comes From	p. 19
Orientations and Framing	p. 25
What Does the Security Industry Sell?	p. 27
How Security Is Sold	p. 33
On Evidence
The Trouble with Surveys	p. 46
The Trade Press	p. 50
Vulnerabilities	p. 52
Instrumentation on the Internet	p. 54
Organizations and Companies with Data	p. 55
The Rise of the Security Breach
How Do Companies Lose Data?	p. 64
Disclose Breaches	p. 68
Possible Criticisms of Breach Data	p. 70
Moving from Art to Science	p. 74
Get Involved	p. 76
Amateurs Study Cryptography; Professionals Study Economics
The Economics of Information Security	p. 82
Psychology	p. 95
Sociology	p. 99
Spending
Reasons to Spend on Security Today	p. 106
Non-Reasons to Spend on Security	p. 110
Emerging Reasons to Spend	p. 112
How Much Should a Business Spend on Security?	p. 116
The Psychology of Spending	p. 122
On What to Spend	p. 126
Life in the New School
People Are People	p. 132
Breach Data Is Not Actuarial Data	p. 136
Powerful Externalities	p. 137
The Human Computer Interface and Risk Compensation	p. 139
The Use and Abuse of Language	p. 142
Skills Shortages, Organizational Structure, and Collaboration	p. 144
A Call to Action
Join the New School	p. 149
Embrace the New School	p. 153
Make Money from the New School	p. 157
Final Words	p. 159
Endnotes	p. 161
Bibliography	p. 213
Index	p. 229
Table of Contents provided by Ingram. All Rights Reserved.

Excerpts

= 0) {slash = '\\';} else {slash = '/';}openLoc = figLoc.substring(0, figLoc.lastIndexOf(slash) + 1);while (pPage.substring(0,3) == '../') {openLoc = openLoc.substring(0, openLoc.lastIndexOf(slash, openLoc.length - 2)+ 1);pPage = pPage.substring(3, pPage.length + 1);}popUpWin =window.open('','popWin','resizable=1,scrollbars=1,location=0,toolbar=0,width=525,height=394');figDoc = popUpWin.document;zhtm= ' ' + pPage + ' ';zhtm += ' ';zhtm += ' ';zhtm += ' ';zhtm += '' + pPage.substring(pPage.lastIndexOf('/') + 1, pPage.length) + '';zhtm += ' ';figDoc.write(zhtm);figDoc.close();}// modified 3.1.99 RWE v4.1 --> The New School of Information Security Preface"I didn't have time to write you a short letter, so I wrote a long one."--Mark TwainWe've taken the time to write a short book, and hope you find it enjoyable and thought-provoking. We aim to reorient security practitioners and those around them to a New School that has been taking shape within information security. This New School is about looking for evidence and analyzing it with approaches from a wide set of disciplines. We'd like to introduce this approach to a wider audience, so we've tried to write so that anyone can understand what we have to say.This isn't a book about firewalls, cryptography, or any particular security technology. Rather, it's about how technology interacts with the broader world. This perspective has already provided powerful insights into where security succeeds and fails. There are many people investing time and effort in this, and they are doing a good deal of interesting research. We make no attempt to survey that research in the academic sense. We do provide a view of the landscape where the research is ongoing. In the same spirit, we sometimes skim past some important complexities because they distract from the main flow of our argument. We don't expect the resolution of any of those will change our argument substantially. We include endnotes to discuss some of these topics, provide references, and offer side commentary that you might enjoy. Following the lead of books such asEngines of CreationandThe Ghost Map, we don't include endnote numbers in the text. We find those numbers distracting, and we hope you won't need them.Some of the topics we discuss in this book are fast-moving. This isn't a book about the news. Books are a poor place for the news, but we hope that after readingThe New School, you'll look at the news differently.Over the course of writing this book, we've probably written three times more words than you hold in your hands. The book started life asSecurity Decisions