The New School of Information Security
Read an excerpt:
Chapter 1: Observing the World and Asking Why
Excerpt provided courtesy of Addison-Wesley Professional. Copyright © Pearson Education, Addison-Wesley Professional. Written permission from the publisher is required for any use of this material.
|
Be the First to Write a Review and tell the world about this title!People who purchase this book frequently purchase: Books on similar topics, in best-seller order:Books from the same publisher, in best-seller order:
“It is about time that a book like The New School came along. The age of
security as pure technology is long past, and modern practitioners need to understand
the social and cognitive aspects of security if they are to be successful. Shostack
and Stewart teach readers exactly what they need to know--I just wish I could
have had it when I first started out.”
--David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems
Why is information security so dysfunctional? Are you wasting the money you
spend on security? This book shows how to spend it more effectively. How can
you make more effective security decisions? This book explains why professionals
have taken to studying economics, not cryptography--and why you should, too.
And why security breach notices are the best thing to ever happen to information
security. It’s about time someone asked the biggest, toughest questions
about information security. Security experts Adam Shostack and Andrew Stewart
don’t just answer those questions--they offer honest, deeply troubling
answers. They explain why these critical problems exist and how to solve them.
Drawing on powerful lessons from economics and other disciplines, Shostack and
Stewart offer a new way forward. In clear and engaging prose, they shed new
light on the critical challenges that are faced by the security field. Whether
you’re a CIO, IT manager, or security specialist, this book will open your
eyes to new ways of thinking about--and overcoming--your most pressing security
challenges. The New School enables you to take control, while others struggle
with non-stop crises.
•
Better evidence for better decision-making
• Why the security data you have doesn’t support effective decision-making--and
what to do about it
•
Beyond security “silos”: getting the job done together
• Why it’s so hard to improve security in isolation--and how the entire industry
can make it happen and evolve
•
Amateurs study cryptography; professionals study economics
• What IT security leaders can and must learn from other scientific fields
•
A bigger bang for every buck
• How to re-allocate your scarce resources where they’ll do the most good
Table of Contents
1. OBSERVING THE WORLD AND ASKING WHY Spam, and Other Problems with Email 4
Hostile Code 7
Security Breaches 9
Identity and the Theft of Identity 11
Should We Just Start Over? 14
The Need for a New School 15
2. THE SECURITY INDUSTRY Where the Security Industry Comes From 19
Orientations and Framing 25
What Does the Security Industry Sell? 27
How Security Is Sold 33
3. ON EVIDENCE The Trouble with Surveys 46
The Trade Press 50
Vulnerabilities 52
Instrumentation on the Internet 54
Organizations and Companies with Data 55
4. THE RISE OF THE SECURITY BREACH How Do Companies Lose Data? 64
Disclose Breaches 68
Possible Criticisms of Breach Data 70
Moving from Art to Science 74
Get Involved 76
5. AMATEURS STUDY CRYPTOGRAPHY; The Economics of Information Security 82
PROFESSIONALS STUDY ECONOMICS Psychology 95
Sociology 99
6. SPENDING Reasons to Spend on Security Today 106
Non-Reasons to Spend on Security 110
Emerging Reasons to Spend 112
How Much Should a Business
Spend on Security? 116
The Psychology of Spending 122
On What to Spend 126
7. LIFE IN THE NEW SCHOOL People Are People 132
Breach Data Is Not Actuarial Data 136
Powerful Externalities 137
The Human Computer Interface and
Risk Compensation 139
The Use and Abuse of Language 142
Skills Shortages, Organizational
Structure, and Collaboration 144
8. A CALL TO ACTION Join the New School 149
Embrace the New School 153
Make Money from the New School 157
Final Words 159
ENDNOTES 161
BIBLIOGRAPHY 213
INDEX 229
About the Author
Adam Shostack is part of Microsoft’s Security Development Lifecycle strategy
team, where he is responsible for security design analysis techniques. Before
Microsoft, Adam was involved in a number of successful start-ups focused on
vulnerability scanning, privacy, and program analysis. He helped found the CVE,
International Financial Cryptography association, and the Privacy Enhancing
Technologies workshop. He has been a technical advisor to companies including
Counterpane Internet Security and Debix.
|
