Slashdot Mirror
Beyond Fear
He then goes on to apply this method to a series of security issues while covering the various types of security and their weaknesses. For the most part this not a technical evaluation of the tools used, but rather an analysis for each example of what the security goals are and how the tools and technology achieve or fail to achieve those goals. Even more importantly, he deals with the tradeoffs inherent in any security system.
Schneier applies this method not only to the global issues that have come up since 9/11, from airline security to protecting government secrets, but also to personal issues, including tradeoffs in personal home security. By doing so, he takes principles which might be hard for some to understand in the abstract and makes it clear how they apply in situations almost everyone has thought about.
By drawing parallels, for instance, between how you might select a home alarm system to how you might evaluate the use of face recognition at the airport, Schneier shows that you don't have to be a security "expert" to think logically about security. He brings to the forefront the tradeoffs that you made in these personal choices; for example, the downside of dealing with deactivating an alarm system every time you come home. Then, in turn, he shows how you must consider the problem of people being falsely identified by the face recognition system at the airport.
Given this strong framework, he then uses his method to analytically and dispassionately tear apart most of the silly and stupid security methods (note my dispassion here) that have been put in place or considered in the past few years, from airline security methods to national ID cards. With a combination of funny yet pointed anecdotes, clear statistics and the occasional Harry Potter reference, Schneier uses his talent for cogent, rational explanation to show how people can think about security in the modern world, instead of simply panicking at every ominous news report.
To Read Or Not To Read So it sounds like a good book and probably would be for some, but there was not enough new content for me to make it worth my limited reading time. Perhaps due to my general interest in security or just because waiting in line at the airport has already given me a lot of time to think, but I have already considered most of the ideas Schneier raises in Beyond Fear. I own a shredder, but not an alarm system, because I have considered the risks and costs. I dislike the idea of a National ID card because I was already afraid of what someone might do who got access to it, and already monitor my credit report. I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as passwords?).If this describes you, skip the book. However you might note above I didn't say this was a waste of my money. This book is soon going to find its way into hands of friends and relations who need to think about security. It is a great introduction to a way of thinking that is critical in a post-9/11 world. It should be required reading for members of Congress before any more security laws are passed based only on the need to do something instead of rational thought.
Summary If you think consciously about security, know who Schneier is, or have ever noticed (and complained) that many airport security measures make no sense, you probably don't need this book. If you have only considered this topic in general, though, and want a book to focus your thoughts, Beyond Fear will do that. Finally, if you have friends who don't yet think this way (admit it, we all do), get this book into their hands.You can purchase Beyond Fear from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
As a computer person, I don't consider myself a great conversationalist. And I agree that I've already thought about a lot of the issues Schneier brings up in "Beyond Fear."
However, most "normal people" relate well to anecdotes, and general examples, and this book is full of them. Instead of trying to describe how 256 bit keys are safer than 64 bit keys to non-technical friends and relatives, I've learned lots of metahphors involving door locks, car theft, and every day risk assesment that will help me to get my point across a lot more clearly.
I think this is the point of this book. It's not technical. It's Security for the Everyman.
This came true on a national scale with 9/11 of course. The public went whole hog for the idea of airport screeners but those airport screeners have the brains of a mall security guard.
I'd love to see a simple process for evaluating new proposed 'security' practices in my organization to help debunk the idea that these proposals provide any security at all.
I don't understand why Americans are so afraid of national ID cards. Where I live we have standardized national ID cards that are used in most situations, and I can't say how it has made me any less free.
In the modern world, we are counted and registered with our government. What is wrong with having a standardized card to show who we are?
I don't know if these cards would stop anybody from crashing airplanes, but they do help against things like identity theft, which is quite common in America but almost unheard of here. We don't have to have "three kinds of photo id" to go to bank, we don't consider our mother's maiden name or SS#'s security secrets, and we don't need to bring the electic bill to rent a movie.
Granted, my country is much smaller than the US, but I would support having an EU wide Identity card standard. I cannot see sensible argument against it.
This might seem like common sense, but a IMO *lot* of otherwise Clueful people could use having this sort of process tatooed in reverse on their forehead so they'd have to review it every morning when they looked in the mirror.
The trouble with any job that involves detail and careful attention is that the forest tends to duck behind all the damned trees, and this is especially true for IT. Hell, look at all the /.'ers in our recent discussions about programs or products that are "useless" or "should have waited longer to be released" because it doesn't provide absolute security, whereas in reality security is a *step by step* type of deal, not one of absolutes.
Anyhow, in my experience it often benefits even the "experts" to have the blatently obvious spelled out in this way and laid out before them. Security isn't alone here -- this goes for just about all disciplines, IT or not. Given that, I think it's dangerous to dismiss something like this as too basic.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
I am sure most Slashdot readers know Schneier's name and his work.
Oh sure,if he's from soviet russia and he, for one, welcomes 1-2-3-profiting from first posts, I'm sure most Slashdot readers know him.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
No. We aren't all born with the knowledge of obscure technologists here.
Bruce Schneier is well known as an expert in security and cryptography. In particular, he is possibly best known for writing the bible of cryptography: Applied Cryptography.
For other examples of his work, see here.
Fear is a strong word. I don't think getting an alarm system is evidence that you are cringing in fear, or even feeling fear. It may be a sensible step in a practical plan to simply be prepared. Obviously there are exceptions; some people truly are fearful, but I doubt most are.
One mistake Schnier tends to make is to ascribe certain thoughts to others that may not be there at all. For example, he seems to think that anyone who has a security system of any kind (software, hardware, etc.) assumes that system will be invincible. He then goes on to attack that assumption, without stopping to realize that the assumption he is attacking is not one that is actually held by most people. Now his new attack, on "fear" this time (that he thinks everyone with security systems must have), is of the same form.
However, over the years his all-or-nothing approach has mellowed, fortunately; since he is so influential, it's good that he is starting to see things less as black and white and more in terms of tradeoffs. The old view that poor security equals no security is easily debunked by pointing out that virtually all security systems in place everywhere are penetrable, yet they remain effective in the aggregate.
Bottom line: Beyond Fear is just a good title. Let's hope he doesn't really think that locking your car door is firm evidence that you are quaking in your boots.
This is precisely why I don't bother with any encryption that isn't built in. Browser encryption - fine. Using PGP or RMSPG on my email -- as Dogbert asked, "Who would want to read your mail?" There is too much hassle involved, just on my end, never mind getting my sister or mother in law to read encrypted email. Unless you make a fetish of it for your own sake or you're sending something genuinely worth protecting, who cares?
What I'm listening to now on Pandora...
No, the bible of cryptography is "Military Crytology" by William Friedman. Unfortunately, its not available thru Amazon. You'll have to go to Ft. Meade MD to get a copy. If you dont know who William Friedman is, find out.
11. Buy a tinfoil hat and tell the little alien on your shoulder to get one too.
For US government regulatory purposes, the value of a human life ranges from about $1.1 million to about $6 million. (1999 dollars). The current administration would prefer smaller numbers, because environmental and safety regulations are measured against those values. (1 CFR s305-88-7). So the Enron collapse, at $40 billion, equates to about 7,000 lives.
Yet Ken Lay is still at large.
Just renounce your US citizenship but remain in SF. That way you'll now be an illegal alien. Then just head on over to the DMV and they'll print your license out for you straight away.
And California is about to massively devalue that ID by issuing drivers licenses to undocumented (aka illegal) aliens.
Logically, every other state in the union should refuse to recognize a CA drivers license as a valid ID, except maybe as proof of the ability to drive a car (about the same utility as the "international drivers license" you can get). I'm sure Californians will be real happy when TSA stops accepting their DLs as valid ID next time they try to board a plane.
You want a national ID? Get a passport.
-- Alastair
...quit being such a goddamned pussy. Yeah, yeah, I know... "flamebait" or "troll", but I honestly believe this. The US, especially, is increasingly full of people afraid to leave their houses, and when they do, they're armed to the teeth. I don't know what everybody's so goddamned afraid of. Michael Moore's "Bowling for Columbine" suggested this in a roundabout way, but I believe, that that's a big problem with the US. Everybody's becoming scared of their own shadow. Afraid of terrorists. Afraid of crime. Afraid of "cyber attacks" (this is beyond ridiculous). I suggest quit being such a goddamned pussy, that's what I suggest.
I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as identifiers?
The cat's out of the bag already. Pretending that SSN's are somehow secret was dubious enough thirty years ago, but is just plain reckless today. It's this coy game of 'if you know your SSN you must be you even though we know that's not true' that has allowed identify theft to proliferate.
Instead we need to just say, "this is my National ID # - use it for whatever you damn well please" - at that point people will have to start looking for real security solutions instead of the crazy half-baked ineffective one they're trifling with now.
Of course, this can't be done electively - there needs to be a national cutover date with probably 2 years notice (then at least 2 years of delays). All that needs to be done is to get Congress, the IRS, the President, and 'Privacy Advocates' on board. No problem.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
I teach security to novices, and I have found Bruce's books extremely useful resources. As soon as read Beyond Fear, I incorporated some of his ideas in my lectures (although I expanded the 5-step process to 6 steps for the students). Well recommended.
I was chief architect several years ago at a pioneering (and now dead) movies-over-the-net company. Beyond the technical issues involved, our biggest problem was movie-industry execs who insisted on "absolute, guaranteed, unbreakable" security. Needless to say, this was a bit of a stumbling block, as there's no such thing.
When I gave security-related presentations to non-techies, I got in the habit of asking for a show of hands asking who had locked their front door when they left home that morning. Needless to say, all hands went up. I'd then point out that a thief could break a window, tunnel through a wall, dig up through the floor, cut a hole in the roof, or batter down a door if they were determined enough to get inside...so why did they bother locking the front door? Thinking about this got people into a more reasonable mindset to discuss cost/benefit ratios and attack scenario analysis.
When all you have is a hammer, everything looks like a skull.