Beyond Fear

pres (Preston Tollinger) writes "I picked up Beyond Fear: Thinking Sensibly About Security In an Uncertain World basically because it was by Bruce Schneier. I am sure most Slashdot readers know Schneier's name and his work. The problem is, this book probably isn't for you (but might be perfect for someone you know)." To find out what he means by that, read on for the rest of Tollinger's review, below. Beyond Fear: Thinking Sensibly About Security In an Uncertain World author Bruce Schneier pages 256 publisher Copernicus Books rating 7 reviewer Preston Tollinger ISBN 0387026207 summary A worthwhile introduction to real-world (not just computer) security, aimed at a literate but non-technical audience. The Book Beyond Fear is described very well by its subtitle: this book helps you think sensibly about security. Don't expect the highly technical material you have seen in Schneier's previous books, but rather the more accessible material, much like you might read in his monthly newsletter. That doesn't mean the book is breezy: In Schneier's wordy but well-written manner, he describes a five-step process to analyze any particular security system or practice. The process helps you make sure you understand what you are protecting, what the tradeoffs are, and whether, in the end if it is worthwhile to implement the system.

He then goes on to apply this method to a series of security issues while covering the various types of security and their weaknesses. For the most part this not a technical evaluation of the tools used, but rather an analysis for each example of what the security goals are and how the tools and technology achieve or fail to achieve those goals. Even more importantly, he deals with the tradeoffs inherent in any security system.

Schneier applies this method not only to the global issues that have come up since 9/11, from airline security to protecting government secrets, but also to personal issues, including tradeoffs in personal home security. By doing so, he takes principles which might be hard for some to understand in the abstract and makes it clear how they apply in situations almost everyone has thought about.

By drawing parallels, for instance, between how you might select a home alarm system to how you might evaluate the use of face recognition at the airport, Schneier shows that you don't have to be a security "expert" to think logically about security. He brings to the forefront the tradeoffs that you made in these personal choices; for example, the downside of dealing with deactivating an alarm system every time you come home. Then, in turn, he shows how you must consider the problem of people being falsely identified by the face recognition system at the airport.

Given this strong framework, he then uses his method to analytically and dispassionately tear apart most of the silly and stupid security methods (note my dispassion here) that have been put in place or considered in the past few years, from airline security methods to national ID cards. With a combination of funny yet pointed anecdotes, clear statistics and the occasional Harry Potter reference, Schneier uses his talent for cogent, rational explanation to show how people can think about security in the modern world, instead of simply panicking at every ominous news report.

To Read Or Not To Read So it sounds like a good book and probably would be for some, but there was not enough new content for me to make it worth my limited reading time. Perhaps due to my general interest in security or just because waiting in line at the airport has already given me a lot of time to think, but I have already considered most of the ideas Schneier raises in Beyond Fear. I own a shredder, but not an alarm system, because I have considered the risks and costs. I dislike the idea of a National ID card because I was already afraid of what someone might do who got access to it, and already monitor my credit report. I have written my local representative that while his recent bill to remove SSNs from insurance cards is nice, it's far too late (and how about just getting people to stop using SSN's as passwords?).

If this describes you, skip the book. However you might note above I didn't say this was a waste of my money. This book is soon going to find its way into hands of friends and relations who need to think about security. It is a great introduction to a way of thinking that is critical in a post-9/11 world. It should be required reading for members of Congress before any more security laws are passed based only on the need to do something instead of rational thought.

Summary If you think consciously about security, know who Schneier is, or have ever noticed (and complained) that many airport security measures make no sense, you probably don't need this book. If you have only considered this topic in general, though, and want a book to focus your thoughts, Beyond Fear will do that. Finally, if you have friends who don't yet think this way (admit it, we all do), get this book into their hands.

You can purchase Beyond Fear from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

Re:What's wrong with national IDs?

[Jeffrey Baker]

It's really symptomatic of something else: American's don't trust their government. Over the last century the government and laws of the USA have really gotten out of control, but the population has mostly just let it slide. I mean it's illegal to smoke marijuana, but everyone does it anyway. It's illegal in many states to be involved in a blow job, or to arrange your furniture in a certain way, or to change the needle valves in your carburetor. All these laws are pretty stupid, but nobody really cares because they are unenforceable.

In addition the people of the USA have a tradition of just being criminals. Practically anyone has a smuggler or a bootlegger or a bookie in their family tree somewhere. These things were illegal but not really dishonorable. And in the beginning days of the country, it was possible for someone to fuck up their lives in one area and simply start over further west. So we've gotten used to ignoring the laws and taking advantage of anonymity.

The situation changes if the government suddenly becomes organized and informed. If the government has a good way to track who we are and what we are doing, all those things that are illegal will suddenly matter. So the reaction is to resist tracking and information programs. Of course, this is the incorrect reaction: what we should really be doing is reigning in our government and repealling stupid laws until we feel that we can trust it again. But that answer isn't as obvious.

I'll end with a short example: last year I got on an SF MUNI streetcar at a station where the toll machines were broken. I paid my $1, but the machine didn't give me a ticket. No attendant was on duty so I just boarded the train anyway. Well, lo and behold here comes Fare Inspection Shitwit to check my ticket, which I didn't have, through no fault of my own. Inspector Shitwit gives me a ticket ($90 fine) for failure to have a ticket on the streetcar. Naturally I rebuked him profanely and threw the ticket in the trash. I don't have any intention of dealing with such rubbish. But now, six months later, there's a warrant for my arrest which will never be served by the SFPD and I will be unable to renew my driver's license, which is expired, until a year after the incident. If the government were *really* well organized I might even get arrested. I'm really afriad that in some well-organized, well-tracked future government regime, people will get in *real trouble* for not having a piece of paper that says you paid $1 to get on the bus.

Re:What's wrong with national IDs?

[SquadBoy]

Becuase they do not buy any security and they open many holes.
You may trust your government enough to know everything about you and to keep it all in one great big database but you have to keep in mind that here in America we don't so much. In fact we are an entire country founded on the thought that the government should get the fuck out of our lives. National IDs do nothing for security they do nothing to prevent idenitity theft they do nothing but put all of your personal info in one database that can be abused by those who have access to it and broken into and abused by those who do not. In Beyond Fear Bruce goes through this with the 5 step process. You spend a large amount of money and get nothing in return.

Think about it for a moment and I can only speak for the US but I'll walk you through the process.

I have a drivers license and a Social Security card. With those two forms of ID I can get any other form of ID that we have here in the US. Those two pieces of ID are in turn based on a birth cert. You can get a birth cert for a couple of hundred dollars. To implement a national ID they would have to figure out someway to figure out who everybody is and at this point it is impossible to prove who anyone is beyond accepting what their current IDs say. See the problem yet?

So national IDs will just give you another ID that says that you are who you claim to be. But if I don't like being that person anymore it would take a couple of hundred dollars and a bit of time to be someone else. There is *no* way that you can prove that anyone is anyone. Trying to do so is pointless and will merely cause problems for honest folks.

How to get your driver's license back

[Anonymous Coward]

Just renounce your US citizenship but remain in SF. That way you'll now be an illegal alien. Then just head on over to the DMV and they'll print your license out for you straight away.