Schneier on Security 204
brothke writes "There is a perception in both the
private and government sector, that security, both physical and digital, is
something you can buy. Witness the mammoth growth of airport security
products following 9/11, and the sheer number of vendors at security
conferences. With that, government officials and corporate executives
often think you can simply buy products and magically get instant security by
flipping on the switch. The reality is that security is not something
you can buy; it is something you must get." Keep reading for the rest of Ben's review.
Perhaps no one in the world
gets security like author Bruce Schneier does. Schneier is a
person who I am proud to have as a colleague [Schneier and I
are both employed by the same parent company, but work in different divisions,
in different parts of the country]. Schneier on Security is a
collection of the best articles that Bruce has written from June 2002 to June
2008, mainly from his
Crypto-Gram
Newsletter, his
blog,
and other newspapers and magazine. The book is divided into 12 sections,
covering nearly the entire range of security issues from terrorism, aviation,
elections, economics, psychology, the business of security and much
more.
| Schneier on Security | |
| author | Bruce Schneier |
| pages | 336 |
| publisher | Wiley |
| rating | 10 |
| reviewer | Ben Rothke |
| ISBN | 978-0470395356 |
| summary | The best articles from one of security's best |
Two of the terms Schneier uses extensively throughout the book are intelligence and economics. From an intelligence perspective, he feels that Washington has spent far too much on hardware and other trendy security devices that create a sense of security theater. The security theater gives an aura and show of security, but in reality, has little real effect.
The lack of intelligence is most manifest with airports, which are a perfect example of misguided security. Schneier notes that current trends in US airport security requires that people remove their shoes, due to a one-time incident with shoe-based explosive. Such an approach completely misses the point. Also, Schneier notes that the attempt to create a no-fly list, by feeding a limited set of characteristics into a computer, which is somehow expected to divine a person's terrorist leaning, is farcical.
Schneier therefore feels that the only way to effectively uncover terrorist plats is via intelligence and investigations, not via large-scale processing of everyone. Intelligence is an invaluable tool against terrorism, and the beauty of it is that it works regardless of what the terrorists are plotting. The bottom line according to Schneier in the book is that too much of the United State's counterterrorism security spending is not designed to protect us from the terrorists; but instead to protect public officials from criticism when another attack occurs.
Schneier also astutely notes that for the most part, security is not really so much of a technical issue, rather one of economics. A perfect example he gives is that of bulletproof vests. Since they are so effective, why doesn't everyone wear them all of the time? The reason people don't is that they do not think they are worth the cost. It is not worth the money or inconvenience, as the risk of being shot for most people is quite low. As a security consumer, people have made the calculation that not wearing a bulletproof vest is a good security trade-off. Schneier also notes that much of what is being proposed as national security is a bad security trade-off. It is not worth it and as consumers, the public is being ripped off.
Another recurring theme throughout the book is how the Bush administration has little by little eroded the Constitution, all in the name of fighting terrorism. Schneier notes that the brilliant framework the founding fathers created by creating divisions of power (executive, legislative, judicial) with checks and balances violates a basic unwritten rule, that the government should be granted only limited powers, and for limited purposes. Since there is a certainty that government powers will be abused.
Schneier observes that the USA PATRIOT is a perfect example of this abuse. The Constitution was designed and carefully outlines which powers each branch may exercise. While Schneier is best-known as a cryptographer and security expert, Schneier on Security also shows him to be a defender of the Constitution. In a number of essays in the book, he shows how unchecked presidential powers is bad not only for security, but for the preservation of democracy.
In chapter 8, on the topic of the economics of security, Schneier suggests a three-step program for improving computer and network security. He notes that none of them have anything to do with technology; they all have to do with businesses, economics, and people.
In chapter 9, on the psychology of security, Schneier writes that he tells people that if something is in the news, then they do not have to worry about it. He writes that the very definition of news is something that hardly ever happens. It's when something is not in the news, when it is so common that it is no longer news, drunk drivers killing people, domestic violence, deaths from diabetes, etc., that is when you should start worrying. And much of the terrorist threats that the Department of Homeland Security is spending tens of billions of dollars on, are those news threats, such as shoe bombers and liquid explosives that present very little real threat to the people of the US.
A fundamental theme of the book is that security is a trade-off. And far too many people have made the security trade-off without thinking if it is truly worth it. In essay after essay, Schenier challenges those assertions. Since 9/11, much has been given up in the name of terrorism, and that has been personal privacy and security. Schenier asks, has it been worth it?
Schneier on Security is an exceptionally important book that is overflowing with thought-provoking articles. Schneier gets above vague adages such as the war on terror and gets to the heart of the matter. His insight details what the real threats are, and what we should really be worrying about. The irony is that what Washington does is often the exact opposite of what should be done.
Much of the security carried out in the name of 9/11 has proven to be infective in the seven years since the attack. Schneier on Security is a manifesto of what should have been done, and what should be done. The book is eye-opening from the first page to the last. It lets you know that the next time you see grandma asked to take her shoes off by a TSA agent at the airport, why she is simply a bit player in the large security theater. And why spending tens of billions on a charade like that, makes that a tragedy of epic proportions.
Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.
You can purchase Schneier on Security from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
Afterword (Score:5, Interesting)
Two things:
First, Van Gogh painted Bruce Schneier's portrait [petroz.com] over a hundred years ago.
Well ok, that's not Bruce but it sure looks like him, doesn't it? The linked picture is a Van Gogh self-portrait.
Secondly, I want to point to an afterward to Cory Doctorow's Little Brother [craphound.com]. Bruce Schneier writes:
That's just a snippet, as the book is one long HTML page do a word search on "Bruce Schneier" to find the afterword.
Bruce Almightly (Score:4, Interesting)
Dealing with symptoms (Score:5, Interesting)
Everything he talks about is just dealing with the symptoms. Terrorism is a symptom of very desperate people who feel that they're being shit on by someone.
I've been thinking about terrorism lately and its causes and its implementers. most terrorism is centered on what's happening in the Middle East. Now before someone accuses me of being anti-Islamic or racist or whatever, hear me out.
Terrorism is the result of very desperate people who have lost all hope and feel powerless. The Middle East and its people have been shit on for a couple of millennia; whether by western powers, other in the Middle East (Persians and Turks), Asians. These are people who have felt shit on by the World and there's nothing they can do about it. The creation of Israel was the straw that broke the camels back - so to speak.
To make a long story short, if we gave autonomy to the Middle east (Oil supplies be damned!), meaning pull out completely. I think terrorism would stop or at the very least, decrease dramatically.
I also disagree with folks who think that if we were to leave the Middle East, others would gain control of the Oil thereby sending us into a depression or putting our military and defense in jeopardy. It won't happen.
Re:Afterword (Score:5, Interesting)
Amen.
I recently relocated to a rather rural area and I've met a lot of... shall we call them "simple" people. They look like country bumpkins, and many rarely leave the area, but several have surprised me with their insights.
One was an older man who worked construction his whole life. He once flew out to see his son's family in another state. While waiting to board his return flight he was sitting facing the key-pad door that led to the tarmac. He heard one person type "Beep... Beep... Beep... Bip-bip-bip." Then another. He realized that the six-digit code was three different numbers, followed by three identical numbers.
So he watched. After fifteen minutes he got the code. It was something like "264000." He wrote it on his boarding pass. When we handed the pass to the attendant at the gate she asked, "Sir, do you need this number?" He responded, "No, I don't need the code to your locked door over there." And then he boarded the plane.
A few minutes later two airport police officers came on the plane and asked him if he'd mind answering a few questions. He missed his flight (though they took mercy on him and put him on a later flight) while he was read the riot act. At no point did anyone thank him, nor did it seem that they were willing to find fault with their system or people who let out their ubersecret code.
He was wrong for hearing the code. He was wrong for watching the employees type the code.
Re:The thesis is a joke... (Score:3, Interesting)
How on earth can the middle east feel powerless when it is sucking a trillion dollars of oil money a year out of the western world?
Because >99% of those trillions go to 1% of the population?
Re:Afterword (Score:4, Interesting)
Well, I was only six 50 years ago, but it did seem that there were fewer thieves. Certainly our governments and industries weren't run by thieves like they are now. But you would have to show some stats to convince me that eat-and-run and shoplifting are more prevalent. I'd say with the advent of security tags on merchandice, all the cameras, there HAS to be a lot less, or today's thieves are smarter than your grandpa's thieves.
I don't think you can blame immigration on it, not in the US at least. We have always been a nation of immigrants.
I know that when I was a teenager, kids were as awful as they are today. And you don't hear about lynchings, or hear the word "nigger", at least not from white people. I'm not sure people are more dishonest than then.
I do know that geezers are a hell of a lot nastier than they were back then. Rich peole are nastier too.
Ahem...taken from the last Crypto-Gram: (Score:4, Interesting)
The Seven Habits of Highly Ineffective Terrorists
[...]
Conventional wisdom holds that terrorism is inherently political, and that people become terrorists for political reasons. This is the "strategic" model of terrorism, and it's basically an economic model. It posits that people resort to terrorism when they believe -- rightly or wrongly -- that terrorism is worth it; that is, when they believe the political gains of terrorism minus the political costs are greater than if they engaged in some other, more peaceful form of protest. It's assumed, for example, that people join Hamas to achieve a Palestinian state; that people join the PKK to attain a Kurdish national homeland; and that people join al-Qaida to, among other things, get the United States out of the Persian Gulf.
If you believe this model, the way to fight terrorism is to change that equation, and that's what most experts advocate. Governments tend to minimize the political gains of terrorism through a no-concessions policy; the international community tends to recommend reducing the political grievances of terrorists via appeasement, in hopes of getting them to renounce violence. Both advocate policies to provide effective nonviolent alternatives, like free elections.
Historically, none of these solutions has worked with any regularity. Max Abrahms, a predoctoral fellow at Stanford University's Center for International Security and Cooperation, has studied dozens of terrorist groups from all over the world. He argues that the model is wrong. In a paper published this year in International Security that -- sadly -- doesn't have the title "Seven Habits of Highly Ineffective Terrorists," he discusses, well, seven habits of highly ineffective terrorists. These seven tendencies are seen in terrorist organizations all over the world, and they directly contradict the theory that terrorists are political maximizers:
Terrorists, he writes, (1) attack civilians, a policy that has a lousy track record of convincing those civilians to give the terrorists what they want; (2) treat terrorism as a first resort, not a last resort, failing to embrace nonviolent alternatives like elections; (3) don't compromise with their target country, even when those compromises are in their best interest politically; (4) have protean political platforms, which regularly, and sometimes radically, change; (5) often engage in anonymous attacks, which precludes the target countries making political concessions to them; (6) regularly attack other terrorist groups with the same political platform; and (7) resist disbanding, even when they consistently fail to achieve their political objectives or when their stated political objectives have been achieved.
Abrahms has an alternative model to explain all this: People turn to terrorism for social solidarity. He theorizes that people join terrorist organizations worldwide in order to be part of a community, much like the reason inner-city youths join gangs in the United States.
The evidence supports this. Individual terrorists often have no prior involvement with a group's political agenda, and often join multiple terrorist groups with incompatible platforms. Individuals who join terrorist groups are frequently not oppressed in any way, and often can't describe the political goals of their organizations. People who join terrorist groups most often have friends or relatives who are members of the group, and the great majority of terrorist are socially isolated: unmarried young men or widowed women who weren't working prior to joining. These things are true for members of terrorist groups as diverse as the IRA and al-Qaida.
For example, several of the 9/11 hijackers planned to fight in Chechnya, but they didn't have the right paperwork so they attacked America instead. The mujahedeen had no idea whom they would attack after the Soviets withdrew from Afghanistan, so they sat around until they came up with a new enemy: America. Pakistani terrorists regularly defect to another terro
Re:Bruce Almightly (Score:3, Interesting)
What I have a problem with is the security pundits who add no real value to the discussion besides stating the obvious . His success today is more like that of an IT pop star preaching to the choir. Anger and jealousy don't fit into it....I can admire his past achievements and disagree with his current approach at the same time.
I think I can shed some light on this. Bruce's job is to convince your boss about the stuff you already know. Your boss will believe Bruce because 1) he's Bruce and 2) he's not you. I don't mean you specifically, but you the underling of an average IT manager. In this case, you are an idiot. In your specific case, your $20K probably fixed your boss (I'm overgeneralizing but this kind of thing happens frequently).
In short, Bruce serves a useful function. And I run all my ssh sessions '-c blowfish'.