Page 1 of 1
In the episode that aired on May 9th, about eight or nine minutes in, there’s a scene with a copy of Applied Cryptography prominently displayed on the coffee table.
This isn’t the first time that my books have appeared on that TV show.
Two of my books can be seen in the background in CBS’ new Sherlock Holmes drama, Elementary. Copies of Schneier on Security and Secrets & Lies are prominently displayed on Sherlock Holmes’ bookshelf. You can see them in the first few minutes of the pilot episode. The show’s producers contacted me early on to ask permission to use my books, so it didn’t come as a surprise, but it’s still a bit of a thrill.
Here’s a listing of all the books visible on the bookshelf.
There’s a discussion on Slashdot about the security of code signing, and particularly my comments on the topic in the book Secrets and Lies.
Even though it’s five years old, here’s a new review of my previous book: Secrets and Lies.
In both Secrets and Lies and Beyond Fear, I discuss a key difference between attackers and defenders: the ability to concentrate resources. The defender must defend against all possible attacks, while the attacker can concentrate his forces on one particular avenue of attack. This precept is fundamental to a lot of security, and can be seen very clearly in counterterrorism. A country is in the position of the interior; it must defend itself against all possible terrorist attacks: airplane terrorism, chemical bombs, threats at the ports, threats through the mails, lone lunatics with automatic weapons, assassinations, etc, etc, etc. The terrorist just needs to find one weak spot in the defenses, and exploit that. This concentration versus diffusion of resources is one reason why the defender’s job is so much harder than the attackers.
This same principle guides security questioning at the Ben Gurion Airport in Israel. In this example, the attacker is the security screener and the defender is the terrorist. (It’s important to remember that “attacker” and “defender” are not moral labels, but tactical ones. Sometimes the defenders are the good guys and the attackers are the bad guys. In this case, the bad guy is trying to defend his cover story against the good guy who is attacking it.)
Security is impressively tight at the airport, and includes a potentially lengthy interview by a trained security screener. The screener asks each passenger questions, trying to determine if he’s a security risk. But instead of asking different questions—where do you live, what do you do for a living, where were you born—the screener asks questions that follow a storyline: “Where are you going? Who do you know there? How did you meet him? What were you doing there?” And so on.
See the ability to concentrate resources? The defender—the terrorist trying to sneak aboard the airplane—needs a cover story sufficiently broad to be able to respond to any line of questioning. So he might memorize the answers to several hundred questions. The attacker—the security screener—could ask questions scattershot, but instead concentrates his questioning along one particular line. The theory is that eventually the defender will reach the end of his memorized story, and that the attacker will then notice the subtle changes in the defender as he starts to make up answers.
Sidebar photo of Bruce Schneier by Joe MacInnis.