Schneier on Security

Let’s assume for a moment that you are not a techie or a hacker. You’re browsing in a bookstore and happen to pick up a copy of Secrets and Lies: Digital Security in a Networked World (John Wiley & Sons, $29.99). As you idly flip through it, all you see are dense paragraphs on arcana: the role of symmetric algorithms in encryption systems, the relative merits of code signing and access control at the interfaces, and what a one-way hash function does. Whoa! This is way over your head, you think, as you sheepishly put the book down and look for the latest Grisham thriller…

Bruce Schneier, author of Applied Cryptography, reportedly shelved the unfinished manuscript for his latest book, Secrets and Lies ($29.99, Wiley), because it was too depressing. He let it sit for two years, derailed by the fact that, for all he knew about threats to security in the digital age, he could offer no truly effective solutions. Cryptography, he discovered, was not the answer. As he put it, “Mathematics is perfect; reality is subjective. Mathematics is defined; computers are ornery. Mathematics is logical; people are erratic, capricious, and barely comprehensible.”…

Rarely does an author start out telling you about the mistakes he made in his previous book. But that’s exactly what Bruce Schneier does in Secrets & Lies: Digital Security In A Networked World.

Schneier is chief technology officer and co-founder of Counterpane Internet Security Inc., San Jose, CA. He also is the author of Applied Cryptography (John Wiley & Sons Inc., 1994), which he says mistakenly stated that cryptography, based on logical mathematics, was the great technological equalizer that could provide individuals and businesses with data security. At the beginning of …

In April 1999, Bruce Schneier, mathematician, digital security expert and unlikely hacker-scene hero, had an epiphany. It prodded him to reorganize this company, Counterpane Internet Security, and altered his view of securing computer systems. The fruits of that thinking also make up the bulk of his engaging and exhaustive new book, Secrets and Lies: Digital Security in a Networked World.

Schneier, the creator of two widely used data-scrambling formulas and author of the definitive Applied Cryptography, realized that he and his colleagues were trained to view security as a hopeless prophylactic, a passive approach that relies too heavily on complex technologies to keep hackers and criminals out. “Too many system designers think about security design as a cookbook thing,” writes Schneier. Add a firewall and a pinch of encryption, and eventually you’ll have a secure system…

You have to respect an author who begins a book by confessing that he wrote it “partly to correct a mistake,” especially when that author is one of the most respected authorities in a highly technical field. That’s exactly how Bruce Schneier begins his new book on computer security, Secrets and Lies: Digital Security in a Networked World (John Wiley & Sons, Inc. New York. 2000). What he is actually confessing is a kind of naiveté shared by altogether too many people regarding computer security: that technology is the answer. That was the implied thesis of his earlier book on applied cryptography, still an excellent guide to the guts of cryptographic systems…

Internationally recognized computer security expert Bruce Schneier offers a practical, straightforward guide to achieving security throughout computer networks. Schneier uses his extensive field experience with his own clients to dispel the myths that often mislead IT managers as they try to build secure systems. This practical guide provides readers with a better understanding of why protecting information is harder in the digital world, what they need to know to protect digital information, how to assess business and corporate security needs, and much more…