Beyond Fear: Thinking Sensibly About Security in an Uncertain World
A “professional thinker about security” and author of Applied Cryptography (1994), said to have sold >200,000 copies, applies the methods developed for computer security to broader security issues, especially security against terrorism. “Security issues affect us more and more in our daily lives, and we should all make an effort to understand them better. We need to stop accepting uncritically what politicians and pundits are telling us. We need to move beyond fear and start making sensible security trade-offs.” Everyone makes security trade-offs, every day. We live our lives making judgments, assessments, assumptions, and choices about security (e.g., when we lock the door to our home, we make a security trade-off: the inconvenience of using a key in exchange for some security against burglary). Making security trade-offs isn’t some mystical art: “the goal of this book is to demystify security, to help you move beyond fear.” To get beyond fear, you have to start thinking intelligently about trade-offs, the risks you face, and the options for dealing with those risks. A lot of lousy security is available for purchase, and a lot of lousy security is imposed on us by government. Once we move beyond fear, we can recognize bad or overpriced security.
No security is foolproof, but neither is all security equal. There’s cheap security and expensive security, unobtrusive security and security that forces change in how we live. There’s security that respects our liberties and security that doesn’t. “A common path to bad security is knee-jerk reactions to the news of the day. Too much of the US government’s response post-9/11 is exactly that.” Most of the changes we’re being asked to endure won’t result in good security. They’re Band-Aids that ignore the real problems. “Security is always a trade-off, and to ignore or deny those trade-offs is to risk losing basic freedoms and ways of life we now take for granted.” Security exists to deal with a few bad apples. It’s a tax on the honest. Perfect security is impractical because the costs are too high. Despite a plethora of security systems in every aspect of our lives, “none of these systems is perfect.” The challenge is to figure out what to keep, what to alter, what to toss and what to build from scratch. The status quo is never fine, because security is never done. It has no beginning and no end. “Words like ‘always’ and ‘never,’ when used to describe security solutions, are major contributors to bad security decisions.”
A five-step process is used to analyze and evaluate security systems, technologies, and practices: 1) What assets are you trying to protect? 2) What are the risks to these assets? 3) How well does the security solution mitigate those risks? 4) What other risks does the security solution cause (in that most solutions cause new problems)? 5) What costs and trade-offs does the security solution impose? [NOTE: Simply-written, with wisdom for everyone, at every level—from personal and family security to organization and nation. Schneier’s ideas were profiled in “Homeland Insecurity” by Charles C. Mann (The Atlantic Monthly, Sept. 2002, 82-102).]
Categories: Beyond Fear, Text