Bruce Schneier Reflects on a Decade of Security Trends
Author, blogger, cryptographer and security luminary Bruce Schneier shares his opinions on the trends and technology of the last 10 years in information security.
Share your opinion on the most important trend(s) of the last decade; technology trends, as well as overall strategic/business trends?
Bruce Schneier: The most amazing thing about the last ten years is how little things have changed technologically. Firewalls, IDSs, worms and viruses, spam, denial of service: they’re all still here. Sure, there have been technological advances in both attacks and defences – phishing is relatively new, for example – but for the most part we’re using the same technological defences against the same technological attacks.
What has changed is the business motivations. Security is now big business, both on the attackers’ side and on the defenders’. We’re seeing more criminal attackers and more criminally motivated hacking. And, at the same time, IT security is something that the CEO now cares about. This is the engine that forces real technological change. We’re already seeing very sophisticated and professionally written malware, and business is starting to demand better security products.
Many have cited compliance mandates—Sarbanes-Oxley in particular—as having the most impact on the security industry. A) Do you agree? B) Does the need for regulation demonstrate a failure of security to carry out its responsibilities?
Schneier: For years, we in the security industry have been futilely trying to convince companies to pay more attention to their security. Basically, there are two purchasing motivators out there, fear and greed, and security has always been a fear sell. But greed sells much better. Whenever you see slogans like “we take care of security so you can take care of your business,” you can be sure that some consulting firm has told that company to try to turn security into a greed sell. It never works. ROI models never convince, either. Security is fundamentally a fear sell, and so it doesn’t sell very well.
Regulation—SOX, HIPAA, GLB, the credit-card industry’s PCI, the various disclosure laws, the European Data Protection Act, whatever—has been the best stick the industry has found to beat companies over the head with. And it works. Regulation forces companies to take security more seriously, and sells more products and services.
Applied Cryptography or Beyond Fear? Which is your favourite and why (probably like choosing a favourite child, I know)?
Schenier: They’re so different, it’s hard to even make a comparison. Applied Cryptography was a book written for engineers and programmers. It was published in 1993, in the early days of the popular Internet. It was also the zenith of the “crypto wars,” when the U.S. government wanted to ban strong cryptography. I wanted to make cryptography understandable and accessible, and foster its ubiquity in computer and communications systems.
Beyond Fear was written for everyone; my mother was my target audience. It was published in 2003, during the height of the post 9/11 stupid-security madnesss. I wanted to make security understandable and accessible, to foster rational debate instead of fear mongering.
What is legacy/lasting impact of each of those books?
Schneier: I think they both accomplished their task. Applied Cryptography did foster the inclusion of cryptography in many, many commercial products around the world. Many of those systems weren’t very good, unfortunately, but that’s another story. And Beyond Fear has succeeded in helping people understand security trade-offs, debate security options, and—in general—think about security.
Both books are still selling well today, which is a legacy in itself. But the most complementary thing anyone can say about my books, and my writing in general, is: “You changed the way I think.” The most important legacy of Applied Cryptography is the number of people who entered the security industry because they read it, and the most important legacy of Beyond Fear is the number of people who see the world of security differently, and more sceptically, and more rationally, because they read it.
Cryptography was once illegal, now it’s encouraged as business best practice, and some regulations punish companies for not using it to protect data. What was the turning point here, in your opinion?
Schneier: Electronic commerce was the killer app for cryptography, and that’s what forced it out of the shadows and into the mainstream. But really, we won the crypto war because cryptography doesn’t matter nearly as much as we thought. Back in the mid-1990s, we thought cryptography would protect our data from outsiders. But the real problems are in computer and network security. It doesn’t matter how good your encryption is if the bad guys installed a Trojan on your computer, or a keylogger. Or if they can guess your encryption key. I think the FBI realised, a couple of years before we all did, that cryptography wasn’t all that important.
I can remember a presentation you did at RSA about 5 years ago when you predicted big things for cyber insurance and how liability would drive a change in secure software development. What factors have gotten in the way of this happening? Do you think this idea still has legs?
Schneier: I still give talks about liability and the computer industry. Liability is coming—there’s no way we can transition to a traditional, mature industry without it—and with liability comes insurance. It’s just taking slower than I expected, probably because things are still moving too fast. I think the transition to software-as-a-service will foster liability more. If you’re running my application and hosting my data, it’s much more obvious that you’re liable if something goes badly wrong. And once that becomes the norm, insurance will step in to reduce that liability risk.
You’ve written a lot lately about the psychology of security and tried to teach people how to think about security. How can a CISO apply what you’ve written and researched to tweak or redefine their security programs?
Schneier: If there’s one thing I’ve learned in all my research into human psychology and how we deal with security, risk, trade-off, costs, and decision making, it’s that people are not rational. On the one hand, this is obvious. On the other hand, we who work with computers like to pretend that people are just semantic computers: logical, rational, and so on. It’s just not true. People make decisions in completely irrational ways, breaking all sorts of rules of logic while doing so. Our brains are weirdly engineered, with overlapping systems, fail-safe overrides, memory glitches, and systemic bugs. And while we are superbly engineered for the cognitive problems that arise while living in small family groups in the East African highlands in 100,000 BC, we’re much less suited to 2007 New York.
And when I lecture CISOs on the psychology of security, my goal is for them to leave thinking differently about how people think. Because if you don’t get the psychology right, your security system will fail regardless of how good the technology is.
Categories: Text, Written Interviews