Schneier on Security

Bruce Schneier has increased BT’s press mentions in the North American press by 21% since the UK telecom giant’s acquisition of his firm Counterpane one year ago. BT insists that the acquisition ran smoothly and that the two companies are working well together, and Bruce tells us that the Counterpane people are happy. But it seems there are a few creases in the BT Counterpane story that still need to be ironed out—Bruce’s job title being the first.

“I thought that by now I’d have had a BT title, but find me the person to give me one,” Schneier said, speaking to Infosecurity at the RSA Conference on 23 October. “You see I’m not going to lose my CTO Counterpane title—it’s a good title. But I think they’d [BT] be smart to make me something in BT. But it has to be a title equally good or I’m not going to give this one up. She [talking about BT’s PR representative who accompanied Bruce at the interview] says you just do it, but I don’t know what that means. There has to be someone who says yes and no-one knows who that someone is.”…

Bruce Schneier packed out the show’s keynote theatre when he spoke about ‘The Psychology of Security’, based on a draft essay he published in February. He outlined a range of research suggesting that our perceptions of a given risk are heightened if it is – among other things – spectacular, discussed widely, outside our normal experience or willingly taken rather than beyond our control. Such biases are ideal for hunter-gatherers living in small family groups in Kenya in 100 000BC, he argues, but not for modern life.

So how does this apply to infosecurity risks? “The obvious place is the people who are afraid of cyber-terrorism, while minimising cyber-crime,” he says. “Cyber-terrorism gets the news, it’s the hot topic, it’s the scary topic and people are afraid of it. Cyber-crime doesn’t get as much news, and I think people very much underplay that threat. You see it also when people overplay the threat of peer-to-peer, or they get all scared of people bringing their iPods in and maybe putting data on it. They forget that data could walk out on paper. So there is a lot of people reacting to the news, instead of to the reality of security. Now, it’s hard to blame them. This is what’s reported, this is what people worry about, but I think there’s a big difference in how people perceive internet security and what’s really going on…