The New School of Information Security

• Cover Type: Hard Cover with 288 pages
• Published by: Addison-Wesley Professional
• Edition: 1st Edition April 5, 2008
• Written in: English
• ISBN 10 Number: 0321502787
• ISBN 13 Number: 978-0321502780
• Book Dimensions: 9 x 6.1 x 1.3 inches
• Weighs: 1.3 pounds

--David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems

Why is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It’s about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don’t just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you’re a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises.

• Better evidence for better decision-making
  Why the security data you have doesn’t support effective decision-making--and what to do about it
• Beyond security “silos”: getting the job done together
  Why it’s so hard to improve security in isolation--and how the entire industry can make it happen and evolve
• Amateurs study cryptography; professionals study economics
  What IT security leaders can and must learn from other scientific fields
• A bigger bang for every buck
  How to re-allocate your scarce resources where they’ll do the most good

Adam Shostack is part of Microsoft’s Security Development Lifecycle strategy team, where he is responsible for security design analysis techniques. Before Microsoft, Adam was involved in a number of successful start-ups focused on vulnerability scanning, privacy, and program analysis. He helped found the CVE, International Financial Cryptography association, and the Privacy Enhancing Technologies workshop. He has been a technical advisor to companies including Counterpane Internet Security and Debix.

Andrew Stewart is a Vice President at a US-based investment bank. His work on information security topics has been published in journals such as Computers & Security and Information Security Bulletin. His homepage is homepage.mac.com/andrew_j_stewart

Reader Reviews
If you don't "get" Allan Schiffman's 2004 phrase "amateurs study cryptography; professionals study economics," if you don't know who Prof. Ross Anderson is, and if you think anti-virus and a firewall are required simply because they are "best practices," you need to read The New School of Information Security (TNSOIS). If you already recognize why I highlight these issues, you will not find much beyond an explanation of these central tenets in TNSOIS. Authors Adam Shostack and Andrew Stewart do a good job summarizing the problems with the worldview held by many in the digital security industry. While they fairly effectively demolish current mindsets, they don't do much to provide actionable next steps. For example, the book jacket teases us with statements like "Why the security data you have doesn't support effective decision-making -- and what to do about it" and "How to re-allocate your scare resources where they'll do the most good." I read that most of what the industry does is broken, but not much beyond general ideas like these from the end of Ch 6: "When considering spending on a security product, a useful first question to ask is whether the core capabilities that the product would provide are already available within the organization's IT structure... Another framing question to consider is whether the security functionality you want will be delivered at some point in the future within the infrastructure that the organization already owns or expects to own" (pp 126-7). This isn't very "new school" to me, i.e., don't buy what you already have or expect to have soon. Similarly, the "Call to Action" in Ch 8 boils down to "Gather Good Data," "Analyze Good Data," and "Seek New Perspectives," but aside from breach data, we aren't given much else to follow. Sections like this make me think TNSOIS could have been more of a pamphlet than a book, but I shouldn't take for granted that many people don't think like the authors. I thought it ironic that a book praising the importance of evidence would place all of the references as endnotes at the back of the book. I laughed when I read on p x "we don't include endnote numbers in the text. We find those numbers distracting, and we hope you won't need them." Accurate documentation is the heart of good research, so a second edition or future works should put proper footnotes on each page. Readers usually ignore endnotes because it's a hassle to flip back and forth. When is the reader to know an endnote even exists, if the text has been stripped of endnote numbers? We do need more security books that teach "how to think," instead of "how to configure a firewall." I wonder if books like "Cyber Security: Economic Strategies and Public Policy Alternatives" by Gallaher, Link, and Rowe might provide a stronger empirical rationale for the ideas we read in TNSOIS. I'd like to leave the authors with one thought. The back jacket asks "Why is information security so disfunctional? Are you wasting the money you spend on security?" I don't see real data (of the kind I'd expect the authors would demand elsewhere) justifying the "disfunction" aspect, although my "gut" sympathizes with this assessment. That doesn't satisfy an evidence-based approach, however. Maybe disfunction should be empirically demonstrated before foundations for a "New School" are deployed?