The New School of Information Security [Hardcover]

 

 

Create your own review

As an information security professional, I enjoyed reading this book. The authors present a somewhat compelling case for a scientific approach to information security that emphasizes decision making based on empirical evidence, public disclosure of breach data as a means of gathering that evidence, and the application of methods and concepts from other disciplines such as economics, psychology, and sociology to information security problems.

In the first part of the book, the authors attempt to make the case that information security as a discipline is failing. High profile examples of various forms of computer crime, spam, phishing, malware, data breaches, and identity theft are cited as evidence. While the material makes for interesting reading, it falls somewhat short of making a convincing argument that the bad guys are winning the war on all fronts. I would have liked to see more solid evidence that the current approaches are not working. Has anti-virus technology truly failed to stem the tide of malware? Are there any statistics on that? What about anti-spam measures? Surely, not everything that the security industry has been up to until now has been a waste of time?

The current state of the security industry is examined next. Some criticism of the security industry is certainly warranted. The proliferation of questionable products which are more marketing hype than substance is a phenomenon that has parallels in other domains as well. One need only look at the world of high-end audio, where ridiculously expensive snake-oil products are sold to eager buyers who convince themselves that they can hear the difference in sound quality that these products purportedly afford them. However, this observation does not justify the wholesale rejection of all security products on the market and the security practices they facilitate. Just as technology alone cannot solve most real-world security problems, neither can most security failures be blamed on technology alone.

Several potential sources of empirical data are evaluated in the third and fourth chapter. Surveys are largely dismissed as flawed. The value of data from trade publications is questioned due to issues of timeliness and relevance to individual organizations. Software vulnerability data is given a little more respect, although the challenge to drawing meaningful conclusions from it remains largely unsolved. Instrumentation on the Internet in the form of honeypots and other security sensors is described as a promising source of evidence. In a similar vein, breach data locked up within the confines of individual organizations would constitute a veritable goldmine if shared freely, and this is expanded upon in the following chapter. The authors conclude with the observation that while objective evidence is very difficult to come by, the search for it must become the central focus for the "new school".

The fifth chapter is an interesting illustration of the explanatory power that a multi-disciplinary approach can bring to the problems of information security. Economic theory is used to elucidate the reasons for the proliferation of insecure software, the resistance to adoption of many security technologies and the failure to stop spam. Concepts from psychology are applied to the problems of patching software vulnerabilities and the management of security risks. The sociological problem of gender bias and lack of ethnic diversity within the computer security community is explored in terms of its exclusionary effect on new insights and fresh ways of thinking about information security.

Information security spending is analyzed in chapter six. Several emerging business drivers, such as creating customer trust and the benefits of security capabilities on IT operations efficiency, are described and may be of interest to readers faced with the challenge of selling security within their own organizations. Traditional approaches to security spending are discussed and sometimes rightfully criticized. An interesting recommendation is made: based on a study by Gordon and Loeb at the University of Maryland, the optimal amount to spend on the protection of an asset is 37% of the expected loss. Psychological factors influencing spending decisions are examined. The cost-effectiveness of employee security awareness and training is questioned, as is the return on investment from the development of a comprehensive security policy framework. This chapter is likely to be the most controversial one in the eyes of many security practitioners who are not technologists.

If I have been somewhat skeptical of the early parts of the book, I wholeheartedly agree with the overall message in the final two chapters. It is certainly worthwhile to explore new directions in information security, and a scientific, multi-disciplinary approach holds much promise for the future. The "new school" mind-set can only be a positive influence on the industry and I would not hesitate to recommend this book to anyone in the information security profession.

Share your thoughts with other customers: Create your own review

› See the customer review...

 

Search Customer Reviews
Only search this product's reviews

Search Listmania!