Beyond Fear: Thinking Sensibly About Security in an Undertain World


If you are a security practitioner, this is the book you should recommend to your friends and relatives.

You should also read this book yourself, to get a better handle on explaining Security issues to non-security people, including executive management.

Chapter 3 is titled, "Security Trade-offs Depend on Power and Agenga." I give Schneier a lot of credit for being brave enough and astute enough to write in a helpful way about a dimension of security that all security practitioners experience, but few talk about. Here is the first paragraph in that chapter:

Most security decisions are complicated, involving multiple players with their own subjective assessments of security. Moreover, each of these players also has his own agenda, often having nothing to do with security, and some amount of power in relation to the other players. In analyzing any security situation, we need to assess these agendas and power relationships. The question istn't which system provides the optimal security trade-offs—rather, it's which sytem provides the optimal security trade-offs for which players.

This is a real-world book about security.

Schneier doesn't hesitate to point out our own general personal weaknesses and biases regarding security, to help improve our judgement and make us better "consumers" of security. For example, Schneier says in Chapter 2, "More people are killed every year by pigs than by sharks, which shows you how good we are at evaluating risk."

Whether you are a security professional or not, this book will change the way you think about security, for the better.

—Ray Bernard


Here is what the book jacket has to say about the book:

In Beyond Fear, Bruce Schneier invites us to take a critical look at not just the threats to our security, but the ways in which we're encouraged to think about security by law enforcement agencies, businesses of all shapes and sizes, and our national governments and militaries. Schneier believes we all can and should be better security consumers, and that the trade-offs we make in the name of security—in terms of cash outlays, taxes, inconvenience, and diminished freedoms—should be part of an ongoing negotiation in our personal, professional, and civic lives, and the subject of an open and informed national discussion.

With a well-deserved reputation for original and sometimes iconoclastic thought, Schneier has a lot to say that is provocative, counter-intuitive, and just plain good sense. He explains in detail, for example, why we need to design security systems that don't just work well, but fail well, and why secrecy on the part of government often undermines security. He also believes, for instance, that national ID cards are an exceptionally bad idea: technically unsound, and even destructive of security. And, contrary to a lot of current nay-sayers, he thinks online shopping is fundamentally safe, and that many of the new airline security measure (though by no means all) are actually quite effective. A skeptic of much that's promised by highly touted technologies like biometrics, Schneier is also a refreshingly positive, problem-solving force in the often self-dramatizing and fear-mongering world of security pundits.

Schneier helps the reader to understand the issues at stake, and how to best come to one's own conclusions, including the vast infrastructure we already have in place, and the vaster systems--some useful, others useless or worse--that we're being asked to submit to and pay for.

Bruce Schneier is the author of seven books, including Applied Cryptography (which Wired called "the one book the National Security Agency wanted never to be published") and Secrets and Lies (described in Fortune as "startlingly lively...[a] jewel box of little surprises you can actually use."). He is also Founder and Chief Technology Officer of Counterpane Internet Security, Inc., and publishes Crypto-Gram, a free monthly e-mail newsletter on computer security and cryptography. Crypto-Gram is one of the most widely read newsletters in the field of online security.