Introduction xv
1 The Business and Economics of Security 1
Consolidation: Plague or Progress 1
Prediction: RSA Conference Will Shrink Like a Punctured Balloon 2
How to Sell Security 4
Why People Are Willing to Take Risks 4
How to Sell Security 6
Why Do We Accept Signatures by Fax? 7
The Pros and Cons of LifeLock 9
The Problem Is Information Insecurity 12
Security ROI: Fact or Fiction? 14
The Data Imperative 15
Caveat Emptor 16
Social Networking Risks 17
Do You Know Where Your Data Are? 18
Be Careful When You Come to Put Your Trust in the Clouds 21
Is Perfect Access Control Possible? 22
News Media Strategies for Survival for Journalists 24
Security and Function Creep 26
Weighing the Risk of Hiring Hackers 27
Should Enterprises Give In to IT Consumerization at the Expense of Security? 29
The Vulnerabilities Market and the Future of Security 30
So You Want to Be a Security Expert 33
When It Comes to Security, Were Back to Feudalism 34
I Pledge Allegiance to the United States of Convenience 35
The Good, the Bad, and the Ugly 36
You Have No Control Over Security on the Feudal Internet 37
2 Crime, Terrorism, Spying, and War 41
Americas Dilemma: Close Security Holes, or Exploit Them Ourselves 41
Are Photographers Really a Threat? 43
CCTV Doesnt Keep Us Safe, Yet the Cameras Are Everywhere 45
Chinese Cyberattacks: Myth or Menace? 47
How a Classic Man-in-the-Middle Attack Saved Colombian Hostages 48
How to Create the Perfect Fake Identity 51
A Fetishistic Approach to Security Is a Perverse Way to Keep Us Safe 52
The Seven Habits of Highly Ineffective Terrorists 54
Why Society Should Pay the True Costs of Security 56
Why Technology Wont Prevent Identity Theft 58
Terrorists May Use Google Earth, but Fear Is No Reason to Ban It 60
Thwarting an Internal Hacker 62
An Enterprising Criminal Has Spotted a Gap in the Market 65
We Shouldnt Poison Our Minds with Fear of Bioterrorism 66
Raising the Cost of Paperwork Errors Will Improve Accuracy 68
So-Called Cyberattack Was Overblown 70
Why Framing Your Enemies Is Now Virtually Childs Play 72
Beyond Security Theater 73
Feeling and Reality 74
Refuse to Be Terrorized 76
Cold War Encryption Is Unrealistic in Todays Trenches 77
Profiling Makes Us Less Safe 80
Fixing Intelligence Failures 81
Spy Cameras Wont Make Us Safer 82
Scanners, Sensors Are Wrong Way to Secure the Subway 84
Preventing Terrorist Attacks in Crowded Areas 86
Where Are All the Terrorist Attacks? 87
Hard to Pull Off 88
Few Terrorists 88
Small Attacks Arent Enough 89
Worst-Case Thinking Makes Us Nuts, Not Safe 89
Threat of Cyberwar Has Been Hugely Hyped 92
Cyberwar and the Future of Cyber Conflict 94
Why Terror Alert Codes Never Made Sense 96
Debate Club: An International Cyberwar Treaty Is the Only Way to Stem the Threat 97
Overreaction and Overly Specific Reactions to Rare Risks 99
Militarizing Cyberspace Will Do More Harm Than Good 101
Rhetoric of Cyber War Breeds Fearand More Cyber War 103
Attacks from China 103
GhostNet 104
Profitable 105
The Boston Marathon Bombing: Keep Calm and Carry On 105
Why FBI and CIA Didnt Connect the Dots 107
The FBIs New Wiretapping Plan Is Great News for Criminals 109
US Offensive Cyberwar Policy 112
3 Human Aspects of Security 117
Secret Questions Blow a Hole in Security 117
When You Lose a Piece of Kit, the Real Loss Is the Data It Contains 118
The Kindness of Strangers 120
Blaming the User Is EasyBut Its Better to Bypass Them Altogether 122
The Value of Self-Enforcing Protocols 123
Reputation Is Everything in IT Security 125
When to Change Passwords 127
The Big Idea: Bruce Schneier 129
High-Tech Cheats in a World of Trust 131
Detecting Cheaters 134
Lance Armstrong and the Prisoners Dilemma of Doping in Professional Sports 137
The Doping Arms Race as Prisoners Dilemma 138
The Ever-Evolving Problem 139
Testing and Enforcing 140
Trust and Society 141
How Secure Is the Papal Election? 143
The Court of Public Opinion 147
On Security Awareness Training 150
Our New Regimes of Trust 152
4 Privacy and Surveillance 155
The Myth of the Transparent Society 155
Our Data, Ourselves 157
The Future of Ephemeral Conversation 158
How to Prevent Digital Snooping 160
Architecture of Privacy 162
Privacy in the Age of Persistence 164
Should We Have an Expectation of Online Privacy? 167
Offhand but On Record 168
Googles and Facebooks Privacy Illusion 171
The Internet: Anonymous Forever 173
A Taxonomy of Social Networking Data 175
The Difficulty of Surveillance Crowdsourcing 177
The Internet Is a Surveillance State 179
Surveillance and the Internet of Things 181
Government Secrets and the Need for Whistleblowers 184
Before Prosecuting, Investigate the Government 187
5 Psychology of Security 189
The Security Mindset 189
The Difference between Feeling and Reality in Security 191
How the Human Brain Buys Security 194
Does Risk Management Make Sense? 195
How the Great Conficker Panic Hacked into Human Credulity 197
How Science Fiction Writers Can Help, or Hurt, Homeland Security 198
Privacy Salience and Social Networking Sites 201
Security, Group Size, and the Human Brain 203
People Understand RisksBut Do Security Staff Understand People? 205
Natures Fears Extend to Online Behavior 206
6 Security and Technology 209
The Ethics of Vulnerability Research 209
Ive Seen the Future, and It Has a Kill Switch 211
Software Makers Should Take Responsibility 212
Lesson from the DNS Bug: Patching Isnt Enough 214
Why Being Open about Security Makes Us All Safer in the Long Run 216
Boston Courts Meddling with Full Disclosure Is Unwelcome 218
Quantum Cryptography: As Awesome as It Is Pointless 220
Passwords Are Not Broken, but How We Choose Them Sure Is 222
Americas Next Top Hash Function Begins 223
Tigers Use Scent, Birds Use CallsBiometrics Are Just Animal Instinct 225
The Secret Question Is: Why Do IT Systems Use Insecure Passwords? 227
The Pros and Cons of Password Masking 229
Technology Shouldnt Give Big Brother a Head Start 231
Lockpicking and the Internet 233
The Battle Is On against Facebook and Co. to Regain Control of Our Files 235
The Difficulty of Un-Authentication 237
Is Antivirus Dead? 238
Virus and Protocol Scares Happen Every Day but Dont Let Them Worry You 240
The Failure of Cryptography to Secure Modern Networks 242
The Story behind the Stuxnet Virus 244
The Dangers of a Software Monoculture 247
How Changing Technology Affects Security 249
The Importance of Security Engineering 251
Technologies of Surveillance 253
When Technology Overtakes Security 255
Rethinking Security 255
7 Travel and Security 259
Crossing Borders with Laptops and PDAs 259
The TSAs Useless Photo ID Rules 261
The Two Classes of Airport Contraband 262
Fixing Airport Security 264
Laptop Security while Crossing Borders 265
Breaching the Secure Area in Airports 268
Stop the Panic on Air Security 269
A Waste of Money and Time 271
Why the TSA Cant Back Down 273
The Trouble with Airport Profiling 275
8 Security, Policy, Liberty, and Law 279
Memo to Next President: How to Get Cybersecurity Right 279
CRB Checking 281
State Data Breach Notification Laws: Have They Helped? 283
How to Ensure Police Database Accuracy 285
How Perverse Incentives Drive Bad Security Decisions 287
Its Time to Drop the Expectation of Privacy Test 288
Who Should Be in Charge of Cybersecurity? 291
Coordinate, but Distribute Responsibility 294
Zero Tolerance Really Means Zero Discretion 295
US Enables Chinese Hacking of Google 297
Should the Government Stop Outsourcing Code Development? 299
Punishing Security Breaches 300
Three Reasons to Kill the Internet Kill Switch Idea 302
Internet without Borders 302
Unpredictable Side Effects 303
Security Flaws 303
Web Snooping Is a Dangerous Move 304
The Plan to Quarantine Infected Computers 307
Close the Washington Monument 310
Whitelisting and Blacklisting 312
Securing Medical Research: a Cybersecurity Point of View 313
Fear Pays the Bills, but Accounts Must Be Settled 317
Power and the Internet 319
Danger Lurks in Growing New Internet Nationalism 321
IT for Oppression 323
The Public/Private Surveillance Partnership 325
Transparency and Accountability Dont Hurt Security Theyre Crucial to It 327
Its Smart Politics to Exaggerate Terrorist Threats 329
References 333
Index 347
