What do you think?
Rate this book
Secrets and Lies: Digital Security in a Networked World
Viruses. Identity Theft. Corporate Espionage. National secrets compromised. Can anyone promise security in our digital world?
The man who introduced cryptography to the boardroom says no. But in this fascinating read, he shows us how to come closer by developing security measures in terms of context, tools, and strategy. Security is a process, not a product – one that system administrators and corporate executives alike must understand to survive.
This edition updated with new information about post-9/11 security.
The man who introduced cryptography to the boardroom says no. But in this fascinating read, he shows us how to come closer by developing security measures in terms of context, tools, and strategy. Security is a process, not a product – one that system administrators and corporate executives alike must understand to survive.
This edition updated with new information about post-9/11 security.
401 pages, Paperback
First published January 1, 2000
177 people are currently reading
2884 people want to read
About the author
Bruce Schneier
50 books639 followersBruce Schneier is a renowned security technologist, called a “security guru” by the Economist. He has written more than one dozen books, including the New York Times bestseller Data and Goliath (2014) and Click Here to Kill Everybody (2018). He teaches at the Harvard Kennedy School and lives in Cambridge, Massachusetts.
Ratings & Reviews
Friends & Following
Create a free account to discover what your friends think of this book!
Community Reviews
Displaying 1 - 30 of 74 reviews
July 9, 2018
Q:
In any case, the future does not look good. (c)
In any case, the future does not look good. (c)
April 29, 2021
This was a textbook for an information security class, and we didn’t read all of it over the course of the class, probably because it’s pretty old, and the prof only assigned chapters she thought were still relevant and good introductory explanations.
This is the third Schneier book I’ve read, and I think he’s very good at making technical subject matter accessible to a general audience. He also has a way of scaring the heck out of the reader about all the ways technology can go wrong, especially with baddies intentionally trying to break and ruin things. I would recommend his more recent work over this one, particularly Click Here to Kill Everybody, which is good for raising awareness of the issues surrounding a networked world.
This is the third Schneier book I’ve read, and I think he’s very good at making technical subject matter accessible to a general audience. He also has a way of scaring the heck out of the reader about all the ways technology can go wrong, especially with baddies intentionally trying to break and ruin things. I would recommend his more recent work over this one, particularly Click Here to Kill Everybody, which is good for raising awareness of the issues surrounding a networked world.
June 19, 2013
I've wanted to read a Bruce Schneier book for a long time and this particular one was well rated. I might have confused it with the similarly named Liars and Outliers, which came out much more recently. What I didn't realize when I bought Secrets and Lies it is that Schneier published it in 2000, so it's both an insightful look at computer security practices and a trip down foggy memory lane.
Most of the advice in this book is still perfectly valid, like the importance of intrusion detection in a world where perfect prevention is impossible. But some of it feels dated. It's especially enlightening to read what people were worried about 13 years ago. For example, do you remember that the US federal government spent most of the 1990s advocating legislation that required encryption key escrow? You'd have had to register your private keys (or some other backdoor keys) with Uncle Sam or an independent agency so that law enforcement could access your data when necessary if you wanted to use any sort of encryption. The policy makes no sense because it's basically unenforceable, and its popularity in political circles is a distant memory because of the idea's technical flaws.
But on the other hand Schneier has virtually nothing to say about later security issues like e-mail spam. If he'd published this book a mere three years later he'd probably have devoted a whole chapter to spam, not to mention to phishing attacks that he hints at but doesn't describe in depth -- certainly not with the inevitable references to Nigeria a mid-decade book would have had. Same goes for spyware and other browser-vulnerable malware that would so inundate Windows XP (pre-SP2) users due to the craptastic security architecture of Internet Explorer 6 (may it be deleted with extreme prejudice).
Still, an interesting read. The best bits are where he talks about Windows NT/2000 security: he really lets loose, and with ample justification.
Most of the advice in this book is still perfectly valid, like the importance of intrusion detection in a world where perfect prevention is impossible. But some of it feels dated. It's especially enlightening to read what people were worried about 13 years ago. For example, do you remember that the US federal government spent most of the 1990s advocating legislation that required encryption key escrow? You'd have had to register your private keys (or some other backdoor keys) with Uncle Sam or an independent agency so that law enforcement could access your data when necessary if you wanted to use any sort of encryption. The policy makes no sense because it's basically unenforceable, and its popularity in political circles is a distant memory because of the idea's technical flaws.
But on the other hand Schneier has virtually nothing to say about later security issues like e-mail spam. If he'd published this book a mere three years later he'd probably have devoted a whole chapter to spam, not to mention to phishing attacks that he hints at but doesn't describe in depth -- certainly not with the inevitable references to Nigeria a mid-decade book would have had. Same goes for spyware and other browser-vulnerable malware that would so inundate Windows XP (pre-SP2) users due to the craptastic security architecture of Internet Explorer 6 (may it be deleted with extreme prejudice).
Still, an interesting read. The best bits are where he talks about Windows NT/2000 security: he really lets loose, and with ample justification.
February 14, 2018
Simply put one can make career out of this book, if used wisely. This book gives a glimpse of the entire landscape, the past, present and future, of digital security in the networked world.
March 7, 2021
This legendary book came out in 2001, but has not lost any of it's pizzazz. It's a truly introductory book for the everyman who wants to get into the general security mindset. There are no equations, because it talks about humans and the naughty things they're up to.
It's especially fun to read in retrospect. Much remains the same, but much of the described "common sense security" has also sneaked into widespread casual use - password managers, Two-Factor Authentication, Estonian ID-card based on public key crypto, open source and public security protocols, global malware and cyberattacks, release buggy software and fix it afterwards. Furthermore, the mindset that security should be open source and available for public scrutiny, like public audits and hacker contests. Or companies and platforms offering bounties for vulnerabilities - those are everyday little improvements that have creeped from the pages of Schneier's books into reality and we're all better for it.
The book is from time when Windows 98, Internet Explorer, Netscape Navigator, Java 2 and applets, ISDN modems were a thing, but it doesn't matter as much, because the concepts still matter. And the major nostalgia is somewhat confined around Chapter 10.
I had a subject called "System Theory" in college. Never understood much of it or what it was talking about. Most of the class seemed to hover in the same region of "nonderstanding". It was so abstract. To me everything in life looked like a "system". Stop talking nonsense, professor. I even needed to retake the exam, because I failed hard on the first time. But now Schneier basically gives me the introduction to the subject I never had. Even though later one of my job titles has been a "system administrator". What a laugh.
What follows is probably a far too long list of quotes, but this book is such a gold mine that I can't help myself. Starting with the quote about "system theory".
Systems have several interesting properties relevant to this book.
First, they are complex. Machines are simple: a hammer, a door hinge, a steak knife. Systems are much more complicated; they have components, feedback loops, mean times between failure, infrastructure. Digital systems are daedal; even a simple computer program has hundreds of thousands of lines of computer code doing all sorts of different things. A complex computer program has thousands of components, each of which has to work by itself and in interaction with all the other components. This is why object-oriented programming was developed: to deal with the complexity of digital systems.
Second, systems interact with each other, forming even larger systems. This can happen on purpose—programmers use objects to deliberately break large systems down into smaller systems, engineers break large mechanical systems into smaller subsystems, and so on—and it can happen naturally. The invention of the automobile led to the development of the modern system of roads and highways, and this in turn interacted with other systems in our daily lives to produce the suburb. The air traffic control system interacts with the navigation systems on aircrafts, and the weather prediction system. The human body interacts with other human bodies and with the other systems on the planet. The Internet has intertwined itself with almost every major system in our society.
Third, systems have emergent properties. In other words, they do things that are not anticipated by the users or designers. The telephone system, for example, changed the way people interact. (Alexander Graham Bell had no idea that a telephone was a personal communications device; he thought you could use it to call ahead to warn that a telegram was coming.) Automobiles changed the way people meet, date, and fall in love. Environmental-control systems in buildings have effects on people’s health, which affects the health care system. Word processing systems have changed the way people write. The Internet is full of emergent properties; think about eBay, virtual sex, collaborative authoring.
And fourth, systems have bugs. A bug is a particular kind of failure. It’s an emergent property of a system, one that is not desirable. It’s different from a malfunction. When something malfunctions, it no longer works properly. When something has a bug, it misbehaves in a particular way, possibly unrepeatable, and possibly unexplainable. Bugs are unique to systems. Machines can break, or fail, or not work, but only a system can have a bug.
We in the computer security field like to think they’re enormous, but they haven’t really affected a company’s bottom line. From the CEO’s perspective, the risks include the possibility of bad press and angry customers and network downtime—none of which is permanent. And there’s some regulatory pressure, from audits or lawsuits, which adds additional costs. The result: a smart organization does what everyone else does, and no more. Things are changing; slowly, but they’re changing. The risks are increasing, and as a result spending is increasing.
This same kind of economic reasoning explains why software vendors spend so little effort securing their own products. We in computer security think the vendors are all a bunch of idiots, but they’re behaving completely rationally from their own point of view. The costs of adding good security to software products are essentially the same ones incurred in increasing network security—large expenses, reduced functionality, delayed product releases, annoyed users—while the costs of ignoring security are minor: occasional bad press, and maybe some users switching to competitors’ products. The financial losses to industry worldwide due to vulnerabilities in the Microsoft Windows operating system are not borne by Microsoft, so Microsoft doesn’t have the financial incentive to fix them. If the CEO of a major software company told his board of directors that he would be cutting the company’s earnings per share by a third because he was going to really—no more pretending—take security seriously, the board would fire him. If I were on the board, I would fire him. Any smart software vendor will talk big about security, but do as little as possible, because that’s what makes the most economic sense.
Firewalls are ubiquitous because corporate auditors started demanding them. This changed the cost equation for businesses. The cost of adding a firewall was expense and user annoyance, but the cost of not having a firewall was failing an audit. And even worse, a company without a firewall could be accused of not following industry best practices in a lawsuit. The result: everyone has firewalls all over their network, whether they do any actual good or not.
STEP ONE: ENFORCE LIABILITIES
STEP TWO: ALLOW PARTIES TO TRANSFER LIABILITIES
STEP THREE: PROVIDE MECHANISMS TO REDUCE RISK
There’s no reason to treat software any differently from other products. Today Firestone can produce a tire with a single systemic flaw and they’re liable, but Microsoft can produce an operating system with multiple systemic flaws discovered per week and not be liable. Today if a home builder sells you a house with hidden flaws that make it easier for burglars to break in, you can sue the home builder; if a software company sells you a software system with the same problem, you’re stuck with the damages. This makes no sense, and it’s the primary reason computer security is so bad today. I have a lot of faith in the marketplace and in the ingenuity of people. Give the companies in the best position to fix the problem a financial incentive to fix the problem, and fix it they will.
“Security is a chain; it’s only as secure as the weakest link.” “Security is a process, not a product.”
Admiral Grace Hopper said: “Life was simple before World War II. After that, we had systems.”
A system might be secure against the average criminal, or a certain type of industrial spy, or a national intelligence agency with a certain skill set. A system might be secure as long as certain mathematical advances don’t occur, or for a certain period of time, or against certain types of attacks. Like any adjective, “secure” is meaningless out of context.
I am writing this book in the United States at the turn of the millennium. I am not writing it in Sarajevo, Hebron, or Rangoon. I have no experiences that can speak to what it is like to live in such a place. My personal expectations of safety come from living in a stable democracy. This book is about the security from the point of view of the industrialized world, not the world torn apart by war, suppressed by secret police, or controlled by criminal syndicates. This book is about the relatively minor threats in a society where the major threats have been dealt with.
Marketers have long used whatever data they could get their hands on to target particular people and demographics. In the United States, personal data do not belong to the person whom the data are about, they belong to the organization that collected it. Your financial information isn’t your property, it’s your bank’s. Your medical information isn’t yours, it’s your doctor’s. Doctors swear oaths to protect your privacy, but insurance providers and HMOs do not. Do you really want everyone to know about your heart defect or your family’s history of glaucoma? How about your bout with alcoholism, or that embarrassing brush with venereal disease two decades ago? Privacy violations can easily lead to fraud. In the novel Paper Moon, Joe David Brown wrote about the Depression-era trick of selling bibles and other merchandise to the relatives of the recently deceased. Other scams targeted the mothers and widows of overseas war dead—“for only pennies a day we’ll care for his grave”—and people who won sweepstakes. In many areas in the country, public utilities are installing telephone-based systems to read meters: water, electricity, and the like. It’s a great idea, until some enterprising criminal uses the data to track when people go away on vacation. Or when they use alarm monitoring systems that give up-to-the-minute details on building occupancy. Wherever data can be exploited, someone will try it, computers or no computers.
People, often employees, have been prosecuted for peeking at confidential police or IRS files. Under other circumstances, it’s called data mining and is entirely legal. For example, the big credit database companies, Experian (formerly TRW), TransUnion, and Equifax, have mounds of data about nearly everyone in the United States. These data are collected, collated, and sold to anyone willing to pay for it. Credit card databases have a mind-boggling amount of information about individuals’ spending habits: where they shop, where they eat, what kind of vacations they take—it’s all there for the taking.
Physical counterfeiting is a problem, but it’s a manageable problem. Over two decades ago, we sold the Shah of Iran some of our old intaglio printing presses. When Ayatollah Khomeini took over, he realized that it was more profitable to mint $100 bills than Iranian rials. The FBI calls them supernotes, and they’re near perfect. (This is why the United States redesigned its currency.) At the same time the FBI and the Secret Service were throwing up their hands, the Department of the Treasury did some calculating: The Iranian presses can only print so much money a minute, there are only so many minutes in a year, so there’s a maximum to the amount of counterfeit money they can manufacture. Treasury decided that the amount of counterfeit currency couldn’t affect the money supply, so it wasn’t a serious concern to the nation’s stability.
If the counterfeiting were electronic, it would be different. An electronic counterfeiter could automate the hack and publish it on some Web site somewhere. People could download this program and start undetectably counterfeiting electronic money. By morning it could be in the hands of 1,000 first-time counterfeiters; another 100,000 could have it in a week. The U.S. currency system could collapse in a week.
This is also not meant as a call to extinguish legitimate researchers or hackers, full disclosure mailing lists, or the right to evaluate security products. In the United States, laws have been passed that prohibit reverse engineering of copy protection systems. The entertainment industry lobbied hard for these draconian laws, using them in an attempt to hide their incompetent security countermeasures. No other industry tries to prohibit someone who purchases a product from taking it apart to see how it works. No other industry tries to prevent Consumer Reports–style evaluations of its products’ effectiveness. Shooting the messenger is simply another overreaction to the situation.
Ask any doctor how to poison someone untraceably, and he can tell you. Ask someone who works in aircraft maintenance how to drop a 747 out of the sky without getting caught, and he’ll know. Now ask any Internet security professional how to take down the Internet, permanently. I’ve heard about half a dozen different ways, and I know I haven’t exhausted the possibilities.
... oh man, I ran out of Goodreads review space. Must have been a quote/thought-worthy book.
It's especially fun to read in retrospect. Much remains the same, but much of the described "common sense security" has also sneaked into widespread casual use - password managers, Two-Factor Authentication, Estonian ID-card based on public key crypto, open source and public security protocols, global malware and cyberattacks, release buggy software and fix it afterwards. Furthermore, the mindset that security should be open source and available for public scrutiny, like public audits and hacker contests. Or companies and platforms offering bounties for vulnerabilities - those are everyday little improvements that have creeped from the pages of Schneier's books into reality and we're all better for it.
The book is from time when Windows 98, Internet Explorer, Netscape Navigator, Java 2 and applets, ISDN modems were a thing, but it doesn't matter as much, because the concepts still matter. And the major nostalgia is somewhat confined around Chapter 10.
I had a subject called "System Theory" in college. Never understood much of it or what it was talking about. Most of the class seemed to hover in the same region of "nonderstanding". It was so abstract. To me everything in life looked like a "system". Stop talking nonsense, professor. I even needed to retake the exam, because I failed hard on the first time. But now Schneier basically gives me the introduction to the subject I never had. Even though later one of my job titles has been a "system administrator". What a laugh.
What follows is probably a far too long list of quotes, but this book is such a gold mine that I can't help myself. Starting with the quote about "system theory".
Systems have several interesting properties relevant to this book.
First, they are complex. Machines are simple: a hammer, a door hinge, a steak knife. Systems are much more complicated; they have components, feedback loops, mean times between failure, infrastructure. Digital systems are daedal; even a simple computer program has hundreds of thousands of lines of computer code doing all sorts of different things. A complex computer program has thousands of components, each of which has to work by itself and in interaction with all the other components. This is why object-oriented programming was developed: to deal with the complexity of digital systems.
Second, systems interact with each other, forming even larger systems. This can happen on purpose—programmers use objects to deliberately break large systems down into smaller systems, engineers break large mechanical systems into smaller subsystems, and so on—and it can happen naturally. The invention of the automobile led to the development of the modern system of roads and highways, and this in turn interacted with other systems in our daily lives to produce the suburb. The air traffic control system interacts with the navigation systems on aircrafts, and the weather prediction system. The human body interacts with other human bodies and with the other systems on the planet. The Internet has intertwined itself with almost every major system in our society.
Third, systems have emergent properties. In other words, they do things that are not anticipated by the users or designers. The telephone system, for example, changed the way people interact. (Alexander Graham Bell had no idea that a telephone was a personal communications device; he thought you could use it to call ahead to warn that a telegram was coming.) Automobiles changed the way people meet, date, and fall in love. Environmental-control systems in buildings have effects on people’s health, which affects the health care system. Word processing systems have changed the way people write. The Internet is full of emergent properties; think about eBay, virtual sex, collaborative authoring.
And fourth, systems have bugs. A bug is a particular kind of failure. It’s an emergent property of a system, one that is not desirable. It’s different from a malfunction. When something malfunctions, it no longer works properly. When something has a bug, it misbehaves in a particular way, possibly unrepeatable, and possibly unexplainable. Bugs are unique to systems. Machines can break, or fail, or not work, but only a system can have a bug.
We in the computer security field like to think they’re enormous, but they haven’t really affected a company’s bottom line. From the CEO’s perspective, the risks include the possibility of bad press and angry customers and network downtime—none of which is permanent. And there’s some regulatory pressure, from audits or lawsuits, which adds additional costs. The result: a smart organization does what everyone else does, and no more. Things are changing; slowly, but they’re changing. The risks are increasing, and as a result spending is increasing.
This same kind of economic reasoning explains why software vendors spend so little effort securing their own products. We in computer security think the vendors are all a bunch of idiots, but they’re behaving completely rationally from their own point of view. The costs of adding good security to software products are essentially the same ones incurred in increasing network security—large expenses, reduced functionality, delayed product releases, annoyed users—while the costs of ignoring security are minor: occasional bad press, and maybe some users switching to competitors’ products. The financial losses to industry worldwide due to vulnerabilities in the Microsoft Windows operating system are not borne by Microsoft, so Microsoft doesn’t have the financial incentive to fix them. If the CEO of a major software company told his board of directors that he would be cutting the company’s earnings per share by a third because he was going to really—no more pretending—take security seriously, the board would fire him. If I were on the board, I would fire him. Any smart software vendor will talk big about security, but do as little as possible, because that’s what makes the most economic sense.
Firewalls are ubiquitous because corporate auditors started demanding them. This changed the cost equation for businesses. The cost of adding a firewall was expense and user annoyance, but the cost of not having a firewall was failing an audit. And even worse, a company without a firewall could be accused of not following industry best practices in a lawsuit. The result: everyone has firewalls all over their network, whether they do any actual good or not.
STEP ONE: ENFORCE LIABILITIES
STEP TWO: ALLOW PARTIES TO TRANSFER LIABILITIES
STEP THREE: PROVIDE MECHANISMS TO REDUCE RISK
There’s no reason to treat software any differently from other products. Today Firestone can produce a tire with a single systemic flaw and they’re liable, but Microsoft can produce an operating system with multiple systemic flaws discovered per week and not be liable. Today if a home builder sells you a house with hidden flaws that make it easier for burglars to break in, you can sue the home builder; if a software company sells you a software system with the same problem, you’re stuck with the damages. This makes no sense, and it’s the primary reason computer security is so bad today. I have a lot of faith in the marketplace and in the ingenuity of people. Give the companies in the best position to fix the problem a financial incentive to fix the problem, and fix it they will.
“Security is a chain; it’s only as secure as the weakest link.” “Security is a process, not a product.”
Admiral Grace Hopper said: “Life was simple before World War II. After that, we had systems.”
A system might be secure against the average criminal, or a certain type of industrial spy, or a national intelligence agency with a certain skill set. A system might be secure as long as certain mathematical advances don’t occur, or for a certain period of time, or against certain types of attacks. Like any adjective, “secure” is meaningless out of context.
I am writing this book in the United States at the turn of the millennium. I am not writing it in Sarajevo, Hebron, or Rangoon. I have no experiences that can speak to what it is like to live in such a place. My personal expectations of safety come from living in a stable democracy. This book is about the security from the point of view of the industrialized world, not the world torn apart by war, suppressed by secret police, or controlled by criminal syndicates. This book is about the relatively minor threats in a society where the major threats have been dealt with.
Marketers have long used whatever data they could get their hands on to target particular people and demographics. In the United States, personal data do not belong to the person whom the data are about, they belong to the organization that collected it. Your financial information isn’t your property, it’s your bank’s. Your medical information isn’t yours, it’s your doctor’s. Doctors swear oaths to protect your privacy, but insurance providers and HMOs do not. Do you really want everyone to know about your heart defect or your family’s history of glaucoma? How about your bout with alcoholism, or that embarrassing brush with venereal disease two decades ago? Privacy violations can easily lead to fraud. In the novel Paper Moon, Joe David Brown wrote about the Depression-era trick of selling bibles and other merchandise to the relatives of the recently deceased. Other scams targeted the mothers and widows of overseas war dead—“for only pennies a day we’ll care for his grave”—and people who won sweepstakes. In many areas in the country, public utilities are installing telephone-based systems to read meters: water, electricity, and the like. It’s a great idea, until some enterprising criminal uses the data to track when people go away on vacation. Or when they use alarm monitoring systems that give up-to-the-minute details on building occupancy. Wherever data can be exploited, someone will try it, computers or no computers.
People, often employees, have been prosecuted for peeking at confidential police or IRS files. Under other circumstances, it’s called data mining and is entirely legal. For example, the big credit database companies, Experian (formerly TRW), TransUnion, and Equifax, have mounds of data about nearly everyone in the United States. These data are collected, collated, and sold to anyone willing to pay for it. Credit card databases have a mind-boggling amount of information about individuals’ spending habits: where they shop, where they eat, what kind of vacations they take—it’s all there for the taking.
Physical counterfeiting is a problem, but it’s a manageable problem. Over two decades ago, we sold the Shah of Iran some of our old intaglio printing presses. When Ayatollah Khomeini took over, he realized that it was more profitable to mint $100 bills than Iranian rials. The FBI calls them supernotes, and they’re near perfect. (This is why the United States redesigned its currency.) At the same time the FBI and the Secret Service were throwing up their hands, the Department of the Treasury did some calculating: The Iranian presses can only print so much money a minute, there are only so many minutes in a year, so there’s a maximum to the amount of counterfeit money they can manufacture. Treasury decided that the amount of counterfeit currency couldn’t affect the money supply, so it wasn’t a serious concern to the nation’s stability.
If the counterfeiting were electronic, it would be different. An electronic counterfeiter could automate the hack and publish it on some Web site somewhere. People could download this program and start undetectably counterfeiting electronic money. By morning it could be in the hands of 1,000 first-time counterfeiters; another 100,000 could have it in a week. The U.S. currency system could collapse in a week.
This is also not meant as a call to extinguish legitimate researchers or hackers, full disclosure mailing lists, or the right to evaluate security products. In the United States, laws have been passed that prohibit reverse engineering of copy protection systems. The entertainment industry lobbied hard for these draconian laws, using them in an attempt to hide their incompetent security countermeasures. No other industry tries to prohibit someone who purchases a product from taking it apart to see how it works. No other industry tries to prevent Consumer Reports–style evaluations of its products’ effectiveness. Shooting the messenger is simply another overreaction to the situation.
Ask any doctor how to poison someone untraceably, and he can tell you. Ask someone who works in aircraft maintenance how to drop a 747 out of the sky without getting caught, and he’ll know. Now ask any Internet security professional how to take down the Internet, permanently. I’ve heard about half a dozen different ways, and I know I haven’t exhausted the possibilities.
... oh man, I ran out of Goodreads review space. Must have been a quote/thought-worthy book.
August 11, 2016
If you want a “crash course” on digital security this is the book. The author Schneier is well-respected security consultant, cryptographer and the author of Applied Cryptography - one of the most respected books on the subject. If you are a professional who knows the limitation of technology, but need solution then this book will interest you. For those who are still to realize this fact – Schneier opens this book by acknowledging the he was wrong when he said earlier, that cryptography is The Answer™ for security. He goes further to make his point that it is not the mathematics of cryptography, which is faulty, but his perception of security devoid of the people is faulty (i.e., it people who use and implement the security). So people are the weakest link in security. Let us appreciate the fact that an authority like Schneier acknowledges his mistake and shares with us. This is not a book if you are looking at just building firewalls, IDE, secure code or encryption algorithm. This book is all about understanding of the security risks and coming out with a practical solution to mitigate them
The core thesis of this book is –
1. There is nothing like “complete”, “air tight” secure product, and all those claims we hear on various secure products are all “buzzword compliant products” (pp 102-103) Because security comes from carefully crafted systems not mass produced products (pp 217)
2. Security is about managing risks. Security requirement is relative and contextual
3. Instead of going beyond a total secure system, it is better to have a mediocre security
4. The best methodology to build security into your product, is by collective analytical ability – that is provide unlimited access to people to review and critique the product design and implementation
5. Use Prevention, Detection and Reaction mechanism in tandem to counter security breeches
This book has facts on digital security that makes your reading hilarious and also scary because it removes the illusion that everything is safe and brings an awareness of the vulnerabilities with which we are conducting business in the “digital world”.
The areas where I would like to see improvements in the second edition of this book are - editorial is bad, sentences are not phrased in a manner to understand easily, no references for further reading. There is no section numbers, which makes the flow difficult. How could anyone ever justify the cause of terrorism (pp 53)? – Is it because author and USA had not yet seen 9/11;-) There are sections that gives the felling that the author goes overboard to make a point! But definitely this is a must book to read, since gains to be achived by reading this book overweigh these issues(1) and in addtion difficult to put up with those repeated China, UK, and Microsoft bashing! - Is worth the effort
The 25 chapters in this book are organized into three main sections. The first section sets the context for security requirement in the current digital world; the second describes the various technologies and their limitations. Finally the third provides us the roadmap to mange for now with the current technology limitations.
The Landscape –. Schneier says cyber crime is very similar in motive to the real world, people haven’t changed and cyberspace is just yet another new place to “ply their trade” (pp 45). The motives are – financial gains, publicity, etc. (Chap 3) The threat in the digital world is the same as in the real world, but it gets a new perspective because of - speed of automation what would take hundreds of days in the real world can be done in minutes. Secondly prosecuting a cyber criminal is difficult because he/she may be sitting in New York and hacking a computer in St Petersburg, so neither the law of USA or Russia can apply. Finally “skill to hack” is just the need of the first person that break the system, later he/she can share with the rest of the world through the Internet (Chap 2) for others to follow. Schneier characterizes the adversaries of the digital world based parameters such as - the objective of their attack, how resourceful are they, how willing are they to tolerate risks, etc. Hackers, lone criminals, industrial espionage, national Intelligence are some of the adversaries described (Chap 4). Finally Schneier concludes this section discussing the various types of security needs, such as - Privacy, multiple levels of security, anonymity, authentication, integrity and audit (Chap 5)
Technologies – This section starts of stating that security is like “an onion”, with various layers – users being at the outermost and cryptography being the inner most layer in the security process/chain. Each of these layers is described, starting with the introduction to what cryptography is and its limitation and its context in computer security landscape (Chap 6-8). Symmetric encryption algorithm, message authentication code, one-way hash functions, types of protocol attacks, are some of the concepts introduced in this section. Various identification and authentication such as password, biometrics, and access token are described with their limitations (Chap 9). As per Schneier there are various ways a system/network can be attacked like - malicious code (virus, worms, etc). Modular code due to the advent of modular programming, and proliferation of scripts such as Java scripts™ ActiveX™, plug-in in software, are all cause for security breach (Chap 10). He then goes to describe the vulnerabilities of network security and defense mechanisms, introducing to readers concepts on IP scoffing, Denial-of service attacks, firewall, demilitarized zone, VPN, IDE, vulnerability scanners, etc (Chap 11-12). Relationship between bugs/quality and security is described (Chap13). Various concepts of securing hardware such as - tamper proof tamper evident and tamper resistant concepts are introduced. Various means of side channel attacks such as through- timing, power, radiation etc are introduced (Chap 14). Digital certificates and their limitations are discussed. Schneier illustrates that certificates are not he some magic security elixir (pp 237). GAK, Database security, Steganography and other techniques are introduced in Chapter 16. Finally this section ends detailing the six aspects of human problems for digital security such as – people overestimate risk, people don’t deal with things that happen very rarely, social engineering, etc
Strategies – This section goes into solving security problems in a planned way. Schneier emphasizes that - security is not a pile of defenses: adding firewalls, IDS, etc will not bring in a secure system (pp 272). The three steps to counter security vulnerabilities are by – protection, detection and reaction. These three steps need to work in tandem to secure a system. On the contrary the people in the digital world think that protection is the only way to protect - this fallacy as per Schneier attributes to the bulk of security breech (pp 281). The solution/success to effective digital security is good engineering and effective understanding of the threats and designing countermeasures (pp 303). The process of understanding threats or in other words threat modeling is not a one-time activity; it needs to be done/revisited at regular intervals. Since “secure system” has different meaning depending upon the context, for e.g. the anti-theft mechanism for expensive cars was to disable hotwiring. But this would take the threat model from one level to another aka from stealing a car from a parking lot to a more dangerous one of carjacking (pp317). So it is an iterative procedure of threat modeling and risk assessment
Ultimately the Schneier three steps for designing a secure system is -
1. Threat modeling – Chapter 21 describes a formal method to model threat using method called as “attack trees”
2. Security policy to defend against the threats - is the one which unifies the threats and countermeasures
3. Design counter measures
On testing for security, Schneier says there is no way functional testing can discover security flaws, since security is a function of probability (pp 257). As on date the best bet for identifying security flaws is through full disclosure – the philosophy being share the design, implementation with the general community to test and review the system. In this method, bugs would have gone through the normal sequence of getting logged and closed making the system “secure” over a course of time (Chap 22). On the question of whether we will ever achieve the “100% secure system anytime in the near future”, Schneier’s advice is – make system simple and use “good enough” security assuming complexity is inevitable (Chap 24). Technology is changing for the better, but the fundamental issues like unreliable software, people not able to remember long passwords, social engineering, etc, are there to stay and torment digital security (pp 353). Finally in Chap 24, the author gives us the process for a security assuming it is realistic to always think that security can be broken. Compartmentalize, secure weakest link, Fail-safe, Detection & Response, Counter attacks and outsourcing security are some of the steps suggested as part of this security process.
The core thesis of this book is –
1. There is nothing like “complete”, “air tight” secure product, and all those claims we hear on various secure products are all “buzzword compliant products” (pp 102-103) Because security comes from carefully crafted systems not mass produced products (pp 217)
2. Security is about managing risks. Security requirement is relative and contextual
3. Instead of going beyond a total secure system, it is better to have a mediocre security
4. The best methodology to build security into your product, is by collective analytical ability – that is provide unlimited access to people to review and critique the product design and implementation
5. Use Prevention, Detection and Reaction mechanism in tandem to counter security breeches
This book has facts on digital security that makes your reading hilarious and also scary because it removes the illusion that everything is safe and brings an awareness of the vulnerabilities with which we are conducting business in the “digital world”.
The areas where I would like to see improvements in the second edition of this book are - editorial is bad, sentences are not phrased in a manner to understand easily, no references for further reading. There is no section numbers, which makes the flow difficult. How could anyone ever justify the cause of terrorism (pp 53)? – Is it because author and USA had not yet seen 9/11;-) There are sections that gives the felling that the author goes overboard to make a point! But definitely this is a must book to read, since gains to be achived by reading this book overweigh these issues(1) and in addtion difficult to put up with those repeated China, UK, and Microsoft bashing! - Is worth the effort
The 25 chapters in this book are organized into three main sections. The first section sets the context for security requirement in the current digital world; the second describes the various technologies and their limitations. Finally the third provides us the roadmap to mange for now with the current technology limitations.
The Landscape –. Schneier says cyber crime is very similar in motive to the real world, people haven’t changed and cyberspace is just yet another new place to “ply their trade” (pp 45). The motives are – financial gains, publicity, etc. (Chap 3) The threat in the digital world is the same as in the real world, but it gets a new perspective because of - speed of automation what would take hundreds of days in the real world can be done in minutes. Secondly prosecuting a cyber criminal is difficult because he/she may be sitting in New York and hacking a computer in St Petersburg, so neither the law of USA or Russia can apply. Finally “skill to hack” is just the need of the first person that break the system, later he/she can share with the rest of the world through the Internet (Chap 2) for others to follow. Schneier characterizes the adversaries of the digital world based parameters such as - the objective of their attack, how resourceful are they, how willing are they to tolerate risks, etc. Hackers, lone criminals, industrial espionage, national Intelligence are some of the adversaries described (Chap 4). Finally Schneier concludes this section discussing the various types of security needs, such as - Privacy, multiple levels of security, anonymity, authentication, integrity and audit (Chap 5)
Technologies – This section starts of stating that security is like “an onion”, with various layers – users being at the outermost and cryptography being the inner most layer in the security process/chain. Each of these layers is described, starting with the introduction to what cryptography is and its limitation and its context in computer security landscape (Chap 6-8). Symmetric encryption algorithm, message authentication code, one-way hash functions, types of protocol attacks, are some of the concepts introduced in this section. Various identification and authentication such as password, biometrics, and access token are described with their limitations (Chap 9). As per Schneier there are various ways a system/network can be attacked like - malicious code (virus, worms, etc). Modular code due to the advent of modular programming, and proliferation of scripts such as Java scripts™ ActiveX™, plug-in in software, are all cause for security breach (Chap 10). He then goes to describe the vulnerabilities of network security and defense mechanisms, introducing to readers concepts on IP scoffing, Denial-of service attacks, firewall, demilitarized zone, VPN, IDE, vulnerability scanners, etc (Chap 11-12). Relationship between bugs/quality and security is described (Chap13). Various concepts of securing hardware such as - tamper proof tamper evident and tamper resistant concepts are introduced. Various means of side channel attacks such as through- timing, power, radiation etc are introduced (Chap 14). Digital certificates and their limitations are discussed. Schneier illustrates that certificates are not he some magic security elixir (pp 237). GAK, Database security, Steganography and other techniques are introduced in Chapter 16. Finally this section ends detailing the six aspects of human problems for digital security such as – people overestimate risk, people don’t deal with things that happen very rarely, social engineering, etc
Strategies – This section goes into solving security problems in a planned way. Schneier emphasizes that - security is not a pile of defenses: adding firewalls, IDS, etc will not bring in a secure system (pp 272). The three steps to counter security vulnerabilities are by – protection, detection and reaction. These three steps need to work in tandem to secure a system. On the contrary the people in the digital world think that protection is the only way to protect - this fallacy as per Schneier attributes to the bulk of security breech (pp 281). The solution/success to effective digital security is good engineering and effective understanding of the threats and designing countermeasures (pp 303). The process of understanding threats or in other words threat modeling is not a one-time activity; it needs to be done/revisited at regular intervals. Since “secure system” has different meaning depending upon the context, for e.g. the anti-theft mechanism for expensive cars was to disable hotwiring. But this would take the threat model from one level to another aka from stealing a car from a parking lot to a more dangerous one of carjacking (pp317). So it is an iterative procedure of threat modeling and risk assessment
Ultimately the Schneier three steps for designing a secure system is -
1. Threat modeling – Chapter 21 describes a formal method to model threat using method called as “attack trees”
2. Security policy to defend against the threats - is the one which unifies the threats and countermeasures
3. Design counter measures
On testing for security, Schneier says there is no way functional testing can discover security flaws, since security is a function of probability (pp 257). As on date the best bet for identifying security flaws is through full disclosure – the philosophy being share the design, implementation with the general community to test and review the system. In this method, bugs would have gone through the normal sequence of getting logged and closed making the system “secure” over a course of time (Chap 22). On the question of whether we will ever achieve the “100% secure system anytime in the near future”, Schneier’s advice is – make system simple and use “good enough” security assuming complexity is inevitable (Chap 24). Technology is changing for the better, but the fundamental issues like unreliable software, people not able to remember long passwords, social engineering, etc, are there to stay and torment digital security (pp 353). Finally in Chap 24, the author gives us the process for a security assuming it is realistic to always think that security can be broken. Compartmentalize, secure weakest link, Fail-safe, Detection & Response, Counter attacks and outsourcing security are some of the steps suggested as part of this security process.
December 31, 2023
Last book of 2023!
As a preface, this is a book that was recommended as supplementary reading for a cybersecurity course I took a little over a year ago.
That being said, this isn't technically speaking a "textbook." It is instead marketed as an introductory overview of computer security, which the average Joe should be able to understand. Personally, I don't think that it lives up to this description and would definitely not recommend this to someone with no computer science background, but maybe I'm just underestimating the average person's computer knowledge.
Another point of note about this book is that it was released in 2000, and it definitely feels like it was released in 2000. While basic computer security concepts and practices are non-temporal in nature, Schneier litters the text with numerous examples that are intended to help the illustrate the concepts described in the book, and 23 years later I had next to no clue of a lot of the various computer security scandals mentioned. There are, however, numerous real-world parallels that are used which help out a lot.
All of that out of the way, this is a remarkable text in its cutting understanding of and explanation of computer security principles. Most notable perhaps is Schneier's commitment to emphasizing that technology itself can only go so far, and that many security vulnerabilities have in fact nothing to do with any of the underlying technologies; a security system is only as secure as its weakest link. Also, it was fun to read Schneier tear apart Microsoft.
TL;DR: Unless you have a computer science background and want to understand cybersecurity in more depth, it's probably best to steer clear of this one.
As a preface, this is a book that was recommended as supplementary reading for a cybersecurity course I took a little over a year ago.
That being said, this isn't technically speaking a "textbook." It is instead marketed as an introductory overview of computer security, which the average Joe should be able to understand. Personally, I don't think that it lives up to this description and would definitely not recommend this to someone with no computer science background, but maybe I'm just underestimating the average person's computer knowledge.
Another point of note about this book is that it was released in 2000, and it definitely feels like it was released in 2000. While basic computer security concepts and practices are non-temporal in nature, Schneier litters the text with numerous examples that are intended to help the illustrate the concepts described in the book, and 23 years later I had next to no clue of a lot of the various computer security scandals mentioned. There are, however, numerous real-world parallels that are used which help out a lot.
All of that out of the way, this is a remarkable text in its cutting understanding of and explanation of computer security principles. Most notable perhaps is Schneier's commitment to emphasizing that technology itself can only go so far, and that many security vulnerabilities have in fact nothing to do with any of the underlying technologies; a security system is only as secure as its weakest link. Also, it was fun to read Schneier tear apart Microsoft.
TL;DR: Unless you have a computer science background and want to understand cybersecurity in more depth, it's probably best to steer clear of this one.
May 23, 2021
"If you do enough threat modeling, you start noticing all kinds of instances where people get the threat profoundly wrong:
* The cell phone industry spent a lot of money designing their systems to detect fraud, but they misunderstood the threat. They thought the criminals would steal cell phone service to avoid paying the charge. Actually, what the criminals wanted was anonymity; they didn't want cell phone calls traced back to them. Cell phone identities are stolen off the air, used a few times, and then thrown away. The antifraud system wasn't designed to catch this kind of fraud.
* The same cell phone industry, back in the analog days, didn't bother securing the connection because (as they said): 'scanners are expensive, and rare.' Over the years, scanners became cheap and plentiful. Then, in a remarkable display of not getting it, the same industry didn't bother securing digital cell phone connections because 'digital scanners are expensive, and rare.' Guess what? They're getting cheaper, and more plentiful.
* Hackers often trade hacking tools on Web sites and bulletin boards. Some of those hacking tools are themselves infected with Back Orifice, giving the tool writer access to the hacker's computer. Aristotle called this kind of thing 'poetic justice.'
[...]
These attacks are interesting not because of flaws in the countermeasures, but because of flaws in the threat model. In all of these cases, there were countermeasures in place; they just didn't solve the correct problem. Instead, they solved some problem near the correct problem. And in some cases, the solutions created worse problems than they solved."
* The cell phone industry spent a lot of money designing their systems to detect fraud, but they misunderstood the threat. They thought the criminals would steal cell phone service to avoid paying the charge. Actually, what the criminals wanted was anonymity; they didn't want cell phone calls traced back to them. Cell phone identities are stolen off the air, used a few times, and then thrown away. The antifraud system wasn't designed to catch this kind of fraud.
* The same cell phone industry, back in the analog days, didn't bother securing the connection because (as they said): 'scanners are expensive, and rare.' Over the years, scanners became cheap and plentiful. Then, in a remarkable display of not getting it, the same industry didn't bother securing digital cell phone connections because 'digital scanners are expensive, and rare.' Guess what? They're getting cheaper, and more plentiful.
* Hackers often trade hacking tools on Web sites and bulletin boards. Some of those hacking tools are themselves infected with Back Orifice, giving the tool writer access to the hacker's computer. Aristotle called this kind of thing 'poetic justice.'
[...]
These attacks are interesting not because of flaws in the countermeasures, but because of flaws in the threat model. In all of these cases, there were countermeasures in place; they just didn't solve the correct problem. Instead, they solved some problem near the correct problem. And in some cases, the solutions created worse problems than they solved."
September 12, 2017
This book came to me well recommended and after making my through it, I understand why. The author takes the reader through the sweeping expanse of digital security with aplomb. Rich with fascinating stories, candid observations, and good technical detail Secrets and Lies is a fairly exhaustive introduction to security.
At the end (not really a spoiler here), the author confesses to have had to pause writing the book because of a certain level of hopelessness and it shows through at times. As the book winds its way through the myriad forms of insecurity and attacks, I found myself at times wondering if the author felt there was any way forward. And I found myself questioning that perspective, after all, we seem to be making our way yet still today. The author does recover.
I really enjoyed reading this book and I recommend it.
At the end (not really a spoiler here), the author confesses to have had to pause writing the book because of a certain level of hopelessness and it shows through at times. As the book winds its way through the myriad forms of insecurity and attacks, I found myself at times wondering if the author felt there was any way forward. And I found myself questioning that perspective, after all, we seem to be making our way yet still today. The author does recover.
I really enjoyed reading this book and I recommend it.
April 4, 2018
Security consultant, cryptographer and author, Bruce Schneier basically gives the reader a history lesson on Digital Security. Some reviewers state the book is “a bit dated”, which is only valid in the sense there's no discussion on post 2001 era computing. However, history is history, and the discussed concepts are still relevant today. There's a few references early on in the book which he just names and doesn't explain, so there's a few examples which were meaningless without doing a small bit of research. I think there are a few sections that cut be trimmed down somewhat, and there's a slight bit of repetition, but overall, it's a good book.
May 20, 2021
This is a very well written book. It is not for beginners, in my opinion, though. Some technical background in information security will certainly help you understand better the topics covered. I believe it is a very good resource for anyone wanting to know a little bit more about digital security.
I read it first in 2004 and recently I reread it. The edition I have is the 2004 paperback edition (bought it from Amazon.com and had it shipped to Brazil at a time where there were no import taxes for books) and believe it or not after almost 20 years it is still actual.
I read it first in 2004 and recently I reread it. The edition I have is the 2004 paperback edition (bought it from Amazon.com and had it shipped to Brazil at a time where there were no import taxes for books) and believe it or not after almost 20 years it is still actual.
February 5, 2021
A great book that was written more than 20 years ago, about digital security, but that is still actual and relevant. An essay about all the possible treats and problems in the digital world, how to measure the threats and how to think about security problems, how to see beyond the known problems, and how the human factor is the most relevant thing. A must-read book, really well written and important until now.
March 2, 2022
This book is a recommended reading material for anyone interested in computer and network security.
The book made it clear that any preventive countermeasure we can put into a complex system will be surpassed by any sufficiently capable attackers. And we can only hope to secure them by deploying a detection and response mechanism to deal with the breach as soon as possible, ideally as it happens in real-time.
The book made it clear that any preventive countermeasure we can put into a complex system will be surpassed by any sufficiently capable attackers. And we can only hope to secure them by deploying a detection and response mechanism to deal with the breach as soon as possible, ideally as it happens in real-time.
November 6, 2020
Not a bad book, but a bit outdated as I had the 2004 edition. Worries about DoubleClick back then seem rather tame compared to the challenge of keeping identity info safe in the Facebook/Google world!
Overall, the message is still sound, security is only as good as the weakest link and adding encryption is only as good as its implementation as a part of the whole security system.
Overall, the message is still sound, security is only as good as the weakest link and adding encryption is only as good as its implementation as a part of the whole security system.
October 29, 2017
Despite the fact our industry is changing with incredible pace Schneider was able to well describe and also predict many possibilities of attacks and risks. He also provides the reader with explanation of main technologies and approaches to tackle the risk.
Well recommended.
Well recommended.
May 8, 2018
Great book, but I don’t think it can take one more update. How about starting from scratch on this topic?
July 19, 2019
Best for those who need to understand Information security. The author give great example from the real world, which make the book more interesting to read.
June 23, 2020
Holistic approach to security, good advice. But a little dated with examples from 2000 or before.
December 28, 2020
Althohugh it is a dated book the basic principles are stille clear and valid and, too often, unapplyed.
A must read to anyone in cybersecurity domain.
Schneier's style is clear and full of examples.
A must read to anyone in cybersecurity domain.
Schneier's style is clear and full of examples.
Read
May 17, 2021Bruce Schneier elaborates on why no matter how good cyber security/cryptography get, Systems are always going to vulnerable because of the weakest links i.e. humans themselves
June 12, 2021
Good overview of security (digital) and more broadly how to think about security as a process and steps to take to make security more robust against evolving threats
November 21, 2024
Though over 20 years old, and so some of the examples are outdated, most of the concepts in this book still hold true in 2024. And the predictions about cyber insurance and MDRs were spot on
August 20, 2025
There have been a few editions of this, but the core facts remain very relevant.
Good overview of the fundamental thinking and methodologies of security.
Good overview of the fundamental thinking and methodologies of security.
July 27, 2011
I'm a technology end-user, deluged with acceleratingly frequent news reports of large corporations getting hacked, have recently been using my internet banking passcode generator, and occasionally placing basic htaccess security on my websites.
Thus, increasingly aware that security isn't to be left solely to experts who run the banking systems and data storage and transfer facilities- even casual users need an understanding of the premises on which they're built, and are responsible for correct implementation, otherwise we cut corners unwittingly and end up being the weakest link.
By training ourselves to examine the limitations of our security systems, we can spot vulnerabilities and uncover unsound assumptions about how secure they really are, and how to order our priorities.
Plenty of insights, too, into how the current systems evolved, and thus how we can learn from previous technological and society-wide breakthroughs, and allocate resources optimally.
It wasn't just digital security- this book made me think more analytically about protection of physical property, loopholes and real-world messiness. I greatly appreciate authors who put the realities of the situation at the forefront, and highlight limitations- how 'secure' something is depends on the context. Such books remind you of interconnections between their topic and everything else.
Bruce is a prolific, high-profile writer, particularly well-known for his criticism of ineffective, time-wasting measures that plague airports throughout the world.
Recently came across a fascinating article by Jeffrey Goldberg, describing how the patchwork of security checks (ID, boarding pass, online database searches) renders the system entirely penetrable to someone with an elementary knowledge of how it (doesn't) work.
Thus, increasingly aware that security isn't to be left solely to experts who run the banking systems and data storage and transfer facilities- even casual users need an understanding of the premises on which they're built, and are responsible for correct implementation, otherwise we cut corners unwittingly and end up being the weakest link.
By training ourselves to examine the limitations of our security systems, we can spot vulnerabilities and uncover unsound assumptions about how secure they really are, and how to order our priorities.
Plenty of insights, too, into how the current systems evolved, and thus how we can learn from previous technological and society-wide breakthroughs, and allocate resources optimally.
It wasn't just digital security- this book made me think more analytically about protection of physical property, loopholes and real-world messiness. I greatly appreciate authors who put the realities of the situation at the forefront, and highlight limitations- how 'secure' something is depends on the context. Such books remind you of interconnections between their topic and everything else.
Bruce is a prolific, high-profile writer, particularly well-known for his criticism of ineffective, time-wasting measures that plague airports throughout the world.
Recently came across a fascinating article by Jeffrey Goldberg, describing how the patchwork of security checks (ID, boarding pass, online database searches) renders the system entirely penetrable to someone with an elementary knowledge of how it (doesn't) work.
April 5, 2015
Read full review at my blog: http://terebrate.blogspot.com/2014/05...
See Cyber Security Canon Candidate List: http://terebrate.blogspot.com/2014/02...
"Secrets and Lies: Digital Security in a Networked World" is the perfect book to hand to new bosses or new employees coming in the door who have not been exposed to cyber security in their past lives. It is also the perfect book for seasoned security practitioners who want an overview of the key issues facing our community today. Schneier wrote it more than a decade ago, but its ideas still resonate. He talks about the idea that “security is a process, not a product.” With that one line, Schneier captures the essence of what our cyber security community should be about. He explains that even though we have advanced technology designed to specifically find cyber break-ins, people are the still the weakest link. He describes how cyber risk is not a special category. It is just another risk to the business. He highlights the ludicrous idea that software vendors have no liability or selling buggy code, and he was one of the first thought leaders to characterize the adversary as something more than just a hacker. He makes the case for things that the cyber security community still needs in order to make the Internet more secure, things like strengthening confidentiality, integrity, and availability (CIA); improving Internet privacy and Internet anonymity; and challenging the idea that security practitioners must make the Sophie’s Choice between better security or more privacy in terms of government surveillance. Finally, he anticipates the need for a Bitcoin-like capability long before Bitcoin became popular. The content within Secrets and Lies is a good introduction to the cyber security community, and Schneier tells the story well. Because of that, Secrets and Lies is candidate for the cyber security canon, and you should have read it by now.
See Cyber Security Canon Candidate List: http://terebrate.blogspot.com/2014/02...
"Secrets and Lies: Digital Security in a Networked World" is the perfect book to hand to new bosses or new employees coming in the door who have not been exposed to cyber security in their past lives. It is also the perfect book for seasoned security practitioners who want an overview of the key issues facing our community today. Schneier wrote it more than a decade ago, but its ideas still resonate. He talks about the idea that “security is a process, not a product.” With that one line, Schneier captures the essence of what our cyber security community should be about. He explains that even though we have advanced technology designed to specifically find cyber break-ins, people are the still the weakest link. He describes how cyber risk is not a special category. It is just another risk to the business. He highlights the ludicrous idea that software vendors have no liability or selling buggy code, and he was one of the first thought leaders to characterize the adversary as something more than just a hacker. He makes the case for things that the cyber security community still needs in order to make the Internet more secure, things like strengthening confidentiality, integrity, and availability (CIA); improving Internet privacy and Internet anonymity; and challenging the idea that security practitioners must make the Sophie’s Choice between better security or more privacy in terms of government surveillance. Finally, he anticipates the need for a Bitcoin-like capability long before Bitcoin became popular. The content within Secrets and Lies is a good introduction to the cyber security community, and Schneier tells the story well. Because of that, Secrets and Lies is candidate for the cyber security canon, and you should have read it by now.
July 14, 2007
time to update my review given that i am now finished!
one thing that slightly annoyed me while i was reading the book was that it did not appear that schneier was offering any solutions to the problems that he was presenting in information security. but, after a certain point, that is when i realized: there really are no clear-cut solutions. as schneier emphasizes throughout the book, security is a process, not a solution. there is no generally algorithm for applying a security process; it really must be performed on a case-by-case basis.
i did like how schneier admitted that it took him longer to write the book than he thought because he could not provide hope to the reader based on all the issues in information security today, until his big epiphany. many of the issues he presented in 1999 are still relevant today (2007), but a lot of it comes down to the thought process that not only an information security expert has, but even just a non-technical person using technology in the information age.
in the end, i am glad i read this book, it was definitely an interesting read, and i would recommend it to people who are not only interested in computer-related security, but also those who may be involved with the liability issues should a breach in security occur.
one thing that slightly annoyed me while i was reading the book was that it did not appear that schneier was offering any solutions to the problems that he was presenting in information security. but, after a certain point, that is when i realized: there really are no clear-cut solutions. as schneier emphasizes throughout the book, security is a process, not a solution. there is no generally algorithm for applying a security process; it really must be performed on a case-by-case basis.
i did like how schneier admitted that it took him longer to write the book than he thought because he could not provide hope to the reader based on all the issues in information security today, until his big epiphany. many of the issues he presented in 1999 are still relevant today (2007), but a lot of it comes down to the thought process that not only an information security expert has, but even just a non-technical person using technology in the information age.
in the end, i am glad i read this book, it was definitely an interesting read, and i would recommend it to people who are not only interested in computer-related security, but also those who may be involved with the liability issues should a breach in security occur.
December 4, 2013
An excellent overview of what digital security is all about. Many people equate it with firewalls and encryption, based on poor news stories among other things, but that's only a small facet of what real security is. This book covers security from a much larger perspective.
What most surprised me, while reading this in 2013, is how prescient this book turned out to be. Originally written between 1998 and 2000, it anticipated the numerous challenges our industry has faced since then. It feels very ominous and bleak at times, but given this year's NSA & GCHQ scandals, it was probably not bleak enough.
The content is written so that laypersons can understand it, and it does not go into detail all that much, but it's definitely good reading for everyone in the field. More than a decade later, security still does not get the respect and resources it needs to, despite the massive proliferation of attacks and the following media coverage.
What most surprised me, while reading this in 2013, is how prescient this book turned out to be. Originally written between 1998 and 2000, it anticipated the numerous challenges our industry has faced since then. It feels very ominous and bleak at times, but given this year's NSA & GCHQ scandals, it was probably not bleak enough.
The content is written so that laypersons can understand it, and it does not go into detail all that much, but it's definitely good reading for everyone in the field. More than a decade later, security still does not get the respect and resources it needs to, despite the massive proliferation of attacks and the following media coverage.
April 12, 2013
Secrets and Lies is a non-technical , non-mathematical book that deals with the "social" , & practical day-to-day aspects of hacking and security breach and violations. The book explains the hows and whys of hackings and its consequences. It explains the different types of cyber crimes i.e. identity thefts, ATM thefts, etc. and explores the causes of each in a different viewpoint than just code flaws or weak algorithms. It focuses specially on the Social Engineering aspect, the fallibility of the human integrity and proves a valid case winningly that human beings are the weakest and easily the most gullible link in a wired world, and no matter how strong the encryption algorithm is, it can always fail if it falls in wrong hands or is wrongly implemented. A non-mathematical, less technical & a really enjoyable book, must for techies and nerds, and highly suggested for people who want to know about cyber crimes, and want to safeguard themselves from it.
June 20, 2008
The second star is solely due to Schneier sending me this book in a nice signed hardback edition -- at 24, such things are a fine trouser-rouse. That having been said...sorry mang, but I certainly wouldn't have paid for it. I kind of imagine him with a blissful look on his face, eyes tightly drawn, visions of Counterpane Security profits dancing in his head as he builds towards an eruptive....well, you'll have to read Secrets and Lies yourself. But don't take my animadversion for it, or else you won't read this self-serving balderdash at all.
That having been said, Bruce Schneier Facts does always manage to put a goofy grin on my face. Hashes collide because they're swerving to avoid Bruce Schneier, lol. Bruce Schneier knows Victoria's Secret. Bruce Schneier is hidden in your markov model. We can do this all day.
That having been said, Bruce Schneier Facts does always manage to put a goofy grin on my face. Hashes collide because they're swerving to avoid Bruce Schneier, lol. Bruce Schneier knows Victoria's Secret. Bruce Schneier is hidden in your markov model. We can do this all day.
July 22, 2010
So far, I believe this book is the best resource to motivate readers to learn computer security. Written like those non-fictions (instead of textbooks), this book is appropriate to be read by anyone who would like to know about computer security.
The author tried to convince that computer security is a need instead of merely theory. He presented few examples of cases that worth reading. Those examples are firstly presented in human view, then he linked up to some relevant theories. He rarely put theories first. By the time readers finished half of the book, they may be surprised they have read up a lot of security concepts.
Choices of security solutions are left open to the reader. He gave the knowledge and possibilities through this book.
The author tried to convince that computer security is a need instead of merely theory. He presented few examples of cases that worth reading. Those examples are firstly presented in human view, then he linked up to some relevant theories. He rarely put theories first. By the time readers finished half of the book, they may be surprised they have read up a lot of security concepts.
Choices of security solutions are left open to the reader. He gave the knowledge and possibilities through this book.
Displaying 1 - 30 of 74 reviews