Home > Store > Security > Network Security
New School of Information Security, The
- By Adam Shostack, Andrew Stewart
- Published Mar 26, 2008 by Addison-Wesley Professional.
- Copyright 2008
- Dimensions: 6x9
- Pages: 288
- Edition: 1st
- Book
- ISBN-10: 0-321-50278-7
- ISBN-13: 978-0-321-50278-0
Register your product to gain access to bonus material or receive a coupon.
Product Author Bios
Adam Shostack is part of Microsoft’s Security Development Lifecycle strategy team, where he is responsible for security design analysis techniques. Before Microsoft, Adam was involved in a number of successful start-ups focused on vulnerability scanning, privacy, and program analysis. He helped found the CVE, International Financial Cryptography association, and the Privacy Enhancing Technologies workshop. He has been a technical advisor to companies including Counterpane Internet Security and Debix.
Andrew Stewart is a Vice President at a US-based investment bank. His work on information security topics has been published in journals such as Computers & Security and Information Security Bulletin. His homepage is homepage.mac.com/andrew_j_stewart
<>“It is about time that a book like The New School came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out.”
--David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems
Why is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It’s about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don’t just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you’re a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises.
- Better evidence for better decision-making
Why the security data you have doesn’t support effective decision-making--and what to do about it - Beyond security “silos”: getting the job done together
Why it’s so hard to improve security in isolation--and how the entire industry can make it happen and evolve - Amateurs study cryptography; professionals study economics
What IT security leaders can and must learn from other scientific fields - A bigger bang for every buck
How to re-allocate your scarce resources where they’ll do the most good
Related Articles
A Brief History of (Internet) Time: From the Beginnings of Malicious Code to Their Likely Future
Bluetooth Security Risks in Business
Turning the OLPC Into a Hacker’s Toolkit - Give One, Get Owned, Part 1
Turning the OLPC Into a Hacker’s Toolkit - Give One, Get Owned, Part 2
|
22 of 26 people found the following review helpful
Book review I wrote for ITToolbox, By
Amazon Verified Purchase(What's this?)
This review is from: The New School of Information Security (Hardcover)
If you want to read a book that will have an influence on your information security career, or if you just want to read something that points out that we do need to do information security differently, then you need to go pick up a copy of "The new school of information security" by Adam Shostack and Andrew Stewart.The book reads like this blog, everything from Noam Epple and the "Security Absurdity" with the response article Noam Eppel Follow up to Security Absurdity and Security Absurdity - Is information security "Broken". All the way through some of the latest hacks from Two weeks, two security breaches in web 2.0 applications to Tom's excellent article on Even Oracle is not without security problems. There are some short sharp jabs in the side for information security people and managers that think they are safe behind their firewalls. If anything is going to serve as the cup of coffee after Noam Epple's wake up call, it has to be this book. Which means you... Read more
24 of 29 people found the following review helpful
Amateurs Study Cryptography; Professionals Study Economics,
This review is from: The New School of Information Security (Hardcover)
What a delightful chapter title in Adam Shostack's and Andrew Stewart's new book, The New School of Information Security. They have produced a readable, compact tour of the information security field as it stands today - or perhaps as it lies in its crib. What we know intuitively the authors bring forward thoughtfully in their analysis of the information security industry: it is struggling to keep up with the defects in online communication, data storage, and business processes.Shostack and Stewart helpfully review the stable of plagues on computing, communication, and remote commerce: spam, phishing, viruses, identity theft, and such. Likewise, they introduce the cast of characters in the security field, all of whom seem to be feeling along in the dark together. Why are the lights off? Lack of data, they argue. Most information security decisions are taken in the absence of good information. The authors perceptively describe the substitutes for good... Read more
17 of 20 people found the following review helpful
A Must-Read Book on a Proper IT Outlook, By
Amazon Verified Purchase(What's this?)
This review is from: The New School of Information Security (Hardcover)
The New School's thesis is straightforward: publish data and use that data to approach IT security questions with a more scientific mindset, utilizing other academic disciplines such as economics and psychology to aid in solving problems.The book would be a great primer for an MBA course on IT systems and organizational behavior. I suspect that so much of what causes secrecy around breaches in business organizations are the overblown fears of MBAs of customers fleeing. Shostack and Stewart do a good job calming those fears, and showing how disclosure really helps all parties move toward better security. The book is a quick read, and it's more of a philosophical treatise than a how-to manual. For that reason I think it would be beneficial for anyone in IT or an organization's management to read it, as the book speaks to both parties. I should disclose that I've known Adam Shostack for years, I do not know Andrew Stewart. |
Online Sample Chapter
Failures of Information Security: Observing the World and Asking Why
Table of Contents
1. OBSERVING THE WORLD AND ASKING WHY Spam, and Other Problems with Email 4
Hostile Code 7
Security Breaches 9
Identity and the Theft of Identity 11
Should We Just Start Over? 14
The Need for a New School 15
2. THE SECURITY INDUSTRY Where the Security Industry Comes From 19
Orientations and Framing 25
What Does the Security Industry Sell? 27
How Security Is Sold 33
3. ON EVIDENCE The Trouble with Surveys 46
The Trade Press 50
Vulnerabilities 52
Instrumentation on the Internet 54
Organizations and Companies with Data 55
4. THE RISE OF THE SECURITY BREACH How Do Companies Lose Data? 64
Disclose Breaches 68
Possible Criticisms of Breach Data 70
Moving from Art to Science 74
Get Involved 76
5. AMATEURS STUDY CRYPTOGRAPHY; The Economics of Information Security 82
PROFESSIONALS STUDY ECONOMICS Psychology 95
Sociology 99
6. SPENDING Reasons to Spend on Security Today 106
Non-Reasons to Spend on Security 110
Emerging Reasons to Spend 112
How Much Should a Business
Spend on Security? 116
The Psychology of Spending 122
On What to Spend 126
7. LIFE IN THE NEW SCHOOL People Are People 132
Breach Data Is Not Actuarial Data 136
Powerful Externalities 137
The Human Computer Interface and
Risk Compensation 139
The Use and Abuse of Language 142
Skills Shortages, Organizational
Structure, and Collaboration 144
8. A CALL TO ACTION Join the New School 149
Embrace the New School 153
Make Money from the New School 157
Final Words 159
ENDNOTES 161
BIBLIOGRAPHY 213
INDEX 229
Sample Pages
Errata
Book
This product currently is not for sale.
Get access to thousands of books and training videos about technology, professional development and digital media from more than 40 leading publishers, including Addison-Wesley, Prentice Hall, Cisco Press, IBM Press, O'Reilly Media, Wrox, Apress, and many more. If you continue your subscription after your 30-day trial, you can receive 30% off a monthly subscription to the Safari Library for up to 12 months. That's a total savings of $199.
