“It is about time that a book like The New School came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out.”--David Mortman, CSO-in-Residence Echelon One, former CSO Seibel SystemsWhy is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It's about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don't just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you're a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises. Better evidence for better decision-making Why the security data you have doesn't support effective decision-making--and what to do about it Beyond security “silos”: getting the job done together Why it's so hard to improve security in isolation--and how the entire industry can make it happen and evolve Amateurs study cryptography; professionals study economics What IT security leaders can and must learn from other scientific fields A bigger bang for every buck How to re-allocate your scarce resources where they'll do the most good
Cited By
- Graves J, Acquisti A and Christin N (2018). Should Credit Card Issuers Reissue Cards in Response to a Data Breach?, ACM Transactions on Internet Technology, 18:4, (1-19), Online publication date: 19-Nov-2018.
- Spring J, Moore T and Pym D Practicing a Science of Security Proceedings of the 2017 New Security Paradigms Workshop, (1-18)
- Benenson Z, Lenzini G, Oliveira D, Parkin S and Uebelacker S Maybe Poor Johnny Really Cannot Encrypt Proceedings of the 2015 New Security Paradigms Workshop, (85-99)
- Radke K, Boyd C, Nieto J, Manulis M and Stebila D Formalising human recognition Proceedings of the Twelfth Australasian Information Security Conference - Volume 149, (37-45)
- Radke K, Boyd C, Nieto J and Brereton M Towards a secure human-and-computer mutual authentication protocol Proceedings of the Tenth Australasian Information Security Conference - Volume 125, (39-46)
- Radke K, Brereton M, Mirisaee S, Ghelawat S, Boyd C and Nieto J Tensions in developing a secure collective information practice - the case of agile ridesharing Proceedings of the 13th IFIP TC 13 international conference on Human-computer interaction - Volume Part II, (524-532)
- Gheorghe G, Massacci F, Neuhaus S and Pretschner A GoCoMM Proceedings of the first ACM workshop on Information security governance, (33-38)
- Neuhaus S and Zimmermann T The beauty and the beast Proceedings of the 2009 conference on USENIX Annual technical conference, (30-30)