The New School of Information Security

Paperback | March 26, 2008

byAdam Shostack, Andrew Stewart

not yet rated|write a review
It is about time that a book like The New School came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out.”

--David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems

 

Why is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It’s about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don’t just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you’re a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises.

  • Better evidence for better decision-making
    Why the security data you have doesn’t support effective decision-making--and what to do about it
  • Beyond security “silos”: getting the job done together
    Why it’s so hard to improve security in isolation--and how the entire industry can make it happen and evolve
  • Amateurs study cryptography; professionals study economics
    What IT security leaders can and must learn from other scientific fields
  • A bigger bang for every buck
    How to re-allocate your scarce resources where they’ll do the most good

Pricing and Purchase Info

$36.98 online
$36.99 list price
In stock online
Ships free on orders over $25
HURRY, ONLY 1 LEFT!

From the Publisher

It is about time that a book like The New School came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it ...

Adam Shostack is part of Microsoft’s Security Development Lifecycle strategy team, where he is responsible for security design analysis techniques. Before Microsoft, Adam was involved in a number of successful start-ups focused on vulnerability scanning, privacy, and program analysis. He helped found the CVE, International Financial C...

other books by Adam Shostack

Threat Modeling: Designing for Security
Threat Modeling: Designing for Security

Paperback|Feb 17 2014

$50.77 online$66.00list price(save 23%)
Format:PaperbackDimensions:288 pages, 8.8 × 5.9 × 0.8 inPublished:March 26, 2008Publisher:Pearson EducationLanguage:English

The following ISBNs are associated with this title:

ISBN - 10:0321814908

ISBN - 13:9780321814906

Customer Reviews of The New School of Information Security

Reviews

Extra Content

Table of Contents

1. OBSERVING THE WORLD AND ASKING WHY Spam, and Other Problems with Email 4

Hostile Code 7

Security Breaches 9

Identity and the Theft of Identity 11

Should We Just Start Over? 14

The Need for a New School 15

2. THE SECURITY INDUSTRY Where the Security Industry Comes From 19

Orientations and Framing 25

What Does the Security Industry Sell? 27

How Security Is Sold 33

3. ON EVIDENCE The Trouble with Surveys 46

The Trade Press 50

Vulnerabilities 52

Instrumentation on the Internet 54

Organizations and Companies with Data 55

4. THE RISE OF THE SECURITY BREACH How Do Companies Lose Data? 64

Disclose Breaches 68

Possible Criticisms of Breach Data 70

Moving from Art to Science 74

Get Involved 76

5. AMATEURS STUDY CRYPTOGRAPHY; The Economics of Information Security 82

PROFESSIONALS STUDY ECONOMICS Psychology 95

Sociology 99

6. SPENDING Reasons to Spend on Security Today 106

Non-Reasons to Spend on Security 110

Emerging Reasons to Spend 112

How Much Should a Business

Spend on Security? 116

The Psychology of Spending 122

On What to Spend 126

7. LIFE IN THE NEW SCHOOL People Are People 132

Breach Data Is Not Actuarial Data 136

Powerful Externalities 137

The Human Computer Interface and

Risk Compensation 139

The Use and Abuse of Language 142

Skills Shortages, Organizational

Structure, and Collaboration 144

8. A CALL TO ACTION Join the New School 149

Embrace the New School 153

Make Money from the New School 157

Final Words 159

ENDNOTES 161

BIBLIOGRAPHY 213

INDEX 229