- ホーム
- > 洋書
- > 英文書
- > Internet / General
Full Description
It is about time that a book like The New School came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out." --David Mortman, CSO-in-Residence Echelon One, former CSO Siebel SystemsWhy is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It's about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don't just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you're a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises.Better evidence for better decision-makingWhy the security data you have doesn't support effective decision-making--and what to do about it Beyond security "silos": getting the job done togetherWhy it's so hard to improve security in isolation--and how the entire industry can make it happen and evolveAmateurs study cryptography; professionals study economicsWhat IT security leaders can and must learn from other scientific fieldsA bigger bang for every buckHow to re-allocate your scarce resources where they'll do the most good
Contents
1. OBSERVING THE WORLD AND ASKING WHY Spam, and Other Problems with Email 4Hostile Code 7Security Breaches 9Identity and the Theft of Identity 11Should We Just Start Over? 14The Need for a New School 152. THE SECURITY INDUSTRY Where the Security Industry Comes From 19Orientations and Framing 25What Does the Security Industry Sell? 27How Security Is Sold 333. ON EVIDENCE The Trouble with Surveys 46The Trade Press 50Vulnerabilities 52Instrumentation on the Internet 54Organizations and Companies with Data 55Disclose Breaches 68Possible Criticisms of Breach Data 70Moving from Art to Science 74Get Involved 765. AMATEURS STUDY CRYPTOGRAPHY; The Economics of Information Security 82PROFESSIONALS STUDY ECONOMICS Psychology 95Sociology 996. SPENDING Reasons to Spend on Security Today 106Non-Reasons to Spend on Security 110Emerging Reasons to Spend 112How Much Should a BusinessSpend on Security? 116The Psychology of Spending 122On What to Spend 126Breach Data Is Not Actuarial Data 136Powerful Externalities 137The Human Computer Interface andRisk Compensation 139The Use and Abuse of Language 142Skills Shortages, OrganizationalStructure, and Collaboration 144Embrace the New School 153Make Money from the New School 157Final Words 159ENDNOTES 161BIBLIOGRAPHY 213INDEX 229
