Table of Contents
To Beth
Credits
Executive Editor
Carol Long
Senior Development Editor
Tom Dinse
Production Editor
Elizabeth Ginns Britten
Copy Editor
Kim Cofer
Editorial Manager
Mary Beth Wakefield
Production Manager
Tim Tate
Vice President andExecutive Group Publisher
Richard Swadley
Vice President andExecutive Publisher
Joseph B. Wikert
Project Coordinator, Cover
Lynsey Stanford
Compositor
Maureen Forys,
Happenstance Type-O-Rama
Proofreader
C.M. Jones
Indexer
Jack Lewis
Cover Designer
Michael Trent
Cover Photo
Steve Woit
Introduction
This book is a collection of essays on security: on security technology, on security policy, on how security works in the real world. Some are about specific technologies, like voting machines or national ID cards. Some are about specific targets, like airplanes or the Olympics. And some are about general trends, like increasing complexity or human behavior.
All have been published beforebetween June 2002 and June 2008in newspapers, magazines, websites, and my own monthly e-mail newsletter Crypto-Gram.
Although I have grouped them by topic and have arranged them within those topics, they all stand alone and can be read in any order. (There is some overlap of material because it appeared in different locations for different audiences.) You dont even have to read this introduction first. Actually, it might be better if you read a few essays first, then returned once you started wondering who in the world I am and what authority I have to write this broadly about security.
Im a security technologist. Ive worked for many companies, small and large, both as an employee and as a consultant. Over the years, my career has been a series of generalizations: from cryptography and mathematical security to computer and network security, and from there to more general security technology. More recently, Ive been researching and writing about the interaction between security technology and people: the economics of security and, most recently, the psychology of security.
It turns out that these human issues are the most important of all. Security is often about technology, but its always about people. People are the reason security exists in the first place, and people are at the core of any security breach. Technology helpsboth the attacker and defender, actually, although in different waysbut security is fundamentally about people.
There are four points I want to make in this introduction, points you should keep in mind as you read the essays in this book and whenever you encounter anything security-related:
1. Security is a trade-off. Theres no such thing as absolute security. Life entails risk, and all security involves trade-offs. We get security by giving something up: money, time, convenience, capabilities, liberties, etc. Sometimes we make these trade-offs consciously, and sometimes we make them unconsciously.
2. You are a security consumer. You get to make these trade-offs, whether they be personal, corporate, national, or whatever. Is this security measure effective? is not a good question. Its much better to ask: Is this a good trade-off? These trade-offs are subjective. Theres not always one answer, because not all costs are objective. Costs like inconvenience, time, and a feeling of security are subjective. Just as different consumers choose different cleaning products, different television shows, and different vacation destinations, different people will make different security trade-offs.
3. Security is a system. People often think of security in terms of specific attacks and defenses. But its not that simple. Security is always part of a system, and that system is always more complex than the individual components. Identification systems are much more than the ID card. Bank vault security is more than the metal box. Whatever the system is, security should always be analyzed in the context of the broader system.
4. Technology causes security imbalances. The thing about technology is that it changes trade-offs. It makes something cheaper, or more expensive; faster, or more time-consuming. Technological advances can make some attacks easier, or it can make some defenses easier. In todays rapidly changing technological world, it is important to watch for new security imbalances.
Much of this book consists of common-sense, although often uncommon, application of these four principles.
If youre done and want to read more, I have two recommendations. The first is my previous book, Beyond Fear: Thinking Sensibly About Security in an Uncertain World, first published in 2003. The second is to subscribe to my free monthly e-mail newsletter, Crypto-Gram. You can also visit my blog and wander through my pages of essays. The newsletter, the blog, and information about my books are all at http://www.schneier.com/.
Terrorism and Security
What the Terrorists Want
Originally published in Wired, 24 August 2006
On August 16, two men were escorted off a plane headed for Manchester, England, because some passengers thought they looked either Asian or Middle Eastern, might have been talking Arabic, wore leather jackets, and looked at their watchesand the passengers refused to fly with them on board. The men were questioned for several hours and then released.
On August 15, an entire airport terminal was evacuated because someones cosmetics triggered a false positive for explosives. The same day, a Muslim man was removed from an airplane in Denver for reciting prayers. The Transportation Security Administration decided that the flight crew overreacted, but he still had to spend the night in Denver before flying home the next day. The next day, a Port of Seattle terminal was evacuated because a couple of dogs gave a false alarm for explosives.
On August 19, a plane made an emergency landing in Tampa, Florida, after the crew became suspicious because two of the lavatory doors were locked. The plane was searched, but nothing was found. Meanwhile, a man who tampered with a bathroom smoke detector on a flight to San Antonio was cleared of terrorism, but only after having his house searched.
On August 16, a woman suffered a panic attack and became violent on a flight from London to Washington, so the plane was escorted to Bostons Logan Airport by fighter jets. The woman was carrying hand cream and matches but was not a terrorist threat, said the TSA spokesman after the incident.
And on August 18, a plane flying from London to Egypt made an emergency landing in Italy when someone found a bomb threat scrawled on an air sickness bag. Nothing was found on the plane, and no one knows how long the note was on board.
Id like everyone to take a deep breath and listen for a minute.
The point of terrorism is to cause terrorsometimes to further a political goal, and sometimes out of sheer hatred. The people terrorists kill are not the targets; they are collateral damage. And blowing up planes, trains, markets, or buses is not the goal; those are just tactics. The real targets of terrorism are the rest of us: the billions of us who are not killed but are terrorized because of the killing. The real point of terrorism is not the act itself, but our reaction to the act.