![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Here's a must read...
Aug. 18th, 2002 09:32 pm...and not just because I know the guy. :)
The Atlantic Monthly has a great profile of Bruce Schneier this month... one that they've also, fortunately, put online.
Bruce is a serious crypto guy, the author of both the highly technical Applied Cryptography and the more layman-oriented Secrets and Lies.
Here's perhaps the number one concept to get from the Atlantic article:
"Schneier is hardly against technology—he's the sort of person who immediately cases public areas for outlets to recharge the batteries in his laptop, phone, and other electronic prostheses. "But if you think technology can solve your security problems," he says, "then you don't understand the problems and you don't understand the technology." Indeed, he regards the national push for a high-tech salve for security anxieties as a reprise of his own early and erroneous beliefs about the transforming power of strong crypto. The new technologies have enormous capacities, but their advocates have not realized that the most critical aspect of a security measure is not how well it works but how well it fails."
In fact, let's go back a few months, to April 15's issue of Cryptogram, Bruce's security newsletter:
"What follows is my foolproof, five-step, security analysis. Use it to judge any security measure.
This five-step process works for any security measure, past, present, or future:
1) What problem does it solve?
2) How well does it solve the problem?
3) What new problems does it add?
4) What are the economic and social costs?
5) Given the above, is it worth the costs?
When you start using it, you'd be surprised how ineffectual most security is these days. For example, only two of the airline security measures put in place since September 11 have any real value: reinforcing the cockpit door, and convincing passengers to fight back. Everything else falls somewhere between marginally improving security and a placebo."
The Atlantic Monthly has a great profile of Bruce Schneier this month... one that they've also, fortunately, put online.
Bruce is a serious crypto guy, the author of both the highly technical Applied Cryptography and the more layman-oriented Secrets and Lies.
Here's perhaps the number one concept to get from the Atlantic article:
"Schneier is hardly against technology—he's the sort of person who immediately cases public areas for outlets to recharge the batteries in his laptop, phone, and other electronic prostheses. "But if you think technology can solve your security problems," he says, "then you don't understand the problems and you don't understand the technology." Indeed, he regards the national push for a high-tech salve for security anxieties as a reprise of his own early and erroneous beliefs about the transforming power of strong crypto. The new technologies have enormous capacities, but their advocates have not realized that the most critical aspect of a security measure is not how well it works but how well it fails."
In fact, let's go back a few months, to April 15's issue of Cryptogram, Bruce's security newsletter:
"What follows is my foolproof, five-step, security analysis. Use it to judge any security measure.
This five-step process works for any security measure, past, present, or future:
1) What problem does it solve?
2) How well does it solve the problem?
3) What new problems does it add?
4) What are the economic and social costs?
5) Given the above, is it worth the costs?
When you start using it, you'd be surprised how ineffectual most security is these days. For example, only two of the airline security measures put in place since September 11 have any real value: reinforcing the cockpit door, and convincing passengers to fight back. Everything else falls somewhere between marginally improving security and a placebo."
