Carry On

Introduction xv

1 The Business and Economics of Security 1

Consolidation: Plague or Progress 1

Prediction: RSA Conference Will Shrink Like a Punctured Balloon 2

How to Sell Security 4

Why People Are Willing to Take Risks 4

How to Sell Security 6

Why Do We Accept Signatures by Fax? 7

The Pros and Cons of LifeLock 9

The Problem Is Information Insecurity 12

Security ROI: Fact or Fiction? 14

The Data Imperative 15

Caveat Emptor 16

Social Networking Risks 17

Do You Know Where Your Data Are? 18

Be Careful When You Come to Put Your Trust in the Clouds 21

Is Perfect Access Control Possible? 22

News Media Strategies for Survival for Journalists 24

Security and Function Creep 26

Weighing the Risk of Hiring Hackers 27

Should Enterprises Give In to IT Consumerization at the Expense of Security? 29

The Vulnerabilities Market and the Future of Security 30

So You Want to Be a Security Expert 33

When It Comes to Security, We’re Back to Feudalism 34

I Pledge Allegiance to the United States of Convenience 35

The Good, the Bad, and the Ugly 36

You Have No Control Over Security on the Feudal Internet 37

2 Crime, Terrorism, Spying, and War 41

America’s Dilemma: Close Security Holes, or Exploit Them Ourselves 41

Are Photographers Really a Threat? 43

CCTV Doesn’t Keep Us Safe, Yet the Cameras Are Everywhere 45

Chinese Cyberattacks: Myth or Menace? 47

How a Classic Man-in-the-Middle Attack Saved Colombian Hostages 48

How to Create the Perfect Fake Identity 51

A Fetishistic Approach to Security Is a Perverse Way to Keep Us Safe 52

The Seven Habits of Highly Ineffective Terrorists 54

Why Society Should Pay the True Costs of Security 56

Why Technology Won’t Prevent Identity Theft 58

Terrorists May Use Google Earth, but Fear Is No Reason to Ban It 60

Thwarting an Internal Hacker 62

An Enterprising Criminal Has Spotted a Gap in the Market 65

We Shouldn’t Poison Our Minds with Fear of Bioterrorism 66

Raising the Cost of Paperwork Errors Will Improve Accuracy 68

So-Called Cyberattack Was Overblown 70

Why Framing Your Enemies Is Now Virtually Child’s Play 72

Beyond Security Theater 73

Feeling and Reality 74

Refuse to Be Terrorized 76

Cold War Encryption Is Unrealistic in Today’s Trenches 77

Profiling Makes Us Less Safe 80

Fixing Intelligence Failures 81

Spy Cameras Won’t Make Us Safer 82

Scanners, Sensors Are Wrong Way to Secure the Subway 84

Preventing Terrorist Attacks in Crowded Areas 86

Where Are All the Terrorist Attacks? 87

Hard to Pull Off 88

Few Terrorists 88

Small Attacks Aren’t Enough 89

Worst-Case Thinking Makes Us Nuts, Not Safe 89

Threat of “Cyberwar” Has Been Hugely Hyped 92

Cyberwar and the Future of Cyber Conflict 94

Why Terror Alert Codes Never Made Sense 96

Debate Club: An International Cyberwar Treaty Is the Only Way to Stem the Threat 97

Overreaction and Overly Specific Reactions to Rare Risks 99

Militarizing Cyberspace Will Do More Harm Than Good 101

Rhetoric of Cyber War Breeds Fear—and More Cyber War 103

Attacks from China 103

GhostNet 104

Profitable 105

The Boston Marathon Bombing: Keep Calm and Carry On 105

Why FBI and CIA Didn’t Connect the Dots 107

The FBI’s New Wiretapping Plan Is Great News for Criminals 109

US Offensive Cyberwar Policy 112

3 Human Aspects of Security 117

Secret Questions Blow a Hole in Security 117

When You Lose a Piece of Kit, the Real Loss Is the Data It Contains 118

The Kindness of Strangers 120

Blaming the User Is Easy—But It’s Better to Bypass Them Altogether 122

The Value of Self-Enforcing Protocols 123

Reputation Is Everything in IT Security 125

When to Change Passwords 127

The Big Idea: Bruce Schneier 129

High-Tech Cheats in a World of Trust 131

Detecting Cheaters 134

Lance Armstrong and the Prisoner’s Dilemma of Doping in Professional Sports 137

The Doping Arms Race as Prisoner’s Dilemma 138

The Ever-Evolving Problem 139

Testing and Enforcing 140

Trust and Society 141

How Secure Is the Papal Election? 143

The Court of Public Opinion 147

On Security Awareness Training 150

Our New Regimes of Trust 152

4 Privacy and Surveillance 155

The Myth of the “Transparent Society” 155

Our Data, Ourselves 157

The Future of Ephemeral Conversation 158

How to Prevent Digital Snooping 160

Architecture of Privacy 162

Privacy in the Age of Persistence 164

Should We Have an Expectation of Online Privacy? 167

Offhand but On Record 168

Google’s and Facebook’s Privacy Illusion 171

The Internet: Anonymous Forever 173

A Taxonomy of Social Networking Data 175

The Difficulty of Surveillance Crowdsourcing 177

The Internet Is a Surveillance State 179

Surveillance and the Internet of Things 181

Government Secrets and the Need for Whistleblowers 184

Before Prosecuting, Investigate the Government 187

5 Psychology of Security 189

The Security Mindset 189

The Difference between Feeling and Reality in Security 191

How the Human Brain Buys Security 194

Does Risk Management Make Sense? 195

How the Great Conficker Panic Hacked into Human Credulity 197

How Science Fiction Writers Can Help, or Hurt, Homeland Security 198

Privacy Salience and Social Networking Sites 201

Security, Group Size, and the Human Brain 203

People Understand Risks—But Do Security Staff Understand People? 205

Nature’s Fears Extend to Online Behavior 206

6 Security and Technology 209

The Ethics of Vulnerability Research 209

I’ve Seen the Future, and It Has a Kill Switch 211

Software Makers Should Take Responsibility 212

Lesson from the DNS Bug: Patching Isn’t Enough 214

Why Being Open about Security Makes Us All Safer in the Long Run 216

Boston Court’s Meddling with “Full Disclosure” Is Unwelcome 218

Quantum Cryptography: As Awesome as It Is Pointless 220

Passwords Are Not Broken, but How We Choose Them Sure Is 222

America’s Next Top Hash Function Begins 223

Tigers Use Scent, Birds Use Calls—Biometrics Are Just Animal Instinct 225

The Secret Question Is: Why Do IT Systems Use Insecure Passwords? 227

The Pros and Cons of Password Masking 229

Technology Shouldn’t Give Big Brother a Head Start 231

Lockpicking and the Internet 233

The Battle Is On against Facebook and Co. to Regain Control of Our Files 235

The Difficulty of Un-Authentication 237

Is Antivirus Dead? 238

Virus and Protocol Scares Happen Every Day— but Don’t Let Them Worry You 240

The Failure of Cryptography to Secure Modern Networks 242

The Story behind the Stuxnet Virus 244

The Dangers of a Software Monoculture 247

How Changing Technology Affects Security 249

The Importance of Security Engineering 251

Technologies of Surveillance 253

When Technology Overtakes Security 255

Rethinking Security 255

7 Travel and Security 259

Crossing Borders with Laptops and PDAs 259

The TSA’s Useless Photo ID Rules 261

The Two Classes of Airport Contraband 262

Fixing Airport Security 264

Laptop Security while Crossing Borders 265

Breaching the Secure Area in Airports 268

Stop the Panic on Air Security 269

A Waste of Money and Time 271

Why the TSA Can’t Back Down 273

The Trouble with Airport Profiling 275

8 Security, Policy, Liberty, and Law 279

Memo to Next President: How to Get Cybersecurity Right 279

CRB Checking 281

State Data Breach Notification Laws: Have They Helped? 283

How to Ensure Police Database Accuracy 285

How Perverse Incentives Drive Bad Security Decisions 287

It’s Time to Drop the “Expectation of Privacy” Test 288

Who Should Be in Charge of Cybersecurity? 291

Coordinate, but Distribute Responsibility 294

“Zero Tolerance” Really Means Zero Discretion  295

US Enables Chinese Hacking of Google 297

Should the Government Stop Outsourcing Code Development? 299

Punishing Security Breaches 300

Three Reasons to Kill the Internet Kill Switch Idea 302

Internet without Borders 302

Unpredictable Side Effects 303

Security Flaws 303

Web Snooping Is a Dangerous Move 304

The Plan to Quarantine Infected Computers 307

Close the Washington Monument 310

Whitelisting and Blacklisting 312

Securing Medical Research: a Cybersecurity Point of View 313

Fear Pays the Bills, but Accounts Must Be Settled 317

Power and the Internet 319

Danger Lurks in Growing New Internet Nationalism 321

IT for Oppression 323

The Public/Private Surveillance Partnership 325

Transparency and Accountability Don’t Hurt Security— They’re Crucial to It 327

It’s Smart Politics to Exaggerate Terrorist Threats 329

References 333

Index 347