This chapter is from the book
This chapter is from the book
This chapter is from the book
The Need for a New School
Criminals and thugs seek to take advantage of the increasingly electronic nature of our lives. Some crimes occur in the physical world, and others take place purely in the realm of computers. These problems can contribute to distrust of the internet as a medium for commerce and interaction. Problems such as data breaches and identity theft portend doom, but the mere fact of their existence raises important questions. Perhaps our approach to information security is flawed. If it is, a dollar spent on information security is unlikely to be spent well.
We wrote this book not because we are pessimists, but to help coalesce and accelerate the rise of a New School of Information Security. That New School is focused on putting our ideas and beliefs through tests designed to draw out their flaws and limitations. By testing our ideas, we can learn to do better than simply following our superstitions and ingrained beliefs. Such testing allows us to improve on the status quo. The New School is concerned with analyzing on what basis we make security decisions today and with seeking data to support rational decision-making. The New School also believes we can make better decisions by learning from other sciences, such as economics. If there were a single information security community, we could say that parts of the New School have been percolating through it for a while. We hope to help organize, add context to, and extend these ideas into a coherent whole.
Some might say that we are already doing enough, that our current approaches and existing levels of investment are sufficient. If we were to implement new approaches—new training, new technologies, and new processes—would their cost be justifiable? Our answer is that investing in new ways of thinking is inexpensive.
Some security practitioners are beginning to question the received wisdom of their profession. In parallel, the way in which businesses view their information security needs is changing. Organizations want to know how to protect themselves in this new world, but they also want to ensure that they are making security decisions that are both effective and fiscally responsible. A skeptical, pragmatic, and forward-thinking outlook is emerging and will become a new consensus. That consensus is the New School of Information Security.
A psychologist friend likes to say that there are three ways to deal with any problem: you can change it, you can accept it, or you can go nuts. This book is offered in the hopes that we can effectively change some things, accept others, and fail to go nuts.