Politico profiles Bruce Schneier, a security specialist who has emerged as one of the foremost critics of the security state. Here's an excerpt:
After 9/11, Schneier saw a familiar utopian thinking creeping into the politics of national security, and he grew into an outspoken critic. He coined the term "security theater" to describe the showy-but-ineffectual performance of security around air travel, a choreography designed to produce a feeling of safety despite being poorly implemented, defending against the wrong danger, or both. His blog, dedicated to cryptography and tech security, was for a time a catalog of the many ways that ever-changing TSA regulations had been defeated by people with everyday resources but above-average creativity. And last year, he caused a small controversy when he cited research claiming that in the years following the September 11th attacks, enough people had chosen long-distance driving over air travel that the increase in auto-accident fatalities surpassed the number of deaths in the Twin Towers.
For Schneier, security is always a choice between different sets of risk, and there is no such thing as a perfect defense; you calculate the probabilities, and the potential costs of your decisions, as best you can. His arguments illuminate not only the places where politics and superstition have worked their way into supposedly rational systems, but also, in sometimes unexpected ways, how the shadow of 9/11 continues to define U.S. national security.
Read the rest here. Read Reason's interview with Schneier here, and read a piece he wrote for ushere.
Start your day with Reason. Get a daily brief of the most important stories and trends every weekday morning when you subscribe to Reason Roundup.
Editor's Note: As of February 29, 2024, commenting privileges on reason.com
posts are limited to Reason Plus subscribers. Past commenters are grandfathered in for a temporary
period.
Subscribe
here to preserve your ability to comment. Your
Reason Plus subscription also gives you an ad-free version of reason.com, along with full access to the
digital
edition and archives of Reason magazine. We request that comments be civil and on-topic. We do
not moderate or assume any responsibility for comments, which are owned by the readers who post them. Comments
do not represent the views of reason.com or Reason Foundation. We reserve the right to delete any comment and
ban commenters for any reason at any time. Comments may only be edited within 5 minutes of posting. Report abuses.
His initial disbelief faded when companies began hiring him to review their digital security, and he found "the weak points had nothing to do with the mathematics. They were in the hardware, the software, the networks and the people. Beautiful pieces of mathematics were made irrelevant."
This is why I love this guy. Where I work, we have layers and layers and layers of encryption, passwords, security, all of it technical. But you'd be amazed at how easily the whole thing goes south because a medical assistant gives her password away to a stranger on the phone.
FBI investigator: Shit, Silk Road is all encrypted and TORd and anonymized... and their damned servers are in Turkmenistan!
FBI Director: Hang on. *looks over shoulder* Gladys! Get the Turkmenistan head of intelligence on the phone!
Gladys: *dials number* He's on line 3, sir!
FBI Director: Alexei, long time no talk. Look, need a favor, got these servers I want images for. *crackled talking on other end* Don't I know it... no fourth amendment for you! Ha, in Turkmenistan, Fourth Amendments YOU! What a country! *laughing on both ends of phone* No, but seriously, I'll telex the server details to you and if you could just let me know when the server images are ready.
*crackled talking on other end of line*
FBI Director: Oh, the usual. How does $5 million for a security and stabilization grant sound?
I just read an article about the Target breach. Sounds like Target's security systems worked correctly to identify the breach, but Target failed to act on the notice. In other words, some human error led to a massive security breach.
It's not all public I'm sure, but I heard a while back that it was access through an HVAC vendor that got the malware into the POS systems. Which, if this article is correct, was detected by Target before the breach.
Molly Snyder, says the intruders had gained access to the system by using stolen credentials from a third-party vendor.
Jesus this is classic. Classic. This whole article is like a who's who of security weaknesses that exist in probably every damned organization. Yes, including mine. Hell, especially mine.
Management: Paul and team, create generic logins that random people will know because logging on is hard.
Us: Not a good idea. Presents a security vulnerability.
Management where I work is fairly good at managing security, which is odd since we are a chemical science company. However, there are some seriously strange protocols. Example: sensitive information should not be shared through email unless it is first encrypted in an archive. Then it can be sent through email; the password should then be sent in a separate message.
I brought this up to the legal department and pointed out that if the mail system was compromised an attacker would have the sensitive information just like they would have if the information hadn't been encrypted.
Within my company security concerns raised through the legal department tend to get addressed faster/more thoroughly than through regular channels. It doesn't hurt that there is a specific Legal IT group
As a result, we are conducting an end-to-end review of our people, processes and technology to understand our opportunities to improve data security and are committed to learning from this experience.
Jesus fucksticks... fire this guy. He's calling the world's largest retail breach an "opportunity".
"By elevating can-do attitudes above accurate-and-sometimes-gloomy status reporting, such project managers undercut their ability to take corrective action. They don't even kjnow they need to take corrective action until the damage has been done. As Tom DeMarco says, can-do attitudes escalate minor setbacks into true disasters.
I will not say anything further right now, because reasons, but I will say that I will say that I have personal, intimate experience with a similar security breach, and the similarities are very close indeed. Technological safeguards usually work just fine, as long as the humans have bothered to put the safeguards into place, pay attention to them, and respond appropriately. Real problems occur when good safeguards are not put into place (because there's always something more important to do), people are tricked into giving away access, and the organization fails to immediately go into complete lockdown and pretty much just sits there and watches things happen.
Bruce is awesome...I got involved with crypto and security several years ago and found him to be the authority on it. Plus he has THIS site dedicated to him, my favorite is Divides by Zero.
Bruce is awesome...I got involved with crypto and security several years ago and found him to be the authority on it. Plus he has THIS site dedicated to him, my favorite is Divides by Zero.
?"he cited research claiming that in the years following the September 11th attacks, enough people had chosen long-distance driving over air travel that the increase in auto-accident fatalities surpassed the number of deaths in the Twin Towers."
So the net on TSA is not that it is ineffective, it is that is truly harmful. And for this we pay every time we try to board a plane and every April 15th.
fucking awesome alt-text
Connoisseurs of quality alt-tex are nodding their approval.
Also Bruce needs more air time. On any network.
It's hard to savor the alt-text when you can't comment on it!
What is the deal with alt-text? H&R commentators seem to have a strange hangup for it.
It's a medical issue, but only somewhat contagious.
If you have to ask, you can't know.
Wow, we're getting personalized alt-text now? What did people with less discriminating tastes get?
A section of Mary's Episiarch slashfic
Chive on! Or whatever those green shirted cultists chant.
This is why I love this guy. Where I work, we have layers and layers and layers of encryption, passwords, security, all of it technical. But you'd be amazed at how easily the whole thing goes south because a medical assistant gives her password away to a stranger on the phone.
People don't get hacked, they get dumbassed.
http://www.howtogeek.com/11567.....real-life/
It's the endpoints... IT'S THE DAMNED ENDPOINTS!
FBI investigator: Shit, Silk Road is all encrypted and TORd and anonymized... and their damned servers are in Turkmenistan!
FBI Director: Hang on. *looks over shoulder* Gladys! Get the Turkmenistan head of intelligence on the phone!
Gladys: *dials number* He's on line 3, sir!
FBI Director: Alexei, long time no talk. Look, need a favor, got these servers I want images for. *crackled talking on other end* Don't I know it... no fourth amendment for you! Ha, in Turkmenistan, Fourth Amendments YOU! What a country! *laughing on both ends of phone* No, but seriously, I'll telex the server details to you and if you could just let me know when the server images are ready.
*crackled talking on other end of line*
FBI Director: Oh, the usual. How does $5 million for a security and stabilization grant sound?
I just read an article about the Target breach. Sounds like Target's security systems worked correctly to identify the breach, but Target failed to act on the notice. In other words, some human error led to a massive security breach.
I haven't read anything except when the story first broke... at that time it very much looked like inside job.
Will check your link.
It's not all public I'm sure, but I heard a while back that it was access through an HVAC vendor that got the malware into the POS systems. Which, if this article is correct, was detected by Target before the breach.
Sucks to be Target right now.
Jesus this is classic. Classic. This whole article is like a who's who of security weaknesses that exist in probably every damned organization. Yes, including mine. Hell, especially mine.
Management: Paul and team, create generic logins that random people will know because logging on is hard.
Us: Not a good idea. Presents a security vulnerability.
Management: Do it anyway.
Oh wait, what am I saying? My management is creating opportunities.
Management where I work is fairly good at managing security, which is odd since we are a chemical science company. However, there are some seriously strange protocols. Example: sensitive information should not be shared through email unless it is first encrypted in an archive. Then it can be sent through email; the password should then be sent in a separate message.
I brought this up to the legal department and pointed out that if the mail system was compromised an attacker would have the sensitive information just like they would have if the information hadn't been encrypted.
Within my company security concerns raised through the legal department tend to get addressed faster/more thoroughly than through regular channels. It doesn't hurt that there is a specific Legal IT group
Jesus fucksticks... fire this guy. He's calling the world's largest retail breach an "opportunity".
"By elevating can-do attitudes above accurate-and-sometimes-gloomy status reporting, such project managers undercut their ability to take corrective action. They don't even kjnow they need to take corrective action until the damage has been done. As Tom DeMarco says, can-do attitudes escalate minor setbacks into true disasters.
That's corporate speak. Every fuck-up is an opportunity or challenge.
If the Nazis were around today, they'd call the Holocaust a "Demographic-Shifting Opportunity."
I will not say anything further right now, because reasons, but I will say that I will say that I have personal, intimate experience with a similar security breach, and the similarities are very close indeed. Technological safeguards usually work just fine, as long as the humans have bothered to put the safeguards into place, pay attention to them, and respond appropriately. Real problems occur when good safeguards are not put into place (because there's always something more important to do), people are tricked into giving away access, and the organization fails to immediately go into complete lockdown and pretty much just sits there and watches things happen.
Bruce is awesome...I got involved with crypto and security several years ago and found him to be the authority on it. Plus he has THIS site dedicated to him, my favorite is Divides by Zero.
Bruce is awesome...I got involved with crypto and security several years ago and found him to be the authority on it. Plus he has THIS site dedicated to him, my favorite is Divides by Zero.
SQUIRRELLLLZZZZZ!!!
But can you make $8745 a week from home? Well??
I am going to have squirrel for dinner tonight! DAMNIT!
Reason, your servers suck.
It's not the servers, it's the people who run them
Posting tip.
If it won't preview, it won't post.
?"he cited research claiming that in the years following the September 11th attacks, enough people had chosen long-distance driving over air travel that the increase in auto-accident fatalities surpassed the number of deaths in the Twin Towers."
So the net on TSA is not that it is ineffective, it is that is truly harmful. And for this we pay every time we try to board a plane and every April 15th.
And playing the comment-lotto is such fun!