Bruce Schneier begins Secrets and Lies by saying "I have written this book partly to correct a mistake" — that being the utopian vision of cryptography in his earlier Applied Cryptography. Of the wonders he predicted in that work, he now writes

"Cryptography can't do any of that.

... Cryptography is a branch of mathematics. And like all mathematics, it involves numbers, equations, and logic. Security, palpable security that you or I might find useful in our lives, involves people: things people know, relationships between people, people and how they relate to machines. Digital security involves computers: complex, unstable, buggy computers."

Secrets and Lies, then, is a non-technical introduction to the full, messy complexity of digital security: cryptography is covered, but only as part of the broader picture and without any mathematics at all. The result is broadly accessible, but many of the ideas it explains are misunderstood even by the technically trained, so it is a work that offers something to techs and managers as well as lay readers.

Part one is a seventy page overview of digital security which could (and perhaps should) be read by anyone who uses the Net. Schneier surveys the threats, covering not just the full range of criminal attacks but also publicity attacks and attacks using the legal system. He categorises the attackers, who can include national intelligence organisations and the press as well as terrorists, insiders, lone criminals, and corporate spies. And he looks as the various kinds of security we need, among them privacy, anonymity, integrity, authenticity, and audit.

Part two looks at a broad range of security technologies (cryptography and its context, software reliability, secure hardware, identification and authentication, and certificates and credentials) and security domains (computer, networked-computer, and network security), with a final chapter on "the human factor". Schneier provides clear, non-technical explanations of everything from the problems with mobile code to the uses of secure hardware to the limitations of digital certificates. In the process he corrects many common misconceptions about security, including some of the rather misleading statements used in product marketing.

Part three, on security strategies, covers the management of digital security. Schneier looks at vulnerabilities, attack methodologies, and countermeasures (protection, detection, and response), stressing the importance of threat modelling and risk assessment (including an approach of his own called "attack trees"). He also covers product testing and verification and the future of products. In the final analysis, however, digital security is about risk management: "security is not a product; it's a process".

December 2000

External links:

- buy from Amazon.com or Amazon.co.uk

Related reviews:

- Bruce Schneier - The Electronic Privacy Papers: Documents on the Battle for Privacy in the Age of Surveillance
- books about the Internet
- books about computing