Rate this book

Clear rating

1 of 5 stars 2 of 5 stars 3 of 5 stars 4 of 5 stars 5 of 5 stars

The New School of Information Security

3.77 of 5 stars 3.77 · rating details · 22 ratings · 2 reviews

"It is about time that a book like The New School "came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out.""--David Mortma...more "It is about time that a book like The New School "came along. The age of security as pure technology is long past, and modern practitioners need to understand the social and cognitive aspects of security if they are to be successful. Shostack and Stewart teach readers exactly what they need to know--I just wish I could have had it when I first started out.""--David Mortman, CSO-in-Residence Echelon One, former CSO Siebel Systems Why is information security so dysfunctional? Are you wasting the money you spend on security? This book shows how to spend it more effectively. How can you make more effective security decisions? This book explains why professionals have taken to studying economics, not cryptography--and why you should, too. And why security breach notices are the best thing to ever happen to information security. It's about time someone asked the biggest, toughest questions about information security. Security experts Adam Shostack and Andrew Stewart don't just answer those questions--they offer honest, deeply troubling answers. They explain why these critical problems exist and how to solve them. Drawing on powerful lessons from economics and other disciplines, Shostack and Stewart offer a new way forward. In clear and engaging prose, they shed new light on the critical challenges that are faced by the security field. Whether you're a CIO, IT manager, or security specialist, this book will open your eyes to new ways of thinking about--and overcoming--your most pressing security challenges. The New School enables you to take control, while others struggle with non-stop crises.Better evidence for better decision-making
Why the security data you have doesn't support effective decision-making--and what to do about it Beyond security "silos" getting the job done together
Why it's so hard to improve security in isolation--and how the entire industry can make it happen and evolveAmateurs study cryptography; professionals study economics
What IT security leaders can and must learn from other scientific fieldsA bigger bang for every buck
How to re-allocate your scarce resources where they'll do the most good(less)

Hardcover, 238 pages

Published April 1st 2008 by Addison-Wesley Professional (first published March 26th 2008)

more details... edit details

Get a copy:

More…

Friend Reviews

To see what your friends thought of this book, please sign up.

Lists with This Book

This book is not yet featured on Listopia. Add this book to your favorite list »

Community Reviews

(showing 1-30 of 56)

filter | sort: default (?) | rating details

Feb 01, 2009 Doug rated it 3 of 5 stars

Recommendation from Robin Shostack...

This book speaks to CIO/CSOs and not to security professionals. I recommend this book for anybody who consumes security solutions or needs to make security software purchasing decisions.

The book is full of good, rich examples and is well written.

I have a big problem in that I flatly disagree with the thesis, which is that the "new" focus on security should be an intense review of security breaches.

Let me back up. I think you can act upon security in a number...more Recommendation from Robin Shostack...

This book speaks to CIO/CSOs and not to security professionals. I recommend this book for anybody who consumes security solutions or needs to make security software purchasing decisions.

The book is full of good, rich examples and is well written.

I have a big problem in that I flatly disagree with the thesis, which is that the "new" focus on security should be an intense review of security breaches.

Let me back up. I think you can act upon security in a number of ways. I'm splitting the levels of understanding into four for purposes of this review. The most regressive, ineffective method is to concentrate on breaches. Not to say there's no value in this; studying failures is good, I want somebody to do it and I want to read the results. But it's not actually doing anything. You've still lost your data, or lost your reputation, or perhaps you've already gone out of business.

The status quo is what I would call the "sophomore" level: focusing on attacks. Intrusion detection falls in this space, and it can be effective and you probably don't want to do without it... but it's not a good return on effort.

To begin thinking about the security problem with an adult perspective is to place your focus on threats. You simply get a lot more bang out of understanding what's at stake and how an attacker (or bug) would most likely compromise what you care about the most.

The highest level of understanding I can think of is to focus on prevention. This is either the next step from understanding threats, or it's simultaneous with doing so. Should we even hold that thing the attackers want so badly? Is there missing input validation in my gateway application to that resource? Are access controls really set up the way they were designed to be?

I felt a little lost in that the endnotes were not numbered, but maybe I'm a just a nerd and it's for the best.

The publisher stuck a sneak preview of _Geekonomics_ into the end and I'm interested in reading that now.(less)

like · see review

Nov 13, 2011 Tim rated it 4 of 5 stars

Nice macro-view of information security. There's very little in the way of operational detail in the book, but I think that's the point :)

I very much liked their take the security measures should be evidence based.

like · see review

Apr 16, 2013 behemoth added it

Apr 06, 2013 Bubbly marked it as from-amazon-wishlist · review of another edition

Mar 31, 2013 Clay rated it 4 of 5 stars

Mar 09, 2013 Peaks marked it as to-read

Mar 07, 2013 Mengchow marked it as to-read

Feb 08, 2013 Guilherme Damasio rated it 5 of 5 stars

Feb 03, 2013 Martisch marked it as to-read

Feb 01, 2013 Alex Railean rated it 4 of 5 stars

Shelves: business, economics, security, technology

Jan 27, 2013 David Janke marked it as to-read

Jan 27, 2013 Rick Howard marked it as to-read

Shelves: cyber-security-books-to-read

Jan 05, 2013 Chrishoulder rated it 4 of 5 stars

Dec 24, 2012 Ian marked it as to-read

Shelves: to-read-tech

Dec 13, 2012 Mustafov Aljunied rated it 5 of 5 stars

Dec 06, 2012 Ali Khalfan rated it 4 of 5 stars

Oct 30, 2012 Andreas added it

Oct 13, 2012 Teresa Merklin marked it as to-read

Shelves: wish-list

Oct 03, 2012 Ganesh Lamichhane added it

Sep 29, 2012 Andrew Hart rated it 3 of 5 stars

Sep 17, 2012 Herr Bücher rated it 2 of 5 stars

Sep 12, 2012 Duy Dang rated it 3 of 5 stars

Aug 03, 2012 Tom rated it 2 of 5 stars

Jul 13, 2012 Julián rated it 4 of 5 stars

May 24, 2012 KC Yerrid rated it 4 of 5 stars

May 15, 2012 Ian rated it 3 of 5 stars

Apr 12, 2012 Jennifer marked it as to-read

Mar 24, 2012 Crowley added it

Feb 29, 2012 Arjun marked it as to-read

Feb 23, 2012 Mark Eichin added it

Shelves: kindle

« previous 1 2 next »

See top shelves...

Share This Book

Facebook Twitter Your website

Trivia About The New School of...

No trivia or quizzes yet. Add some now »

title link	preview: The New School of Information Security
avg rating	preview: The New School of Information Security Goodreads rating: 3.77 (22 ratings)
small image	preview: click here [close]
med image	preview: click here [close]
BBCode	[url=http://www.goodreads.com/book/show/3085015-the-new-school-of-information-security?utm_medium=api&utm_source=blog_book][img]http://d.gr-assets.com/books/1347784659l/3085015.jpg[/img][/url] [url=http://www.goodreads.com/book/show/3085015-the-new-school-of-information-security?utm_medium=api&utm_source=blog_book]The New School of Information Security by Adam Shostack[/url]

The New School of Information Security

Friend Reviews

Lists with This Book

Community Reviews

new topic
Discuss This Book

combine
Other Editions (2)

Genres

Share This Book

Share This Book on Your Website

Trivia About The New School of...

The New School of Information Security

Friend Reviews

Lists with This Book

Community Reviews

new topicDiscuss This Book

combineOther Editions (2)

Genres

Share This Book

Share This Book on Your Website

Trivia About The New School of...

new topic
Discuss This Book

combine
Other Editions (2)