“Beyond Fear” by Bruce Schneier. ISBN 0-387-02620-7 published 2003.
In this book, Bruce Schneier attempts to demystify security and asks us to move ‘Beyond Fear’ when making everyday, and often emotive, security decisions. It guides us through three sections, in which we are asked to understand the concept of security trade-offs, the technicalities of security, and finally the ongoing process or security ‘game’.
The main focus of the book is the ‘five step process’, which boils down to a security risk analysis written in layman’s terms. This process defines the five questions each of us needs to ask ourselves when trying to make a fair and balanced judgement on a security decision. It’s clear that the book is aimed at readers with no prior knowledge of security; it is a populist book for general readers. To this end, the level at which it pitches is about right, but because of this, I wouldn’t recommend this book to people who already work in the security industry.
There are several things that Schneier does well. It’s very important that someone presents a composed and rational argument of how to manage security post 9/11 – a theme that runs throughout the book. He also takes good care to ensure the arguments are easily understood and written in plain English with no jargon. The examples he draws upon are relevant and topical, such as whether or not to buy a burglar alarm, arm airline pilots or shop over the Internet. He makes the point of trade-offs very clearly, especially that you need to consider the new risks inherent in introducing a security control, something that is often overlooked even by professionals. For example, although there are benefits to creating a national identity database, it would place all citizens’ data in one place and cause it to become a prime target. Having so much data in one place is fine until security is breached, at which point it will fail catastrophically – a situation Schneier calls ‘brittle’ security. There is consideration also for the politics of security, which more often than not is the deciding factor in security decisions that affect the general population.
Unfortunately, there are several negative aspects. Many of the main points of the book are lost amongst the dozens of anecdotes and examples that, although serving to illustrate the concepts, cause the reader to lose track of the book’s direction. This is compounded by Schneier’s writing style, which isn’t as well suited to the popular market as it could be. There is also a distinct lack of answers to many of the main questions that are posed. It’s true that ‘it depends’ is often the only answer given the complex nature of security, especially when applied to terrorism, but it often leaves the reader feeling none the wiser.
Overall, the book is fair. It requires the reader to have a genuine desire to want to gain a better understanding of security, but will be too dry for the casual reader and too basic for those with experience. I would recommend it to someone who feels disillusioned by or suspicious of the intrusive nature of post 9/11 security controls, but they would need to exercise a lot of patience to ensure they read each chapter in its correct context and follow the book closely to its conclusion.