3 ms·
I appreciate Bruce's attempts, but as usual, I'm skeptical about his presumed knowledge about every area of security merely because he's an accomplished cryptog
by sabat 17y ago
I appreciate Bruce's attempts, but as usual, I'm skeptical about his presumed knowledge about every area of security merely because he's an accomplished cryptographer.
Security is a mish-mash of scattered fields related only by the concern that someone is going to do something undesirable. I have strong doubts that being a cryptographer qualifies you, automatically, as an expert in physical security.
We need to face the fact the reason there aren't more terrorist attacks is simply because there are not that many people in the world are genuinely willing to commit suicide while taking other lives. Schneier's not entirely wrong, but I think his reasons are peripheral.
- iron_ball 17y agoWell, that was precisely one of his points. There aren't all that many terrorists out there.
- sabat 17y agoIf you define "terrorist" as someone who is actually going to attempt to take others' lives (and possibly his own), then sure. I'm not that sure this is what Bruce meant.
- timcederman 17y agoNot to be too condescending, but it's pretty obvious you haven't studied information security at all (let alone read Schneier's work?). Saying someone is "only" an "accomplished cryptographer" really diminishes what is required to have the mindset that makes you a good cryptographer, amongst other things.
- sabat 17y agoActually I have 10+ years in the field, am a CISSP, and was a CISO in the financial services industry for 6 years. Saying someone is "only" an "accomplished cryptographer" really diminishes what is required to have the mindset that makes you a good cryptographer That's precisely the point of view I'm refuting. The kind of mindset you need to be a good cryptographer has little or nothing to do with being good at physical security, network security, or any other field of security. The reason: informations security is composed of disparate fields, related only by the need to maintain C., I., and A.
- timcederman 17y agoBut cryptography is only one part of information security - not sure why you're focusing on that.
- sabat 16y agoBecause that's what Bruce's background and experience is in. He has never worked in most of the other areas -- he's never held a position doing physical security work. I've got reservations about "security" being all the same thing, and about Bruce being a presumed expert in every area of it. It'd be like a veterinarian doing surgery on a human. Related? Loosely.