Bruce Schneier Q&A: The Endless Broadening of Security

For Bruce Schneier, the security discipline still evolves and expands. Now he's the one trying to expand it.

June 02, 2008 — In September 2003, CSO published a groundbreaking interview with security guru Bruce Schneier. At the time, Schneier was evolving from cryptographer to general security thinker. An emerging generation of Internet criminals and the new realities of a post-9/11 world were fueling his ideas beyond information security to the broader realm where technology and the physical world interacted. He was beginning to see security as a social science. "Real security means making hard choices," Schneier said at the time. It's one of his favorite interviews, and one of ours, too.

Now, nearly five years later, we wanted to find out how Schneier's views on security have evolved since then. Of course his views have changed—Schneier is not one to let his ideas settle into complacency. For Schneier, who is Chief Security Technology Officer of BT, security keeps getting broader, more general, more related to every aspect of our lives. Security, which started for him as fixed equations used for hiding digital data, has become nothing less than the fundamental catalyst for all human behavior. "I have come to believe that security is fundamentally about people," he says.

With this endless broadening of security has come an endless broadening of ambition. Schneier is launching launch the Workshop on Security and Human Behavior—an effort to bring together the brightest thinkers from any number of disciplines: Economists, technologists, psychologists, even poets will be there. The goal is no less than to launch a new academic discipline.

CSO spoke with Schneier about this effort, his impressions of how security's changed over the past five years, and the highly sophisticated risk management practiced by lima beans.

CSO: Five years ago, we published The Evolution of a Cryptographer about how your views on security had changed. Let's start there again. How have your views changed since then?

Schneier: My career seems to be an endless series of generalizations. First cryptography, then computer and network security, then general security—airlines, ID cards, terrorism, and so on—more recently security economics, and now the psychology of security.

This evolution reflects my continuing search for broader contexts by which to understand security. I started out in the details of the technology, but have come to believe that security is primarily about people—and that understanding the people is more important than understanding the technology. Because if we get the economic or psychological motivations wrong, it doesn't matter how good our technology is; it's not going to be used.

CSO: In other words, the fact that, technically, something should be secured has little to do with whether it will be secured?