The book is divided into three parts, starting with ‘the landscape’, describing who the attackers are, what they want, and what we need to do to deal with the threats. Next comes ‘technologies’, where Schneier describes the different security technologies and their limitations. The final part looks at the strategies you can use given the limitations of the technologies and the types of threat you face.

Schneier’s writing style is easy to read and entertaining. Most pages have something to intrigue you, to make you read bits out to the people around you. He uses good examples, and doesn’t try to frighten the reader unnecessarily. For example, in an early chapter describing the type of digital threats facing us, he points out that we live in a sensationalist age, but that dangers are the exception. One reason we feel under threat is because headlines such as ‘millions of people have uneventful day’ don’t sell newspapers or get clicks on web pages.

Part 1 of the book looks at the type of attacks we are at risk from such as criminal or publicity seeking; who is likely to be threatening us; and what sort of security we need. This first part of the book makes interesting reading, and is accessible enough to be read by anyone.

Part 2 looks at the technologies, starting with Schneier’s topic of choice, cryptography. More general computer security is covered next, widening the topic to look at aspects such as controlling computer access, managing accounts, virus protection, and database security. There’s a good chapter on identification and authentication that (though dated) should be required reading for all computer users. The reason I say it’s dated is that it uses Windows NT for the discussion on passwords strength. However, while we might have moved on from NT, the overall message that at the time of the book being written, the password cracking program L0phtcrack could try every alphanumeric password in 5.5 hours, every alphanumeric password with some common symbols in 45 hours, and every possible keyboard password in 480 hours is still clear. Schneier also discusses alternatives such as biometrics and access tokens and their drawbacks.

Networked-computer security is covered next, by which Schneier means attacks on computers on the Internet. As with the previous chapter, some of the discussion looks dated with the talk of Windows 3.1 and 95 and Word ’97, but the underlying messages still hold true. As an example, Schneier discusses using SSL-secured web browsing. It’s still true that people feel safer and happier with a secure web session, even though their secure session could just as easily be with someone malicious unless the user manually checks the certificate the server sent.

There’s a depressing chapter on software reliability that discusses how security measures work better in theory than in practice, and how attacks using buffer overflows and faulty code work. Chapters on secure hardware, and on certificates and credentials make equally gloomy reading. Part two of the book ends with a chapter on ‘other security tricks’ rounding up aspects that didn’t fit into earlier chapters, and a look at ‘the human factor’ – always a weak point for security.

The third part of the book, Strategies, is perhaps the most useful. It considers security as a process, looking at how attacks work in the real world, and how to design systems to deal with those attacks. A chapter on vulnerabilities and the vulnerability landscape discusses the steps to a successful attack and how to combat them. Threat modeling and risk assessment is tackled next, with an illuminating example of the different ways smart cards can be attacked. There’s a good chapter on security policies and countermeasures that avoids the usual platitudes and gives practical examples. A technique called Attack Trees that you can use to model threats against a system and how to protect it is the topic of the next chapter. There’s also an interesting chapter on security processes that gives practical advice such as secure the weakest link; use choke points to enforce monitoring and control; and make use of unpredictability.

Overall, this book still makes a great read. Parts of it have dated where specific products or threats are described, but the concepts and vulnerabilities described are all still as relevant as ever. The sad fact is that while we may be 15 years on from when it was originally published, we don’t seem to have learned much in the interim.