Time Based Security: Adding Measurement, Detection, and Reaction Time to Cybersecurity.

by Winn Schwartau

Book Overview

Time Based Security in a NutshellThe model for Time Based Security (TBS) originated with conversations with Bob Ayers, formerly of the Defense Information Systems Agency (DISA) over a period of years. As a result of many napkin drawings, especially in Warsaw, Poland, TBS was born. In the two years since we spent hours and days arguing over the principles, I have had the opportunity to develop TBS into a workable mathematical model for quantification of security.I have always maintained that to offer a reasonable defense, one has to know how to attack networks. So, TBS, here we go.Defensive Products Do Not and Cannot Work.The current and prevalent methods to defend networks against attack is an approach 10,000 years old based upon classic military strategy: build your defensive walls as high as you can to keep the bad guys out. This is also known as Fortress Mentality. However, it hasn't worked since the dawn of time and still doesn't work. Consider Troy: Odysseus and the Greeks camped themselves out on the plains of Troy for nine years before they screamed, "We give up And here's a horse as a present." We all know the results. The Great Wall of China was meant to keep the marauding Mongolians at bay yet advanced technology like the catapult, battering ram and bribery of guards won out. The Maginot Line; the Berlin Wall: none of them worked because they can't.This fundamental error in historical judgement, though, was what modern defensive information security was based on: how can we build the walls around our networks high enough to keep the bad guys out. Oops Wrong again. They began with the false premise that they could in fact keep the bad guys out and them compounded the error in the erroneous belief that everyone who had access to the networks was already cleared as a good guy; a pro-US gung-ho Marine-like good guy. However, this incorrect model was based upon another antique premise: computers operate in isolation -there is nonsuch thing as a network.When the Trojans let the drawbridge to their city descend to admit the horse, they were networking with the outside world. When the Germans bypassed the Maginot Line, they created a network with the French - right or wrong. When people sailed over or around the Berlin Wall, the network connection was made. Thus, the principle of Fortress Mentality began to collapse as a viable defensive posture. When the security pioneers began to develop security models, they took a similar approach because the network had not yet begun to live and expand as an independent entity. And then the hackers started at us.So, based upon the antiquated model of Fortress Mentality, our network defense program began. And the result? Use firewalls. Use passwords. Use Access Control Tables. But now the question: A lot of people have made a lot of money selling both the government and the private sector tons of firewalls another protective equipment to defend their networks. Sound like a plan, right? Well, maybe it isn't. Name me one company who guarantees their product Name me one company who will provide a warranty that if you use their products, they will legally accept responsibility for any losses you suffer if their products are compromised. Never mind that some of the most popular defensive products are created by foreign government sponsored organizations which do not release source code on how their products work.

• Format: Paperback
• Language: English
• ISBN: B08QRYT91X
• ISBN13: 9798583047444
• Release Date: December 2020
• Publisher: Independently Published
• Length: 190 Pages
• Weight: 0.58 lbs.
• Dimensions: 0.4" x 6.0" x 9.0"

Customer Reviews

Excellent

Nutshell review - The book describes the application of information security in terms of time; protection time, detection time, response time. This is a must read for infosec professionals.

One of the few classics in its field

OK, I admit it! This is another book that should be read alongside Donn Parker and Commander Smith! Excellent and thought provoking. I loved it! The only bad things you could say about it, is Winn's use of storytelling (even if I found it enjoyable and effective), and the shoddy printmanship of the book (unclear pictures and bad illustrations, but that may be Winn's doing again).Regardless of all complaints you may have against it, it needs to be read and understood, as well as being integrated into the curriculum of CISSP and equivalent certifications.

A must have for anyone interested in information security!

It has been said that "form follows function" and in the computer sciences we have had the freedom of sloppy engineering for way to long. It is joked that if builders built buildings the way programmers wrote programs the first woodpecker to come along would destroy civilization. I know that it is for this reason that we have so many problems "securing" anything in the info-sec fields, form is not following function...This book is the only book on my shelf I recommend *everyone* (interested in security) read. It is ground breaking because it starts from scratch and looks at the function and follows with what the form should be. I think this book is a decade ahead of it's time and that until every programmer, consultant, system architect, and info-sec employee read this book and the information becomes ingrained as common sense will security be truly possible in any meaningful way.Most importantly it gives useful information on how to apply this information right now, a decade before we have good competition in the security product market place that will solve this kind of problem. If you plan on doing any kind of intrusion detection, the information in this book must be at your finger tips... It is the only way to measure how well solutions deliver, and to create meaningful metrics for measuring information security solutions. The book has a certain prose about it that keeps on building on the previous idea, and hence seems to be repeating itself, however it is a short book that everyone from CEO to "in the trench guy" can read. Keep reading and thinking about what is being presented to you however and I think you will find as I did that the book is way ahead of it's time and you will soon be building a secure infrastructure for your business that you can measure, and justify.