Schneier Chapters 4 and 5

• Schneir's adversaries:
  1. Lone criminals. People who plan and carry out attacks on their own, or with small groups.
  2. Malicious insiders. People with special access or knowledge that enables their attack.
  3. (Industrial) espionage. Organized and targeted attacks using many resources.
  4. The Press. Organizations interested in selling news, selling advertising, or furthering other goals (including accountability and access to information).
  5. Organized crime. "Lone criminals + money + organization"
  6. Police. They may use attacks in order to solve crime or for other purposes, and usually have the law on their side.
  7. Terrorists. Organizations willing to sacrifice themselves or others to achieve goals.
  8. Intelligence organizations. Might include espionage + police.
  9. Infowarriers. Um.... probably one of the above, but with some sort of mission.
• Schneier's general security needs:
  1. Privacy
  2. Multilevel security (e.g., "need to know" plus accountability, plus enforcability)
  3. Anonymity (is this needed? What do you think? When are you anonymous?)
  4. Authentication: are you who you say you are? Can we match a person or event with corresponding data correctly?
  5. Integrity. Are data accurate? Have they been changed?
  6. Audit. What's going on? When did it happen? Who did it? (Question: what data are audited on the systems you use?)
  7. E-currency. Do you use it? (Think hard. Do you?)
  8. Proaction (e.g., fraud detection)