Security Engineering, 3rd Edition

PART III

In the final part of the book I cover three broad themes: politics, management and assurance. Given that we now have some idea how to provide protection, the three big questions are: what should you do? How do you go about organizing it? And how do you know when you're done?

The first two decades of the 21st century have seen the growth of a security-industrial complex that has consumed billions of dollars and eroded both our freedom and our privacy, for often negligible gains in actual protection. The coronavirus pandemic has brought home with some force that we spend much of our social resilience budget on surveillance systems, when we should have been spending it on public health instead. Pandemic flu was at the top of most countries' risk registers for years, yet it was the heads of the security and intelligence agencies that got to sit in the national security bodies that spent the money. Sustainability should probably take over, yet there too we see just lip service.

The mechanisms that lead to the misperception of risk and the misallocation of resources are fairly well understood. Politicians scare up the vote, and threats seen as personal or cultural make people more anxious. Our industry helps them along with systems that are often best described as ‘security theater’. This gives rise to a number of ethical and political issues for the security engineer. Are our societies vulnerable to terrorism because we overreact, and if so, how can we avoid becoming part ...