Secrets and Lies

Subtitled Digital Security in a Networked World, it is best remembered for its preface. Six years after Applied Cryptography, Schneier writes that he had believed strong cryptography was enough, and that he had been wrong. Systems did not fall because someone broke the cipher; they fell because users picked bad passwords, implementations leaked and organisations never noticed the intrusion.

The book brought to a general audience ideas Schneier kept hammering in Crypto-Gram: attack trees as a way to model threats, security as a process rather than a product, and detection and response mattering as much as prevention. The specifics have aged; the shift in perspective — from ciphers to people and economics — is why it is still read.