17

In the previous episode, we established a consensus that changing our name to either “Information Security” or “Security” would be preferable to keeping our current name “IT Security” which does not reflect the site's topic well.

We've answered questions about blasting ATMs, stealing some documents from a storage unit, padlocks, shooting laser into cameras, protecting computers from a nuclear apocalypse, detecting CCTV cameras, and getting teenagers off our lawns. Every month we get paranoid about something new.

The opinions expressed on the previous thread do not clearly show whether the community prefers “Information Security” or “Security”. So which one should it be?


The site's URL is already security. The main visible changes would be the official name in various places, and the site's logo.

| |
24

I personally prefer "Information Security" because "Security" alone has too high a potential for drifting into really distinct areas, e.g. politic issues with regards to terrorism ("Homeland Security"), unemployment ("job security") or police forces. It is a bit too broad to my taste.

Thinking about it, I would say that the point is that the site ought to be technical: questions about how security can be implemented, with always a view towards technology, not about philosophical issues. The line is hard to pinpoint, but the logo is not meant to be a precise definition; it should be a way to convey the right idea, if vaguely. In that view, "Information Security" has a technical glimmer which "Security" alone lacks ("InfoSec" would even be better for that -- except for its inherent ugliness, of course).

Applying that to Anderson's book, note that it is called Security Engineering and the second term is no less important than the first.

| |
  • This is a site for professionals. I think that provides the same bent as engineering and technical. – Gilles 'SO- stop being evil' Aug 23 '13 at 20:15
  • 3
    Yes, we know this is a site for professionals. The site title and logo are for people who do not know the site yet. It is all about making the first sight correct; for people who already contribute to the site, the logo and title are irrelevant. The current title does not say "for professionals", neither does the logo (but they do say "IT", which at least implies "technical"). – Thomas Pornin Aug 23 '13 at 20:19
  • 3
    Also, there are quite a number of contributors who are not professional security practitioners (some are not even old enough to have a job), so the idea that the site is "for professionals" must be taken with a grain of salt. – Thomas Pornin Aug 23 '13 at 20:21
  • 4
    @Gilles: If you really want to see a long and protracted discussion on what "professional" can mean see here. I've always felt like professional is more about attitude and approach rather than employment status. – Scott Pack Aug 24 '13 at 4:02
  • @ScottPack This site is a site for professionals where people are not carded: non-professionals are welcome if they manage to engage the professionals' interest. (It helps that being a security professional often entails explaining security to non-professionals.) SF is… something else that I had better not describe adequately lest I start using words that would make even local denizens blush. – Gilles 'SO- stop being evil' Aug 24 '13 at 8:42
  • @Gilles: You're letting your emotions get the better of you. My point in bringing them up is that they're the only other SEI site that I know of whose target demographic are professionals instead of hobbyists. The point is that "professional" is more about approach and attitude than title or source of paycheck. I've attempted to explain this to you before, remember? – Scott Pack Aug 24 '13 at 13:07
  • 2
    @ScottPack WTF? For the SF part, let's take it to chat. There are other professional SE sites. Theoretical Computer Science, MO are for researchers in the domain (like on Sec.SE, nobody asks you for credentials, what matters is that your question interests researchers). I think Database Administrators and Cross Validated are also fairly pro-oriented but I'm not familiar with them so I could be wrong. Then there are many beta sites. – Gilles 'SO- stop being evil' Aug 24 '13 at 15:15
  • @Gilles - part of what the site is about is security awareness. This means preaching to laymen. – Deer Hunter Sep 1 '13 at 7:49
  • @Gilles Hey us non-pros are pretty cool. I mean it's not like we don't have good questions (I've gotten a large majority of my rep from questions I've asked.) I think students should be included.... – Griffin Nowak Sep 3 '13 at 19:27
  • @Griffin Students who study security are professionals in training, they are thus included. Furthermore, the site is not exclusively for professionals: it is designed for professionals. Non-professionals are welcome to participate as long as their content is something that professionals are comfortable with. – Gilles 'SO- stop being evil' Sep 3 '13 at 20:20
  • @Gilles What is "SF"? – Matrix Sep 26 '13 at 11:08
  • @Matrix Server Fault — Scott and I were comparing Server Fault's and Security.SE's notions of “professional”. – Gilles 'SO- stop being evil' Sep 26 '13 at 11:34
10

From my experience sticking to "Information Security", or even worse "Information Assurance" would be the best choice.

Most of the people I talk to (in the USA) hear the phrase "I work in security" and assume that I either

  1. Go to work wearing a uniform and possibly sidearm, or
  2. Go to work wearing plain clothes and a earpiece, possibly with no neck and a very nice case in the trunk.

In one situation I had a very interesting, and odd, conversation with a former classmate who also worked in security. It took us a few minutes to realize I meant Information and he meant Personal.

Sticking with "Information Security" definitely helps explicitly bring the scope down to what we've traditionally covered. While it is true that our FAQ is somewhat vague on the specifics, stating,

IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to:

we have always worked under the assumption that we mean information assets.

| |
  • 1
    But why would we accept questions about lockpicking if the safe contains the master password list, and not if the safe contains diamonds? – Gilles 'SO- stop being evil' Aug 24 '13 at 8:43
  • 2
    @Gilles: I'm trying not to go out of my way to find hairs to split since I think that path is ultimately fraught with so many exceptions as to be disastrous. – Scott Pack Aug 24 '13 at 13:03
  • … which is why the name “Information Security” is bad in the same way as “IT Security”: it's an invitation to split hairs. – Gilles 'SO- stop being evil' Aug 24 '13 at 15:17
  • 1
    Information Assurance? The next moment you change the name to this, abbreviation to "IAss" or "InfoAss" or "InAss" will be making you regret your decision. Strongly. – Deer Hunter Sep 1 '13 at 7:42
  • @DeerHunter: I don't disagree. Information Assurance seems to be the new cool kid name for the field. I don't much care for it. – Scott Pack Sep 1 '13 at 14:12
1

I prefer the name Security. It's short and sweet, it's what we already have in the URL. And we often call the site “Security Stack Exchange” already anyway.

Our focus may be on information security, but that's partly a historical accident (this site started out with a strong predominance of network security, and a gradual shift towards more application security via web applications where the twain meet), and partly a bias that any community website is dominated by people who work in computer-related fields. We accept questions about safes when they're used to store backup tapes, so why not accept exactly the same question if the safe contains diamonds?

Any subject good enough for Bruce Schneier should be good enough for us. [Goes off to post a question about squid biology.]

Ross Anderson's book Security Engineering is also a good topic guide. Here's a sample of topics that it covers:

  • Concepts and theory: protocols, access control, multilevel security, …
  • Information security: cryptography, emission security, bookkeeping, printing, seals, …
  • Non-IT topics: economics, justice, nuclear control, …

So let's not replace “IT Security” by “Information security” which is a lot longer and dwarfs the word security by what is at worst a secondary concern and at best irrelevant. The name “Information Security” is worse than “IT Security”. It's longer, and will not turn away the stuff we don't want any more than IT does. Make the official name Security. Just drop IT.


To address any concern that the sky will fall down because we'll be inundated with questions about unemployment, terrorism, police, etc.: this is a site for professionals. I have no idea what an (un)employment security professional would be. As for terrorism and police professionals, I think their security questions could be on-topic, and I'll refer you again to Bruce Schneier tends to write about. As for personal defense, I consider it a tool that can be used for security, in the same vein as cryptography: its techniques are off-topic here, though its doctrine of use might be on-topic. (I do think this site is a lot closer to cryptography than to personal defense, because there is a lot more shared expertise).

Looking at this from the other side, we're already getting a small but steady flux of IT questions. But do you really believe that it's because of the “IT” in the name?

On the gripping hand, people who ask wildly off-topic questions by and large don't read. We could call the site whatever we like, it's not going to influence the non-readers. So let's not worry about them, eh?

| |
  • In defence of your choice, how would address some of the unrealisitc concerns regarding Sec.SE turning into an unemployment, terrorism, and police-related site? – Adi Aug 23 '13 at 20:01
  • @Adnan I have now addressed these unrealistic concerns. – Gilles 'SO- stop being evil' Aug 23 '13 at 20:16
  • The problem that I see is that "security" is a very ambiguous term, overridden in many fields by their own local term. So as @Scott mentioned, one might be a "professional" in the field of personal security, and just assume that "security" means the term he is familiar with. Or perhaps we're talking about "securities trading", again a professional in that field would just read it the same way. Both of these have happened to me... I've even had a psychologist insist that we're in the same field, since he deals with "insecurity" (sic) of his patients. True Story. – AviD Aug 24 '13 at 21:30
  • 1
    @AviD I'm a (former) computer scientist, I'm very much used to people thinking that means I know how to fix their Windows. On Computer Science, we get a steady flux of questions like this, despite “science” in the name. How is that relevant to changing the site name? We already get people who think “IT security” is about fixing their Windows, 'cos it has to be a virus. The change of name wouldn't make a difference in that respect. – Gilles 'SO- stop being evil' Aug 24 '13 at 21:37
  • Because this is not just about what might confuse other people, it is about the ambiguity of the term. We tend to just grab ownership of the word, forgetting that it does have other legitimate, non-confused meanings. – AviD Aug 24 '13 at 21:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .