Should we change our name to “Information Security” or “Security”?

Question

In the previous episode, we established a consensus that changing our name to either “Information Security” or “Security” would be preferable to keeping our current name “IT Security” which does not reflect the site's topic well.

We've answered questions about blasting ATMs, stealing some documents from a storage unit, padlocks, shooting laser into cameras, protecting computers from a nuclear apocalypse, detecting CCTV cameras, and getting teenagers off our lawns. Every month we get paranoid about something new.

The opinions expressed on the previous thread do not clearly show whether the community prefers “Information Security” or “Security”. So which one should it be?

---

The site's URL is already security. The main visible changes would be the official name in various places, and the site's logo.

Answer 1

I personally prefer "Information Security" because "Security" alone has too high a potential for drifting into really distinct areas, e.g. politic issues with regards to terrorism ("Homeland Security"), unemployment ("job security") or police forces. It is a bit too broad to my taste.

Thinking about it, I would say that the point is that the site ought to be technical: questions about how security can be implemented, with always a view towards technology, not about philosophical issues. The line is hard to pinpoint, but the logo is not meant to be a precise definition; it should be a way to convey the right idea, if vaguely. In that view, "Information Security" has a technical glimmer which "Security" alone lacks ("InfoSec" would even be better for that -- except for its inherent ugliness, of course).

Applying that to Anderson's book, note that it is called Security Engineering and the second term is no less important than the first.

Answer 2

From my experience sticking to "Information Security", or even worse "Information Assurance" would be the best choice.

Most of the people I talk to (in the USA) hear the phrase "I work in security" and assume that I either

1. Go to work wearing a uniform and possibly sidearm, or
2. Go to work wearing plain clothes and a earpiece, possibly with no neck and a very nice case in the trunk.

In one situation I had a very interesting, and odd, conversation with a former classmate who also worked in security. It took us a few minutes to realize I meant Information and he meant Personal.

Sticking with "Information Security" definitely helps explicitly bring the scope down to what we've traditionally covered. While it is true that our FAQ is somewhat vague on the specifics, stating,

IT Security Stack Exchange is for Information Security professionals to discuss protecting assets from threats and vulnerabilities. Topics include, but are not limited to:

we have always worked under the assumption that we mean information assets.

Answer 3

I prefer the name Security. It's short and sweet, it's what we already have in the URL. And we often call the site “Security Stack Exchange” already anyway.

Our focus may be on information security, but that's partly a historical accident (this site started out with a strong predominance of network security, and a gradual shift towards more application security via web applications where the twain meet), and partly a bias that any community website is dominated by people who work in computer-related fields. We accept questions about safes when they're used to store backup tapes, so why not accept exactly the same question if the safe contains diamonds?

Any subject good enough for Bruce Schneier should be good enough for us. [Goes off to post a question about squid biology.]

Ross Anderson's book Security Engineering is also a good topic guide. Here's a sample of topics that it covers:

• Concepts and theory: protocols, access control, multilevel security, …
• Information security: cryptography, emission security, bookkeeping, printing, seals, …
• Non-IT topics: economics, justice, nuclear control, …

So let's not replace “IT Security” by “Information security” which is a lot longer and dwarfs the word security by what is at worst a secondary concern and at best irrelevant. The name “Information Security” is worse than “IT Security”. It's longer, and will not turn away the stuff we don't want any more than IT does. Make the official name Security. Just drop IT.

---

To address any concern that the sky will fall down because we'll be inundated with questions about unemployment, terrorism, police, etc.: this is a site for professionals. I have no idea what an (un)employment security professional would be. As for terrorism and police professionals, I think their security questions could be on-topic, and I'll refer you again to Bruce Schneier tends to write about. As for personal defense, I consider it a tool that can be used for security, in the same vein as cryptography: its techniques are off-topic here, though its doctrine of use might be on-topic. (I do think this site is a lot closer to cryptography than to personal defense, because there is a lot more shared expertise).

Looking at this from the other side, we're already getting a small but steady flux of IT questions. But do you really believe that it's because of the “IT” in the name?

On the gripping hand, people who ask wildly off-topic questions by and large don't read. We could call the site whatever we like, it's not going to influence the non-readers. So let's not worry about them, eh?