If you want to read a book that will have an influence on your information security career, or if you just want to read something that points out that we do need to do information security differently, then you need to go pick up a copy of "The new school of information security" by Adam Shostack and Andrew Stewart.
The book reads like this blog, everything from Noam Epple and the "Security Absurdity" with the response article Noam Eppel Follow up to Security Absurdity and Security Absurdity - Is information security "Broken". All the way through some of the latest hacks from Two weeks, two security breaches in web 2.0 applications to Tom's excellent article on Even Oracle is not without security problems. There are some short sharp jabs in the side for information security people and managers that think they are safe behind their firewalls.
If anything is going to serve as the cup of coffee after Noam Epple's wake up call, it has to be this book. Which means you have to go buy it to get where we are going as an industry.
The New School of Information Security asks a lot of questions, that as a security community we need to answer. Everything from the value of the CISSP (is it just showing you can take a test, or does it really imply that the person knows something?), in a debate here that even people in the industry who love what we do can not answer. The idea of the CISSP is good, but the book speaks heresy, reliance on the CISSP is dangerous, dangerous to a company, it narrows the confines of the box when information security people need to be everywhere helping out.
The book also talks about issues within the company as simple as the firewall, to how programmers got around firewall blocks by routing programs over port 80, to the untrusted and trusted insider, to the fundamental bedrock of how we make decisions, the flawed and often meaningless statistics that come from research labs.
The whole industry is broken, and while we bask in our unregulated age, HIPAA, SOX, and other rules like PCI are just the shot across the bow on regulation, and more will be coming.
Programmers do not get it, neither do security folks. From requesting a 6 million dollar solution for a 30 minute test, to saying "no" to watching businesses move their IT requirements to Amazon EC2 or AWS, to dumping the traditional attitude - we are a group of people in trouble, and we need to read this book.
We need to shake up our communities, and the way that we work, not smarter, not harder, but working within the confines of realistic information security for the company that we are in. Best practices are just that, generic, you must tailor them for the risks that you have in your industry. To rely on Best Practices, NIST 800, ITIL, and other standards is to court disaster because no one is taking the specifics or unique issues of your particular industry.
They also talk about security appliances, vendors, trusted sites that have the branding truste and hacker safe, with some interesting comments on how those systems and certifications provide a false sense of security not just to the people running the site, but to the customers who visit them as well.
Much to ponder, some of it has shown up with the writers here at ITtoolbox as well, which is very nice, we have been talking about these very same issues for the last 2 years if you read this site. The book is a nice digest of what has been here, and available to folks who visit here or read via syndication or RSS.
Otherwise, we really will not need a "security industry" per say, we will just get rolled up into something else, and loose our unique and distinct culture.