Making InfoSec Better Through Library Science

The talk opens with a short audience exercise about good and bad memories of libraries, then contrasts libraries' generally positive reputation with the often poor reception security teams receive. A brief history of library science follows, from early guidance on building libraries through the founding of the Library of Congress, along with a reminder that classification systems can carry bias and need ongoing correction.

The middle section makes the case for a shared security vocabulary. The speaker argues the industry needs a diverse, authoritative body to settle terms, since jargon and competing labels for the same threat confuse users, journalists and executives alike. The speaker then adapts the five laws of library science into a draft set of principles for information security: security should be accessible to everyone, teams should curate what is in their environment, education should reach every person, guidance should be kept current, and it should be tailored to different audiences.

Toward the end, the talk introduces the reference interview, a multi-step library practice for finding out what a patron actually needs. Examples include a user who reported a routine newsletter every day because of a misunderstanding, and an employee whose account was compromised after a phishing attempt. The takeaways are to make the security team approachable, listen for what users leave unsaid, ask specific follow-up questions, document outcomes, and verify that fixes keep working. Security is presented as a human problem that needs to evolve with the organization.