The Science of Security

The security profession has produced thousands of books on tools, threats, and compliance frameworks. Almost none on how to think clearly about the problem.

Scientia Securitatis - Latin for "the science of security" - develops the analytical apparatus the field actually needs. Drawing on criminology, cognitive psychology, military theory, and twenty-five years of practitioner experience across physical, cyber, personnel, and operational domains, Chris Mark treats security as a unified discipline whose underlying problems are the same regardless of domain.

This is not another cybersecurity book. Whether the threat is pirates trying to hijack a ship, gunfire against an electrical substation in North Carolina, a deepfake CEO impersonation that moves $25 million across borders, the Volt Typhoon and Salt Typhoon campaigns against U.S. critical infrastructure, or an Equifax-style breach blamed on its victim, the analytical questions are constant: Who chose to attack? Why did the defense fail? What would actually have worked?

What the book develops:

• The Mark Heptad - a taxonomy of seven adversary motivations (financial, espionage, war/defense, facilitation, hacktivism, revenge, nuisance) that maps directly to deterrence strategy
• The IMCM Framework - Ignorance, Mistake, Complacency, Malice - for classifying human-induced vulnerabilities and matching them to specific interventions
• The DIVE Framework - Direction, Intensity, Vulnerability, Exposure - for operational security assessment
• The Multiplicative Security Model - the mathematical basis for why defense-in-depth actually works, and how to calculate it
• Rigorous treatments of the Swiss Cheese Model, Routine Activity Theory, Situational Crime Prevention, and the Twenty-Five Techniques
• A criminological critique of victim blaming in post-incident analysis, drawn from Wolfgang, Timmer and Norman, and case studies of the Equifax, OPM, Target, and Snowflake breaches

Who this book is for:

Security executives building defensible programs across multiple domains. Policy professionals confronting unrestricted warfare doctrine and contemporary asymmetric threats. Risk and compliance leaders who suspect compliance frameworks aren't stopping sophisticated adversaries - and want to understand why. Graduate students approaching security as an analytical discipline rather than a job category. Practitioners with the instincts to ask better questions.