Reddit reviews Beyond Fear: Thinking Sensibly About Security in an Uncertain World.

>Paranoia and worrying about pretty much everything is just my nature. My girlfriend laughs (nicely) about how much I worry about everything.

Just remember, there is a difference between paranoia and taking calculated risks/risk management. On that note, I suggest you read both Secrets and Lies as well as Beyond Fear. These two books will get you into the right mindset.

> I appreciate that this isn't about defining an iron-clad policy and walking away from it, and that it's instead about taking reasonable steps to make sure we're not opening ourselves up.

And remember that a policy means nothing without enforcement.

> I've already thrown together a wiki to manage the ever growing list of infosec "to do" items

Great idea. This will also help you if you ever need to justify your position to management. Often times it's difficult to "prove" that you've done anything to secure the enterprise. Make sure to identify your successes and note them at meetings, promotion time, etc.

First of I want to recommend Bruce Schneiers Beyond Fear, he deals with the problem of making decisions influenced by fear among other things and will probably shed some light on this issue.

The 77 (72?) virgins are a response to another fear, the fear of death. By first using the fear of outside influence as a call to action and a way to radicalise the relief from fear of death can prompt the deed to be executed. Just stating "you'll have 77 virgins" is useless unless they see a problem and the problem must then be blown out of proportion to cause a radical enough backlash, this is where fear comes into play.

To summarize: first you instil fear, build on that fear until the person becoming brainwashed is ready to be sent out and then absolve their fear of death. Then you pat yourself on the back, you've created a terrorist without fear of death who's ruled by fear.

You're asking the wrong question. You assume that the TSA is charged with keeping our skies safe. In fact, the TSA is not the organization charged with keeping us safe. The TSA exists to provide the illusion of safety, and so a simple change in procedures will always be inadequate. As has been stated many times before, by the time a terrorist gets to the airport, it's TOO LATE. Just because the security procedures at the airport are visible doesn't mean they are the most effective or the most valuable tactics. Start thinking about aviation security as a whole, not just as something that happens moments before you board a plane.

As a frequent flier (100K+ miles/year), below is my 5-point approach to revising aviation security, most of which are larger than the TSA itself:

1. Admitting that we will never be perfect at security. Accept the fact that travelling is dangerous for a variety of reasons, and the odds of dying in a terrorist attack are infinitesimally small. You are more likely to die in a car accident on the way to the airport than you are on the plane. If we can't keep guns and knives out of prisons, what makes us think we'll be able to keep them off planes?
   
   
2. Spending our security dollars appropriately. This means where they will have the most impact, and that's certainly NOT at the airport. Invest in terrorism intelligence and stop the problem at the source, not minutes before the plan culminates.
   
   
3. Focusing on bad PEOPLE, not bad THINGS. Any bad person can make a weapon out of virtually anything normally available on an airplane. Any good person with a hunting knife or a gun presents no real risk to a plane. This doesn't necessarily mean profiling, but it does mean more intelligence gathering and less reactionary procedures.
   
   
4. De-federalizing airport security. It's an expensive waste of taxpayer and security fee dollars. Return control of airport security to the airports and airlines, who are motivated to do a good job. Do away with expensive national contracts (body scanners) and inane policies (shoes, liquids) and let local authorities adjust screening to reflect real local threats.
   
   
5. Balancing the benefits of increased security with the costs of enforcing that security. Security is a trade-off, not a goal. We give up time, money, convenience, and liberty in order to increase security. As we give up each of those things, we should carefully question whether the benefits received outweigh the costs imposed.
   
   Bruce Schneier perhaps the foremost expert in this area (he's the Chuck Norris of security) and has written volumes on the subject. I highly recommend reading some of his writings:
   
   http://www.schneier.com/essay-124.html
   
   http://www.amazon.com/Beyond-Fear-Thinking-Sensibly-Uncertain/dp/0387026207

Learn the difference between a risk and a threat, and read about deterrence theory. You're more likely to die in a car accident or by slipping in the bathtub then by a nuke or terrorism, and the likelihood of a non-state actor getting their hands on a nuke is basically zero. Also yeah, how do you go outside? I mean most people I know refer to microwaving as 'nuking' their food.

Edit: You should really read this book: Beyond Fear: Thinking Sensibly About Security in an Uncertain World. https://www.amazon.com/dp/0387026207/ref=cm_sw_r_cp_apa_i_4NetDbNR8X7PD