The Art of Deception: Controlling the Human Element of Security [Paperback]

Reading this book, you will quickly come to realize that Mitnick's toolbox is every bit as effective as the hacking and cracking technology ... and as you read further, it may dawn on you just how hard it is to counter the social engineering attack. After all, much as you might like to, you can't simply plug in a new program to security-patch your employees!

Mitnick's suggested countermeasures in section 4 of the book are fairly straightforward (a wide-ranging security awareness program and a decent set of policies) but implementing them effectively and persuading employees to pay attention requires those very social engineering skills described in sections 1-3.

I'm left with the distinct impression that Mitnick is teasing us by describing a few simple deceptions whilst keeping the best to himself. But think for a moment about the success of the "419" advance fee scams. Otherwise sane, intelligent individuals are evidently being drawn into parting with their hard-earned cash on the basis of these crude deceptions. The implications are truly frightening.

My bottom line: take this book on holiday with you. Once you start, you will not want to put it down and you can reflect on it at the bar. Free drinks anyone?

The book is very easy to read, it isn't full of computer jargon, which I personally thought it would be. The stories are told from the point of view of the hacker, an introduction describing each situation is given first, phone conversations are written down, the con is analyzed, and then Mitnick tells us how to avoid situations like that happening by 'preventing the con'.

It is very easy to see when reading this book how the people (note, not the technology) get tricked or persuaded into giving away such vital information, the key is social engineering. These people believe that the hacker is someone within the organisation who should have access to this information anyway so no harm will come from giving it away, but how can they tell simply from one phone call?

All in all, this book is an education in information security, it tells us that having firewalls, anti-virus software and other security equipment installed will help to protect your information system, but this alone will not be enough, the updates are a very important element in securing your information, and without these, your system will be even more vulnerable from attack by outsiders. Employees, without being educated in information security, can let you down, simply by being too trusting and not knowing who they are giving the information away to!

Like other reviewers I didn’t enjoy Mitnick's self-congratulatory / self-apologetic tone.

What it did remind me of is the lack of security at my own company :

* our employee car park beneath the building is permanently unmanned, so multiple passengers could enter the building piggybacking – and they have direct access to the office space behind the 'firewall' of the reception desk.

* in common with many companies we know have outsourced lots of things, including our Systems Security. So who's protecting who? I get lots of requests to send e-mails of commercially sensitive material outside our network to developers in India; but I refuse. Of course their own staff based onshore could be forwarding it on, and we wouldn't know.

I recommend everyone reads this book to see if they can improve upon their own security.

This statement is not meant to be critical of either the book or of IT\business managers. It is a potential strength of this book. It should have a wide appeal as it is not filled with too much technical detail, and as such could potentially be the catalyst for gaining\increasing management "buy-in" to raising security awareness in an interesting way.

Mitnik's book outlines the key concepts of the most common forms of social engineering attacks and makes the point (several times in fact) that the weakest security link is people and process and not technology. A common theme communicated by many IT security writers and professionals alike.

This is the strength of the book, not as a technical resource or a detailed review of historic attacks and countermeasures, but as an easy to read eye-opener. It is fun to read and leaves the reader with a slightly uncomfortable view of the world, but it does make you think the next time someone asks you one of those seemingly innocent questions.

The most valuable sections are the closing chapters, these contain some good guidelines and ideas for policies, training and awareness raising.

Definitely worth a read, I enjoyed it.