What is THE book on cybersecurity?
February 16, 2015 9:48 AM Subscribe
Recommend a non-fiction book on cyber security and cyber crime?
Prompted by this on the blue - http://www.metafilter.com/147048/Its-like-a-bad-movie-plot-only-IRL
I vaguely understand, on a lay level, that most of the internet is held together with wire and glue and that most information online is guarded with pretty weak methods, and that even industries with sophisticated, secured networks like banking/financial services aren't safe. I'd like to read a non-fiction book that goes into much more detail on why modern cyber security is so bad and/or how various sophisticated cyber crimes are carried out. It could be specific to government network security (maybe a book centered around Stuxnet and similar cyber espionage?) or the financial industry, or something else. It should have more than a NYT level of technical detail but aimed at an educated tech savvy reader who is not a security engineer, and a more compelling read than a textbook. Recommendations?
Prompted by this on the blue - http://www.metafilter.com/147048/Its-like-a-bad-movie-plot-only-IRL
I vaguely understand, on a lay level, that most of the internet is held together with wire and glue and that most information online is guarded with pretty weak methods, and that even industries with sophisticated, secured networks like banking/financial services aren't safe. I'd like to read a non-fiction book that goes into much more detail on why modern cyber security is so bad and/or how various sophisticated cyber crimes are carried out. It could be specific to government network security (maybe a book centered around Stuxnet and similar cyber espionage?) or the financial industry, or something else. It should have more than a NYT level of technical detail but aimed at an educated tech savvy reader who is not a security engineer, and a more compelling read than a textbook. Recommendations?
Bruce Schneier's books are fascinating and aim to educate a technically savvy reader without overwhelming him/her (obviously, skip the cryptography books aimed at actual security engineers). His essays will give you a taste of what his writing is like.
I don't know if any one of his books is THE book on cyber security but he is THE guy on cyber security. In particular, he is the rare "moderate" of the security world.
posted by rada at 10:25 AM on February 16, 2015 [1 favorite]
I don't know if any one of his books is THE book on cyber security but he is THE guy on cyber security. In particular, he is the rare "moderate" of the security world.
posted by rada at 10:25 AM on February 16, 2015 [1 favorite]
Spam Nation by Brian Krebs.
posted by Seeking Direction at 10:48 AM on February 16, 2015 [2 favorites]
posted by Seeking Direction at 10:48 AM on February 16, 2015 [2 favorites]
I don't know of a book that fits what you are looking for, but there are a variety of good forensic reports, written in not *too* technical language, that can give you a feel for how these sophisticated cyber attacks happen. I would start by reading the 2014 Verizon Data Breach Investigations Report. Verizon collaborates with about 50 other companies to produce this report. The 2014 edition, covering attacks that happened in 2013, analyzes about 1,400 data breaches across 95 countries and identifies nine common attack patterns. That will equip you to then dive in to some other forensics; the report contains a lot of end notes referring to other sources. To round out your reading, I would point you at:
Mandiant's report: APT1: Exposing One of China’s Cyber Espionage Units
Mandiant's 2013 threat report: M-Trends 2013: Attack the Security Gap
Ralph Langer's report on Stuxnet, To Kill A Centrifuge
The U.S. Senate's Kill Chain Analysis of the 2013 Target Data Breach
The main themes you are going to see here are (a) nation states entering the arena; (b) the attacks happening over long time periods - months or even years; (c) attackers treating it like it is a job (because it is); (d) long chains of exploited vulnerabilities, the attackers can start out with something innocuous like an email with a malware link to get one employee's credentials and ladder up from there, one vulnerability at a time.
It is very difficult to defend against a really determined attacker. A saying you'll hear is, "we have to be right 100% of the time, the bad guys only have to be right once."
posted by kovacs at 10:58 AM on February 16, 2015 [3 favorites]
Mandiant's report: APT1: Exposing One of China’s Cyber Espionage Units
Mandiant's 2013 threat report: M-Trends 2013: Attack the Security Gap
Ralph Langer's report on Stuxnet, To Kill A Centrifuge
The U.S. Senate's Kill Chain Analysis of the 2013 Target Data Breach
The main themes you are going to see here are (a) nation states entering the arena; (b) the attacks happening over long time periods - months or even years; (c) attackers treating it like it is a job (because it is); (d) long chains of exploited vulnerabilities, the attackers can start out with something innocuous like an email with a malware link to get one employee's credentials and ladder up from there, one vulnerability at a time.
It is very difficult to defend against a really determined attacker. A saying you'll hear is, "we have to be right 100% of the time, the bad guys only have to be right once."
posted by kovacs at 10:58 AM on February 16, 2015 [3 favorites]
Ross Anderson's Security Engineering is a bit out of date now, but it covers a lot of ground, and has a lot of practical examples of security failures from banking and other sectors. It's also very readable, while still being a technical book. The second edition can be downloaded for free from Prof Anderson's site.
posted by crocomancer at 11:16 AM on February 16, 2015
posted by crocomancer at 11:16 AM on February 16, 2015
It's pretty dated now, but if you can find a copy, "Out of the Inner Circle" is pretty interesting.
posted by Chocolate Pickle at 11:36 AM on February 16, 2015
posted by Chocolate Pickle at 11:36 AM on February 16, 2015
It should have more than a NYT level of technical detail but aimed at an educated tech savvy reader who is not a security engineer, and a more compelling read than a textbook.
Kingpin is exactly this. Mostly about a carding ring (credit card fraud). Focuses more on the story and the people, less on tech details. But it tells you how the groups operate, source their equipment, etc. It's a really fun read, too.
posted by ryanrs at 11:41 AM on February 16, 2015 [2 favorites]
Kingpin is exactly this. Mostly about a carding ring (credit card fraud). Focuses more on the story and the people, less on tech details. But it tells you how the groups operate, source their equipment, etc. It's a really fun read, too.
posted by ryanrs at 11:41 AM on February 16, 2015 [2 favorites]
This white paper from Lockhead does a pretty good job of laying the land. Can't say if it's more compelling than a textbook, but even if you only make it a couple of pages, you'll know a lot more about cyber security than most professionals.
posted by General Malaise at 1:43 PM on February 16, 2015
posted by General Malaise at 1:43 PM on February 16, 2015
This recent article on "Equation Group" was a good read as well.
posted by Admira at 10:34 PM on February 16, 2015
posted by Admira at 10:34 PM on February 16, 2015
This thread is closed to new comments.
In googling for things I vaguely remember, I ran across great goodreads list.
posted by bensherman at 10:05 AM on February 16, 2015