Customer Reviews

Enemy at the Water Cooler: True Stories of Insider Threats and Enterprise Security Management Countermeasures

5 star:		(1)
4 star:		(5)
3 star:		(0)
2 star:		(1)
1 star:		(1)

 

 

Ignore the main title - look at the subtitle. This book is little more than a sales pitch for Enterprise Security Management systems, or more specifically the ESM sold by the author's company, with a random assortment of largely unattributed and barely analyzed anecdotes on information security incidents mostly relating to ESM. The link to "insider threats' is tenuous at best and in the most part is merely used as an excuse to hype the wonders of ESM.

If you are seriously interested in ESM, you probably wrote the gushing "review notes" on the cover or the foreword (written by Hugh Njemanze, CTO of - you guessed it - the same ESM company). I'm far from convinced that anyone else (except perhaps from the ESM company and its customers who may be happy with an extremely biased view of the value of ESM) would benefit from this book, even if it is "vendor neutral" (page xxii). If you are looking for some meaningful insight into and analysis of the "insider threat", and perhaps some practical and worthwhile countermeasures apart from ESM, look elsewhere.

'Enemy at the Water Cooler: Real-Life Stories of Insider Threats and Enterprise Security Management Countermeasures' by Brian Contos is an interesting look at some real-life situations that have occurred where nasties have gotten into systems and wrecked the havoc that they are looking to cause. While some reviewers have argued that this book is just a sales pitch to go out and buy anti-hacker software and hardware to combat these criminals, they are probably right!!! Security is always a matter of finding the right balance but certainly erring on the side of caution certainly is the safer way to go in most cases!!

Good book for IT people and specifically security whizzes to take a look at.

**** RECOMMENDED

Even though hacker Kevin Mitnick's notorious exploits are more than a decade old, the media, and even some security professionals, continue to be obsessed with him. In early October 2006 alone, his name came up a few dozen times in a search of the prior month of Google News. Those obsessed with hackers are missing the far greater threat: trusted insiders.

The insider threat shouldn't be a surprise: employee theft takes a bigger bite out of retailers than does shoplifting, and company personnel give away more secrets than are stolen by spies.

On average, authorized network users gain access to 10 to 20 times more resources than they need to perform their jobs, and this extra access leads to most network security breaches. With that as its starting point, Enemy at the Water Cooler looks at the problem of the trusted insider and how to reduce both the threat and the vulnerability. Author Brian Contos astutely notes that insider attacks are the hardest ones to defend against, detect, and manage.

The first part of the book sketches the risks that insiders pose to an organization. It also details mechanisms that can be used to control these risks.

One such solution is ESM (Enterprise Security Management) software. (Full disclosure: the author is the CSO for a leading ESM vendor and some of the illustrations in the book are screenshots from this vendor's product.) ESM software centrally collects and analyzes log data from various entities within a network. When correctly deployed, ESM can be used to discover internal risks, in addition to correlating security information and performing other valuable tasks.

The final chapters of the book run through real-life case studies in which Contos shows how ESM mitigated, or could have mitigated, the risk.

Although the book has a lot of information, at $49.95 for fewer than 250 pages, the book is overpriced. Even though it can come across as self-serving, the book should be commended for tackling a vital and often neglected topic.

This book was extremely easy to read and enjoyable. The case studies made complex concepts such as collaborative attacks and advanced intruder discovery/remediation techniques understandable. I've even shared the case studies with my management as examples of risk to help push our insider threat program forward. I found that sharing key case studies that are relevant to our business helped to make my point about why we need to pay more attention to threats from the inside. And the way the book is written, I don't need to translate tech talk to business talk.

In addition to the insider threat information, the initial chapter that gives an overview of computer-based threats from organized crime, nation-states and terrorist was an eyeopener. The author does an excellent job explaining how these groups use insiders (employees mostly) to help carryout their agendas.

Since reading the book I've also listened to several webcasts and podcasts from the author. I found these to be informative and in several instances, the case studies from the book are explored in even more detail as the author discusses subtitle points that aren't necessarily covered in the book.

I've read a few books on insider threat now, and this is by far one of my favorites, and more so, it has shown great utility at work. Engineers like it, and so does my senior management.

This book starts off nice and easy, giving a good introduction to cyber crime before getting into the more technical aspects of mitigating insider threats. I liked that very much, as opposed to the aggressive beginnings of most security books. I really enjoyed the real life scenarios that were described in this book. Sometimes the best way to learn is by looking at the mistakes of others. In the security world, it's often hard to predict what clever new method an attacker may use to get what he wants; by looking at examples of real world cases you can better equip yourself with the ability to prevent intrusions. Perhaps the part about this book that I liked the most was the writing style. It felt like a conversation. Very easy to read and follow.

I've ordered a couple of books on insider threat, and this is the first one I actually read. This book gives a good, broad overview of the types of threats facing companies. Easy to understand, yet the author seems to have deep experience in this space.

great problem statement and introduction to the overall issues and background surrounding insider threat. Insider threat is one of the hardest problems to understand and address in today's fast moving technology rich organizations. The author seems to have real world experience in dealing with these types of issues and I really enjoyed the insights especially in the use case examples. A nice read.

thanks

Since the author checked his facts out about as much as a third-grader, i thought this book was more sci-fi than fact-based. I've wasted my money and my time but i MIGHT be able to get 3 bucks for it in the used marketplace.