29 of 32 people found the following review helpful
on January 17, 2011
This book is one of the best books I read in regards to (IT) security. I do absolutely recommend this book to any pentester, security officer or person interested in this very interesting aspect of security. Performing penetration tests and security audits myself I try to especially implement SE in tests and audits since it is the best way to find issues and the human factor is neglected in most of the tests and reviews.
There was no book like this book before dealing with Social Engineering. At best SE has been mentioned in a book about security and only a couple pages were dedicated to it. But nowadays SE is becoming more and more important to keep in mind. The times when attackers and pentesters could exploit weaknesses in applications and services without the need of user interaction are mostly over. Usually the user has to open a malicious file for example a PDF file. This book explains how this can be achieved and also what to keep in mind when preparing an awareness training.
Reading this book will teach you how SE attacks are being performed, the background and underlying principles of them as well how to detect and mitigate them.
Chris explains everything in a very good and understandable way giving a lot of examples and infos on where to start with further research on the explained techniques (e.g. NLP, microexpressions...).
It is definately a must have.
66 of 79 people found the following review helpful
on March 9, 2011
One can sum up all of Social Engineering: The Art of Human Hacking in two sentences from page 297, where author Christopher Hadnagy writes "tools are an important aspect of social engineering, but they do not make the social engineer. A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable". Far too many people think that information security and data protection is simply about running tools, without understanding how to use them. In this tremendous book, Hadnagy shows how crucial the human element is within information security.
With that, Social Engineering: The Art of Human Hacking is a fascinating and engrossing book on an important topic. The author takes the reader on a vast journey of the many aspects of social engineering. Since social engineering is such a people oriented topic, a large part of the book is dedicated to sociological and psychological topics. This is an important area, as far too many technology books focus on the hardware and software elements, completely ignoring the people element. The social engineer can then use that gap to their advantage.
By the time that you start chapter 2 on page 23, it is abundantly clear that the author knows what he is talking about. This is in stark contrast with How To Become The Worlds No. 1 Hacker, where that author uses plagiarism to try to weave a tale of being the world's greatest security expert. Here, Hadnagy uses his real knowledge and experience to take the reader on a long and engaging ride on the subject. Coming in at 9 chapters and 360 pages, the author brings an encyclopedic knowledge and dishes it out in every chapter.
Two of the most popular books to date on social engineering to date have been Kevin Mitnick's The Art of Deception: Controlling the Human Element of Security and The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers. The difference between those books and Hadnagy, is that Mitnick for the most part details the events and stories around the attacks; while Hadnagy details the myriad specifics on how to carry out the social engineering attack.
The book digs deep and details how the social engineer needs to use a formal context for the attack, and breaks down the specific details and line-items on how to execute on that. That approach is much more suited to performing social engineering, than simply reading about social engineering.
Chapter 1 goes though the necessary introduction to the topic, with chapter 2 detailing the various aspects of information gathering. Once I started reading, it was hard to put the book down.
Social engineering is often misportrayed as the art of asking a question or two and then gaining root access. In chapter 3 on elicitation, the author details the reality of the requirements on how to carefully and cautiously elicit information from the target. Elicitation is not something for the social engineer alone, even the US Department of Homeland Security has a pamphlet that is uses to assist agents with elicitation.
After elicitation, chapter 4 details the art of pretexting, which is when an attacker creates an invented scenario to use to extract information from the victim.
Chapter 5 on mind tricks starts getting into the psychological element of social engineering. The author details topics such as micro expressions, modes of thinking, interrogation, neuro-linguistic programming and more.
Chapter 6 is on influence and the power of persuasion. The author notes that people are trained from a young age in nearly every culture to listen to and respect authority. When the social engineer takes on that role, it becomes a most powerful tool; far more powerful than any script or piece of software.
The author wisely waits until chapter 7 to discuss software tools used during a social engineering engagement. One of the author's favorite and most powerful tools is Maltego, which is an open source intelligence and forensics application. While the author concludes that it is the human element that is the most powerful, and that a great tool in the hand of a novice is worthless; the other side is that good tools (of which the author lists many), in the hands of an experienced social engineer, is an extremely powerful and often overwhelming combination.
Every chapter in the book is superb, but chapter 9 - Prevention and Mitigation stands out. After spending 338 pages about how to use social engineering; chapter 9 details the steps a firm must put in place to ensure they do not become a victim of a social engineering attack. The chapter lists the following six steps that must be executed upon:
* Learning to identify social engineering attacks
* Creating a personal security awareness program
* Creating awareness of the value of the information that is being sought by social engineers
* Keeping software updated
* Developing scripts
* Learning from social engineering audits
The author astutely notes that security awareness is not about 45- or 90-minute programs that only occur annually; rather it is about creating a culture and set of information security standards that each person in the organization is committed to using their entire life. This is definitely not a small undertaking. Firms must create awareness and security engineering programs to deal with the above six items. If they do not, they are them placing themselves at significant risk of being unable to effectively deal with social network attacks.
As to awareness, if nothing else, Social Engineering: The Art of Human Hacking demonstrates the importance of ensuring that social engineering is an integral part of an information security awareness program. This can't be underemphasized as even the definitive book on security awareness Managing an Information Security and Privacy Awareness and Training Program only has about 10 pages on social engineering attacks.
There are plenty of security books on hardware, software, certification and more. Those were perhaps the easy ones to write. Until now, very few have dealt with the human element, and the costs associated with ignoring that have been devastating. Social Engineering: The Art of Human Hacking is a book that is a long time in coming, but worth every page.
While seemingly geared to the information security staff, this is a book should be read by everyone, whether they are in technology or not. Social engineering is not something that just occurs behind a keyboard. Social attackers know that. It is about time everyone else did also.
130 of 162 people found the following review helpful
on May 1, 2011
This book really isn't about computer safety, or about personal safety - it's just kind of all over. By page 40 I was skimming paragraphs, but page 100 I was skipping entire pages. This book is not written for people in the security field, nor is it really written for people who want to know more about their personal security. I think that if you know enough already to be aware of what social engineering is in the first place and have a decent understanding of personal computing safety - you already know what this book can give you. I would classify this book as a collegiate "survey 101" level textbook on communications - the book focuses on very general processes and only the last 60 pages discuss actual examples.
While deciding whether to buy this book or not, I joked with a friend that the fact that the first 28 people who reviewed it gave it 5 stars, was ITSELF an act of social engineering. I am not so sure that is a joke anymore. I've been buying books on Amazon for 12 some years now, and I don't think I've seen a book get that many fanatically raving reviews right off the bat. Looking back again at all those reviews, I guess perhaps if you know absolutely nothing at all about email scams and personal security, and happen to also be a CEO, then this book would be worth reading.
The foreword and first 10 pages talk about what will be in the book. This is a common format, but that's an awful lot of pages wasted on material that is literally repeated again later in the book. And then up front we see material on The Nigerian Scam. If you are a security professional or a CEO, or anyone really - and have fallen prey to this or don't know what it is, seriously, you've got bigger problems to deal with.
Perhaps that example is the crux of the matter - who exactly is the audience meant to be? The author really uses just one example, over and over, of him stalking a CEO at a bar. He learns a few things about the CEOs current life, including that he will be on vacation next week. The thief goes to the CEOs office when he knows he's gone, pretends he mixed up the date for an interview but wants to leave his resume for when the CEO returns. He hands the secretary a zip drive which has his document, which then also downloads malware onto the company's servers. Okay. While this is a valuable lesson on zip drives, do we need 50 pages of text to prove the point? And rather than focus on the inherent dangers of executable files (from media or emails/websites), the moral of this story focused on not ever talking to anyone in a bar. The author also spends most of the book on how to use SE (or basic thievery) against someone without any real solutions to the problems. For example, Chapter 7 talks about how to pick different kinds of locks - which has nothing to do with social engineering and I am not sure how someone uses that knowledge to protect them. Or how Doritos and FedEx hid symbols in their logos - this is SE sure, but what exactly will I do with this information?
Pages 55 to 100 are all about communicating. Unless you never learned in high school or freshman college that every message needs a sender and a receiver - you can skip this part of the book. If you want an exorbitant amount of detail on how people can intentionally act angry or surprised or sad, or can emphasize certain words all to elicit different responses from people - you can skip to page 181. Again, who is the audience here? Some parts of this chapter talk about how Homeland Security agents are trained to use these "tricks" to interrogate people. How many normal people are faced with dumpster diving, stalking, psychologically trained thieves trying to steal information from your company? And if you ARE faced with these problems -your needs are way beyond the scope of this book.
There are some good parts, like the section on microexpressions. The information on how people create their passwords was okay, though you can get those statistics almost anywhere. The search engine tools were interesting, though again that stuff is not social engineering and most computer savvy people likely know this material. The book was well edited, grammar and formatting, which is why I gave it the 2 stars.
Overall the three things I took from this book are: 1) shred your trash so dumpster divers can't find sensitive information; 2) don't use company email for non-business matters because SE's can use that information to create enticing emails with malware hidden in them; and 3) every time you put information onto anything - Facebook, hobby sites, fan clubs, even Amazon - there are many software packages out there that SE's can use to collect all that information and make profiles to use against you.
27 of 33 people found the following review helpful
on January 10, 2011
Finally, we have a book on hacking humans that contains details of psychology and human factors related to security. There is no other book like it. For that reason, it's a must read for all security professionals.
Humans are and always will be the weakest security link. PERIOD. Up to now, there hasn't been a comprehensive book on (1) how to orchestrate a Social Engineering campaign; (2) how to prevent a Social Engineer from breaching your defenses; and (3) psychological principals of how humans think and operate. This book has all three. It includes the details necessary to fully understand critical concepts for Social Engineering such as pretexting, elicitation, and influence, which provides a great framework on how to manipulate humans to take the actions you want. I've found that many computer security professionals aren't fluent in human factors. By reading this book, they will glean that knowledge.
BUT WAIT, THERE'S MORE, Chris also includes case studies to see the principles in action. These studies from Chris' experience as a professional Social Engineer round out this outstanding book.
Security professionals: If you read only one book in 2011, make it Social Engineering: The Art of Human Hacking by Chris Hadnagy.
5 of 5 people found the following review helpful
on April 17, 2013
I thought this book was a real find. No where else have I ever found the real truth about how well practiced sales people, con men, intelligence people, and law enforcement can learn to practice the art of covert human manipulation to a high art. What makes this book so valuable to me, is that I now understand the tricks and tactics so that I can detect what is going on, but that also know how block this activity and not all it to happen in my life
5 of 5 people found the following review helpful
on October 6, 2012
I suggest any professional read this work to get up to speed on the latest threats to their business. I also suggest this work to anyone who just wants to live a safer life by knowing what to look for in order to avoid being "socially engineered".
You may like this work if you enjoy: Sociology, Psychology, Philosophy, Sensation and Perception studies, street magic (entertainment)
4 of 4 people found the following review helpful
on June 4, 2011
I am a professional of 27 years working in the IT department for a big chip manufacturer, but I am not currently engaged in information security work. In terms of professional infosec skill I am a novice trying to broadly educate myself through reading and understanding the elements of the infosec landscape.
The best part of this book are the examples with real stories of social engineering activities. The author's mini-stories interspersed throughout the chapters really help illustrate the points he is conveying. Even more compelling are the more detailed case studies that have been related to the author from notable social engineers (e.g. Mitnick) and the author's own hands-on case studies. More than anything I think real-world stories are the best way to educate and inform interested people of what social engineering is about. I believe - just like the human targets in the examples - readers consuming the case studies in the book and internalizing the relative ease with which the social engineer successfully hacked the human target(s) would become believers in the power of social engineering and the relatively high vulnerability we all have at the hands of an experienced social engineer.
I like the emphasis first described in Chapter 2 on the importance of information gathering (and re-emphasized over and over and over). While pointing out the importance of being able to adapt quickly to changing conditions and thinking fast on one's feet is important, the author clearly communicates that these abilities are in no way a substitute for patient and thorough information reconnaissance before attempting anything.
The meat of the book was in the chapters on elicitation, pretexting, and the many psychological principles and the author does a good job explaining what each skill was about. The casual references to how some of us unconsciously use these skills on family, friends, children is a nice way of relating some fairly technical concepts in a way that people can clearly understand.
Overall the book struck me as being very polished and professional, but easy to consume. The author's discourse on some of the "darker" aspects of manipulation is well-nuanced. People might argue that it is unethical to teach social engineer skills and point out that there was only one chapter at the end about prevention and mitigation of social engineering attacks. Anyone taking this position is missing the point: the book describes how social engineers plan and execute social engineering operations. Understanding that knowledge is the key to mitigating attacks.
Even being a newcomer to the infosec landscape it seems to me like "human hacking" is really the next frontier or vector that is about to explode in terms of importance and media coverage. Not that social engineering as a discipline is brand new. Rather it is the attack vector for which the vulnerabilities are the greatest (if only because the defenses are not as well understood as other technical infosec practices).
6 of 7 people found the following review helpful
on February 7, 2011
First off, full disclosure: Chris, the author, is a good friend of mine, I was the technical editor for the book, and I help run social-engineer.org. So it can be argued that I have a strong bias. Because of this, I was not going to write a book review for this title. However, I changed my mind based on the response I that I saw from others consuming the title.
I, as well as most of my friends, come from the information security space. Within the insular information security community, perspectives don't always match the real world. People get worked up over minutia that in the real world has very little impact. Because of that, the credibility of much information security advice is often taken with a grain of salt by the general public.
This is something that we were well aware of when starting social-engineer.org, and a trap that we have tried to avoid falling into. This philosophy of real world, practical, explanations of social engineering risks and the proper defense against them has followed through to the Social Engineering book. This makes a big difference in the actual suitability of this title in having more then a passing impact on most people's lives.
This is exemplified by the wide range of people that I have seen read, understand, and enjoy this title. From my son, still at an age where he finds girls "icky", who after reading the book gives me suggestions on how better to correct him (Dad, you have to complement me, then give me suggestions in what to improve, then complement something else so that way I feel positive about the exchange) to my Grandmother who while she won't read the book cover to cover flips through it and chuckles at the examples that directly relate to her life. From the marketing major who finds examples of subtle ways of influencing others into having a positive view on their products to the small business owner that wants to protect her business against threats and finds steps that can be put in place today to better protect her business.
This is not just a book for those of us in the information security space, this is a book for everyone that interacts with modern society.
I am glad to see this book find an audience beyond the information security space, as that is where it can have the most benefit. My suggestion is, after reading this book don't just put it on the shelf with your titles on python programming and firewall configurations. Pass it on to your husband or wife, son or daughter, parent or grandparent, friend or co-worker. Give it to someone that would not normally read a book about how to configure their desktop file permissions to best mitigate the chances of a malware attack.
This is the security book for the general public. That is where it will have the most impact.
6 of 7 people found the following review helpful
on January 8, 2011
Social Engineering: The Art of Human Hacking is a wonderful read for anyone that is involved with Information Security. Often, technical books ignore the human side of information security, yet with every click of a phishing message, data disclosure from a dumpster dive, or simply the inference that can be gleaned from a nearby bar, coffee shop, or smoking area, we should be reminded of how fragile our countermeasures are when they involve the human element. For many publications, the concepts introduced through a skilled social engineer seem completely abstract and lack the punch to make an appropriate call to action. However, Social Engineering: The Art of Human Hacking provides a wealth of solid examples and experiences, with actionable material throughout. I found myself toggling between the material in the book and the links and resources that are provided throughout the text. This approach allows for a smooth advancement and transition through the Social Engineering framework, and also provides discoverable material to assist in raising awareness to colleagues and executives alike.
As a PhD learner in Organizational Management, I have had a fascination with the psychological aspects of Information Security, with a strong emphasis on preventing widespread breaches via the human element of technology. To date, I have not found a publication that comes close to this one in its field, and as such, I have a feeling that this publication is almost seminal in nature. Surprisingly, given the complexity of the subject material, the authors present the subject matter in plain English.
Finally, as the authors correctly explain, social engineering and the material within this publication is not simply for information security practitioners. However, applying personal experiences to the information lead me to applying the concepts within an information security construct. I purchased the Kindle version of the book, and have had no issues whatsoever in the material, diagrams, or screenshots. Have I convinced you to consider the purchase?
4 of 4 people found the following review helpful
on November 8, 2013
the author gives a clear explanation on how to be a social engineer, he teaches both side on understanding how people manipulate while how to influence for the greater good.