The Art of Deception and over one million other books are available for Amazon Kindle. Learn more

Buy New

or
Sign in to turn on 1-Click ordering.
or
Amazon Prime Free Trial required. Sign up when you check out. Learn More
Buy Used
Used - Good See details
$4.15 & eligible for FREE Super Saver Shipping on orders over $25. Details

or
Sign in to turn on 1-Click ordering.
 
   
More Buying Choices
Have one to sell? Sell yours here
The Art of Deception: Controlling the Human Element of Security
 
 
Start reading The Art of Deception on your Kindle in under a minute.

Don't have a Kindle? Get your Kindle here, or download a FREE Kindle Reading App.

The Art of Deception: Controlling the Human Element of Security [Hardcover]

Kevin D. Mitnick (Author), William L. Simon (Author), Steve Wozniak (Foreword)
4.2 out of 5 stars  See all reviews (144 customer reviews)

List Price: $39.95
Price: $22.23 & eligible for FREE Super Saver Shipping on orders over $25. Details
You Save: $17.72 (44%)
  Special Offers Available
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o
In Stock.
Ships from and sold by Amazon.com. Gift-wrap available.
Only 2 left in stock--order soon (more on the way).
Want it delivered Tuesday, June 5? Choose One-Day Shipping at checkout. Details
Textbook Student FREE Two-Day Shipping for students on millions of items. Learn more

Formats

Amazon Price New from Used from
Kindle Edition $8.09  
Hardcover $22.23  
Paperback $11.32  
Audible Audio Edition, Unabridged $21.95 or Free with Audible 30-day free trial

Book Description

October 4, 2002
The world's most infamous hacker offers an insider's view of the low-tech threats to high-tech security
Kevin Mitnick's exploits as a cyber-desperado and fugitive form one of the most exhaustive FBI manhunts in history and have spawned dozens of articles, books, films, and documentaries. Since his release from federal prison, in 1998, Mitnick has turned his life around and established himself as one of the most sought-after computer security experts worldwide. Now, in The Art of Deception, the world's most notorious hacker gives new meaning to the old adage, "It takes a thief to catch a thief."
Focusing on the human factors involved with information security, Mitnick explains why all the firewalls and encryption protocols in the world will never be enough to stop a savvy grifter intent on rifling a corporate database or an irate employee determined to crash a system. With the help of many fascinating true stories of successful attacks on business and government, he illustrates just how susceptible even the most locked-down information systems are to a slick con artist impersonating an IRS agent. Narrating from the points of view of both the attacker and the victims, he explains why each attack was so successful and how it could have been prevented in an engaging and highly readable style reminiscent of a true-crime novel. And, perhaps most importantly, Mitnick offers advice for preventing these types of social engineering hacks through security protocols, training programs, and manuals that address the human element of security.

Special Offers and Product Promotions

  • Buy $50 in qualifying physical textbooks, get $2 in Amazon MP3 Credit. Here's how (restrictions apply)

Frequently Bought Together

The Art of Deception: Controlling the Human Element of Security + The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers + Ghost in the Wires: My Adventures as the World's Most Wanted Hacker
Price For All Three: $63.53

Show availability and shipping details

Buy the selected items together


Editorial Reviews

Amazon.com Review

The Art of Deception is about gaining someone's trust by lying to them and then abusing that trust for fun and profit. Hackers use the euphemism "social engineering" and hacker-guru Kevin Mitnick examines many example scenarios.

After Mitnick's first dozen examples anyone responsible for organizational security is going to lose the will to live. It's been said before, but people and security are antithetical. Organizations exist to provide a good or service and want helpful, friendly employees to promote the good or service. People are social animals who want to be liked. Controlling the human aspects of security means denying someone something. This circle can't be squared.

Considering Mitnick's reputation as a hacker guru, it's ironic that the last point of attack for hackers using social engineering are computers. Most of the scenarios in The Art of Deception work just as well against computer-free organizations and were probably known to the Phoenicians; technology simply makes it all easier. Phones are faster than letters, after all, and having large organizations means dealing with lots of strangers.

Much of Mitnick's security advice sounds practical until you think about implementation, when you realize that more effective security means reducing organizational efficiency--an impossible trade in competitive business. And anyway, who wants to work in an organization where the rule is "Trust no one"? Mitnick shows how easily security is breached by trust, but without trust people can't live and work together. In the real world, effective organizations have to acknowledge that total security is a chimera--and carry more insurance. --Steve Patient, amazon.co.uk

From Publishers Weekly

Mitnick is the most famous computer hacker in the world. Since his first arrest in 1981, at age 17, he has spent nearly half his adult life either in prison or as a fugitive. He has been the subject of three books and his alleged 1982 hack into NORAD inspired the movie War Games. Since his plea-bargain release in 2000, he says he has reformed and is devoting his talents to helping computer security. It's not clear whether this book is a means toward that end or a, wink-wink, fictionalized account of his exploits, with his name changed to protect his parole terms. Either way, it's a tour de force, a series of tales of how some old-fashioned blarney and high-tech skills can pry any information from anyone. As entertainment, it's like reading the climaxes of a dozen complex thrillers, one after the other. As a security education, it's a great series of cautionary tales; however, the advice to employees not to give anyone their passwords is bland compared to the depth and energy of Mitnick's descriptions of how he actually hacked into systems. As a manual for a would-be hacker, it's dated and nonspecific better stuff is available on the Internet but it teaches the timeless spirit of the hack. Between the lines, a portrait emerges of the old-fashioned hacker stereotype: a socially challenged, obsessive loser addicted to an intoxicating sense of power that comes only from stalking and spying.
Copyright 2002 Cahners Business Information, Inc.

Product Details

  • Hardcover: 304 pages
  • Publisher: Wiley; 1 edition (October 4, 2002)
  • Language: English
  • ISBN-10: 0471237124
  • ISBN-13: 978-0471237129
  • Product Dimensions: 9.2 x 6.4 x 1.1 inches
  • Shipping Weight: 1.4 pounds (View shipping rates and policies)
  • Average Customer Review: 4.2 out of 5 stars  See all reviews (144 customer reviews)
  • Amazon Best Sellers Rank: #257,738 in Books (See Top 100 in Books)

More About the Authors

Discover books, learn about writers, read author blogs, and more.

Customer Reviews

Most Helpful Customer Reviews
66 of 68 people found the following review helpful
Format:Hardcover
Kevin Mitnick says "the term 'social engineering' is widely used within the computer security community to describe the techniques hackers use to deceive a trusted computer user within a company into revealing sensitive information, or trick an unsuspecting mark into performing actions that create a security hole for them to slip through." It's suitable that Mitnick, once vilified for his cracking exploits, has written a book about the human element of social engineering - that most subtle of information security threats.

Some readers may find a book on computer security penned by a convicted computer criminal blasphemous. Rather than focusing on the writer's past, it is clear that Mitnick wishes the book to be viewed as an attempt at redemption.

The Art of Deception: Controlling the Human Element of Security states that even if an organization has the best information systems security policies and procedures; most tightly controlled firewall, encrypted traffic, DMZ's, hardened operating systems patched servers and more; all of these security controls can be obviated via social engineering.

Social engineering is a method of gaining someone's trust by lying to them and then abusing that trust for malicious purposes - primarily gaining access to systems. Every user in an organization, be it a receptionist or a systems administrator, needs to know that when someone requesting information has some knowledge about company procedures or uses the corporate vernacular, that alone should not be authorization to provide controlled information.

The Art of Deception: Controlling the Human Element of Security spends most of its time discussing many different social engineering scenarios. At the end of each chapter, the book analyzes what went wrong and how the attack could have been prevented.

The book is quite absorbing and makes for fascinating reading. With chapter titles such as The Direct Attack; Just Asking for it; the Reverse Sting; and Using Sympathy, Guilt and Intimidation, readers will find the narratives interesting, and often they relate to daily life at work.

Fourteen of the 16 chapters give examples of social engineering covering many different corporate sectors, including financial, manufacturing, medical, and legal. Mitnick notes that while companies are busy rolling out firewalls and other security paraphernalia, there are often unaware of the threats of social engineering. The menace of social engineering is that it does not take any deep technical skills - no protocol decoders, no kernel recompiling, no port scans - just some smooth talk and a little confidence.

Most of the stories in the book detail elementary social engineering escapades, but chapter 14 details one particularly nasty story where a social engineer showed up on-site at a robotics company. With some glib talk, combined with some drinks at a fancy restaurant, he ultimately was able to get all of the design specifications for a leading-edge product.

In order for an organization to develop a successful training program against the threats of social engineering, they must understand why people are vulnerable to attack in the first place. Chapter 15 explains of how attackers take advantage of human nature. Only by identifying and understanding these tendencies (namely, Authority, Liking, Reciprocation, Consistency, Social Validation, and Scarcity), can companies ensure employees understand why social engineers can manipulate us all.

After more than 200 pages of horror stories, Part 4 (Chapters 15 and 16) details the need for information security awareness and training. But even with 100 pages of security policies and procedures (much of it based on ideas from Charles Cresson Wood's seminal book Information Security Policies Made Easy) the truth is that nothing in Mitnick's security advice is revolutionary - it's information security 101. Namely, educate end-users to the risks and threats of non-technical attacks.

While there are many books on nearly every aspect of information security, The Art of Deception is one of the first (Bruce Schneier's Secrets and Lies being another) to deal with the human aspect of security; a topic that has long been neglected. For too long, corporate America has been fixated with cryptographic key lengths, and not focused enough on the human element of security.

From a management perspective, The Art of Deception: Controlling the Human Element of Security should be on the list of required reading. Mitnick has done an effective job of showing exactly what the greatest threat of attack is - people and their human nature.

Comment | 
Was this review helpful to you?
46 of 49 people found the following review helpful
Format:Hardcover
Mitnick has his own reputation to live up to with this book, which sets a pretty high bar for the audience who knows him as the "World's Most Notorious Hacker." Unfortunately, while he knows the material cold, his skills as an author are less stellar.

The vignettes describing various cons are, in the large, very entertaining. They're fictionalized, and sometimes the dialogue feels artificial. This book is supposed to convince us how easily people are victimized by social engineers. When the victim's dialogue plays too obviously into the con man's hands (for the purpose of illustrating the point relevant to the enclosing chapter/section), this goal is to some extent defeated. It's too easy to read unnatural dialogue and use that as an excuse to tell oneself, "I don't have to worry about that sort of attack -- I'm not that dumb!" More effort could have been expended in fictionalizing these scenarios without making them so difficult to relate to. Seeing how a con is performed is kind of like learning how a magic trick works -- it holds a similar fascination. Imagine seeing an amazing magic trick performed on television, wondering how it was possibly accomplished, and then learning that the trick was all in the video editing. That really sucks the fun out of the magic -- analogously, when the "trick" in one of these cons is just that the victim does something obviously stupid at just the right moment, the believability and enjoyment are damaged.

Despite what I've said, the cons are definitely enjoyable to read and do offer some genuine insights. Not all suffer from believability problems. However, the supporting material discussing these scenarios is pretty weak. There's a rigid format ("Analyzing the con," "Preventing the con," etc.) which leads the author to repeat the same points over and over again with very little variation, at times seemingly just to fit the format. The purpose of all this material is to give useful security recommendations and proper motivation for following them. The recommendations are on-target, but repeated ad nauseum.

The descriptions of social engineers also suffer from a tendency to stroke the author's own ego -- the bigger the con, the thicker the language about how smart, handsome, and clever the con man is. I'd like to be convinced by facts, not hyperbole.

I think this would really have worked better as two books, for two different audiences. One for entertainment, to read about all the cons and how they work, to get a little history of social engineering. And one for serious security discussion. The blend of the two leads to a schizoid work that's simply mediocre.
Was this review helpful to you?
28 of 30 people found the following review helpful
By A Customer
Format:Hardcover
I went into this book thinking I knew a fair amount about security in general. You know, don't leave your network password on a post-it on your bulletin board, be aware of strangers in your office, that kind of thing. Then, I finished reading the book, and realized that it challenged all the assumptions that I had about the way I react in these situations. Mitnick's right - we as human beings are conditioned to be polite and trusting, and as horrible as it seems, that's not always right. But you don't have to become nasty and distrustful, just aware. That's what this book is talking about. The examples are wonderful - they really do read like a mystery thriller. And the advice is really sound. It doesn't mention it here, but there is a great flowchart in the back of the book that I've copied for everyone in my office. It details what to do if someone calls you for information that you are not sure they need or should be getting. All in all, The Art of Deception is a must read for many of us.
Comment | 
Was this review helpful to you?
Most Recent Customer Reviews
Yay
I like this book very much you should buy it with the money you earned from that cool job you got yo.
Published 2 months ago by Yay for me
Riveting tales of today's security weaknesses...
This book is a must read if you are even remotely interested in security and the security weaknesses of our ever day world. Read more
Published 7 months ago by Jaylinde
If you are concerned about security - READ THIS BOOK!
As an IT/Software Developer for over 15 years, this book is one of the best and sobering books about security I have ever read. Read more
Published 7 months ago by Michael D. Valverde
The Art of Deception
The good ways never stop working. Kevin brings to life the best techniques for influencing your way to success in this deception-ridden world.
Published 9 months ago by nomdeplume
Interesting
Interesting book by a famous hacker about how social engineers fool security systems not by hacking but mostly by fooling people. Read more
Published 10 months ago by Antonio Canas
fun read but outdated
The stories told by Mitnick in this book are very entertaining to read, but I do think that businesses today (certainly enterprises) have done a lot of work in countering practices... Read more
Published 10 months ago by gamblor
Starts ok, becomes repetitive & boring.
I'm a big fan of social engineering. I find it supremely interesting. This book starts out alright, with a couple of interesting examples, but as you get deeper into the book, it... Read more
Published 10 months ago by R. Tabula
Berglund Center for Internet Studies Review by Jeffrey Barlow
The book has real value. Mitnick demonstrates how very important it is that corporations and institutions train their employees in properly controlling all information pertinent to... Read more
Published 12 months ago by Berglund Center for Internet Studies
pretty good
I've been doing computer security for years and I'm wasn't positive what I expected to get out of the book - I guess I was expecting to learn something that I didn't already... Read more
Published 15 months ago by jcm800
Great Book...a must read
I am a Private Investigator by profession for over 25 years...and this book still had some eye openers and tips and tricks I have picked up on and used. Read more
Published 17 months ago by Rich U
Search Customer Reviews
Only search this product's reviews

Book Extras from Other Websites

This content may contain spoilers

Introduction (From Wikipedia)

The Art of Deception is a book by Kevin Mitnick that covers the art of social engineering. Part of the book is composed of real stories, and examples of how social engineering can be combined with hacking. All, or nearly all, of the examples are fictional, but quite plausible. They expose the ease with which a skilled social engineer can subvert many rules most people take for granted. This book also, after giving an example, will tell what tricked/conned the victims of the scam, and how to prevent it in real life or business. The book ends with Mitnick's strategy and business plans to prevent most if not all of the scams in the book.

Attribution: The information appearing above in this tab is from Wikipedia: The Art of Deception. Amazon is not affiliated with, and neither endorses, nor is endorsed by Wikipedia or any of the authors who contributed to this article. The Wikipedia content may be available under the Creative Commons Attribution-ShareAlike License, version 3.0 or any later version, available at: CC BY-SA. Additional or other terms may apply. See Wikipedia Terms of Use for details.
See a problem with this content? Let us know
Please select the problem below and submit.
This article does not match the product
Other
500 characters left
Your feedback is valuable and will be considered.

Inside This Book (learn more)
First Sentence:
a company may have purchased the best security technologies that money can buy, trained their people so well that they lock up all their secrets before going home at night, and hired building guards from the best security firm in the business. Read the first page
Key Phrases - Statistically Improbable Phrases (SIPs): (learn more)
speakeasy security, intracompany mail, heart stent, computer intruders, voice mail passwords, social engineering tactics, good social engineer, social engineering attacks, social engineering skills, social engineering methods, sig card, information thieves, invalid login attempts, security awareness program, corporate computer systems, information security program, legitimate employees, phone phreaks, innocuous information, information security policies, social engineers, employee badge, privileged accounts, company computer systems, voice mailbox
Key Phrases - Capitalized Phrases (CAPs): (learn more)
Trojan Horse, New York, Tom Stilton, Unverified Person, Los Angeles, May Linn, Social Security Administration, Thousand Oaks, Secure Communications Group, Ten North, United States, Honorable Auto Parts, Industrial Federal Bank, Michael Parker, National Bank, Public Defender's Office, San Diego, Accounts Receivable, Bob Billings, Development Center, General Telephone, Obtain Authority, Office of the Inspector General, Peter Milton, Ron Vittaro
New!
Books on Related Topics | Concordance | Text Stats
Browse Sample Pages:
Front Cover | Table of Contents | First Pages | Index | Back Cover | Surprise Me!
Search Inside This Book:


Tags Customers Associate with This Product

 (What's this?)
Click on a tag to find related items, discussions, and people.
 
(4)
(3)

Your tags: Add your first tag
 

Customer Discussions

This product's forum
Discussion Replies Latest Post
No discussions yet

Ask questions, Share opinions, Gain insight
Start a new discussion
Topic:
First post:
Prompts for sign-in
 


Active discussions in related forums
Search Customer Discussions
Search all Amazon discussions
   
Related forums