Profile for Ben Rothke > Reviews

Browse

Ben Rothke's Profile

Customer Reviews: 437
Top Reviewer Ranking: 2,851
Helpful Votes: 3694




Community Features
Review Discussion Boards
Top Reviewers

Guidelines: Learn more about the ins and outs of Your Profile.

Reviews Written by
Ben Rothke "Information security professional" RSS Feed (USA)
(REAL NAME)   

Show:  
Page: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11-20
pixel
Social Media Security: Leveraging Social Networking While Mitigating Risk
Social Media Security: Leveraging Social Networking While Mitigating Risk
by Michael Cross
Edition: Paperback
Price: $47.45
48 used & new from $38.33

4.0 out of 5 stars Book offers a broad framework that a firm can use to create or enhance its social media security program, February 3, 2015
A firm can spend decades building a brand into one that inspires trust. Unfortunately, social media can quickly destroy that trust in an instant. In Social Media Security: Leveraging Social Networking While Mitigating Risk, author Michael Cross provides a comprehensive overview of the security and privacy risks around social media. The book lives up to its title and effectively shows the reader how to use social media without getting caught in its myriad security, privacy, risk, and PR weaknesses.

The book offers a broad framework that a firm can use to create or enhance its social media security program. It covers software solutions, training, policy, PR disaster mitigation, awareness, and more. Social Media Security is a handy resource for firms that are trying to create an effective and secure social media program.

Cross is a computer forensic analyst with Niagara Regional Police Service and brings a real-world approach to the topic. Each chapter lists tools and websites the reader can reference. The book includes real-world examples of firms that suffered damages from social media; it shows how some handled an event effectively while others were completely overwhelmed by an incident.

In 2015, it is important for businesses to have a social media presence. But companies also need an effective social media security program. If they don't, they could be yet another horror story in future editions of this book.


Designing and Building a Security Operations Center
Designing and Building a Security Operations Center
by David Nathans
Edition: Paperback
Price: $47.92
45 used & new from $35.85

3 of 3 people found the following review helpful
4.0 out of 5 stars Good reference to start with for those considering building a SOC, January 28, 2015
Many organizations are overwhelmed by the onslaught of security data from disparate systems, platforms and applications. They have numerous point solutions (anti-virus, firewalls, IDS/IPS, ERP, access control, IdM, single sign-on, etc.) that can create millions of daily log messages. In addition to directed attacks becoming more frequent and sophisticated, there are regulatory compliance issues that place increasing burden on security, systems and network administrators.

This creates a large amount of information and log data without a formal mechanism to deal with it. This has led to many organizations creating a security operations center (SOC). A SOC in its most basic form is the centralized team that deals with information security incidents and related issues.

In Designing and Building a Security Operations Center, author David Nathans provides the basics on how that can be done. An effective SOC provides the benefit of speed of response time to a security incident. Be it a DDoS attack or malware which can spread throughout a corporate network in minutes, and potentially knock out the network, every second counts in identifying these attacks and negating them before they can cause additional damage. Having a responsive SOC can make all the difference in how a firms deals with these security issues.

The book notes that the SOC is akin to an enterprise nervous system that can gather and normalize vast amounts of log and related data. This can provide continuous prevention, protection and detection by providing response capabilities against threats, remotely exploitable vulnerabilities and real-time incidents on the monitored network.

The books 11 chapters provide a start for anyone considering building out their own SOC. Topics include required infrastructure, organizational structure, staffing and daily operations, to training, metrics, outsourcing and more.

When building a SOC, the choices are for the most part doing it yourself (DIY) or using an outsourced managed security service provider (MSSP). The book focuses primarily on the DIY approach, while chapter 10 briefly details the issues and benefits of using a MSSP. The book provides the pros and cons of each approach. Some firms have a hybrid approach where they perform some SOC activities and outsource others. But the book doesn’t details that approach.

The book provides a large amount of details on the many tasks needed to create an internal SOC. The truth is that many firms simply don’t have the staff and budget needed to support an internal SOC. They also don’t have the budget for an MSSP. With that, Mike Rothman of Securosis noted that these firms are “trapped on the hamster wheel of pain, reacting without sufficient visibility, but without time to invest in gaining that much-needed visibility into threats without diving deep into raw log files”.

One important topic the book does not cover is around SIM/SIEM/SEM software. SIEM software can provide a firm with real-time analysis of security alerts generated by network and security hardware, software and other applications.

Many benefits come from an effective SIEM tool being the backbone of the SOC. A SIEM tool consolidates all data and analyzes it intelligently and provides visualization into the environment. But selecting the appropriate SIEM and correctly deploying it is not a trivial endeavor.

Gartner notes that organizations evaluating SIEM tools should begin with a requirements definition effort that includes IT security, IT operations, internal audit and compliance. Organizations must determine deployment scale, real-time monitoring, postcapture analytics and compliance reporting requirements. In addition, organizations should identify products whose deployment and support requirements are good matches to internal project and support capabilities.

To do this, Gartner recommends developing a set of requirements that resolve the initial problem. However, there should also be some planning for the broader implementation of SIEM capabilities in subsequent project phases. Developing a two- to three-year road map for all functions will ensure that the buying decision considers longer-term functional and scaling requirements. Be ready to evolve the plan in response to changes in IT, business requirements and threats. As you can see, SIEM is indeed a big deal.

Those looking for a good reference on SIEM should read: Security Information and Event Management (SIEM) Implementation. That book does provide an excellent overview of the topic and will be of value to those reading looking for answer around SIEM. Those looking for a solid introduction to the world of SIEM should definitely get a copy.

The book notes that the most important part of a SOC, and often the most overlooked, is that of the SOC analyst. And with that, the book writes how it’s important to be cognizant of the fact of SOC analyst burnout. SOC analysts can burnout and it’s important for an organization to have a plan to address this, including aspects of training, management opportunities and job rotation.

Building an in-house SOC takes significant planning an attention to detail and the book details a lot of the particulars that are required for an effective SOC design.

The implementation of a SOC will cost a significant amount of money and management will often want to have metrics to let them know what the SOC is doing. The book spends a brief amount of time on SOC metrics; which is a topic that warrants a book in its own right. There are many metrics that can be created to measure SOC efficacy. Effective SOC metrics will measure how quickly incidents are handled by the SOC, and how incident are identified, addressed and handled.

The downside to metrics is that they must be used judiciously. It’s important not to measure base performance of a SOC analyst simply on the number of events analyzed or recommendations written. Metrics used in that manner are akin to help desk where analysts are only concerned about getting calls finished, in order to meet their calls completed metrics.

As important as a SOC is, this is surprisingly the first book written on the topic. At under 250 pages, the book provides an introduction to the topic, but is not a comprehensive work on the topic. There are areas in SOC management that the book doesn’t cover, such as SOC documentation, creating and using SOC operation run books, and more.

But even with those missing areas Designing and Building a Security Operations Center is a good reference to start with. A SOC is a security component most organizations are in dire need of, and the book is a good way to get them started on that effort.


PRAGMATIC Security Metrics: Applying Metametrics to Information Security
PRAGMATIC Security Metrics: Applying Metametrics to Information Security
by W. Krag Brotby
Edition: Hardcover
Price: $66.45
45 used & new from $59.81

1 of 1 people found the following review helpful
4.0 out of 5 stars Good guide for to develop an information security metrics program, January 27, 2015
Like all books on metrics, early in PRAGMATIC Security Metrics: Applying Metametrics to Information Security authors Krag Brotby and Gary Hinson state that “you can't manage what you can't measure”.

The authors claim that other books on information security metrics discuss number theory and statistics in academic terms. This title promises to be light on mathematics and heavy on utility and is meant as a how-to-do-it guide for security metrics.

Based on that claim, the authors likely had a book such as Data-Driven Security: Analysis, Visualization and Dashboards by Jay Jacobs and Bob Rudis in mind. As Jacobs and Rudis do indeed use statistics extensively in their approach to security metrics.

As to the title, PRAGMATIC is an acronym for the basis of the method of the book, in using metrics that are predictive, relevant, actionable, genuine, meaningful, timely, independent and cost.

One of the benefits of the book is that it provides a method to create quantitative methods for risk, and how to estimate which resources to use to mitigate those identified risks

The authors note that as a consequence of the way the field of information security has developed from IT security, current practice in security metrics seems to be driving by the availability of raw data from firewalls and other systems. But when it comes to measuring security, many organizations completely ignore the nontechnical factors that are often of equal importance to managing information security in a manner that supports the firm’s business objectives. And that is precisely the gap the book is attempting to fix.

Chapter 7 makes up the bulk of the book when it details over 150 different useful metrics in which to use.

For those looking for a book in which to develop their information security metrics program, in PRAGMATIC Security Metrics: Applying Metametrics to Information Security is a valuable reference.


By Rebecca Herold The Practical Guide to HIPAA Privacy and Security Compliance, Second Edition (2nd Second Edition) [Hardcover]
By Rebecca Herold The Practical Guide to HIPAA Privacy and Security Compliance, Second Edition (2nd Second Edition) [Hardcover]
by Rebecca Herold
Edition: Hardcover
7 used & new from $157.69

2 of 2 people found the following review helpful
5.0 out of 5 stars Great HIPAA resource, January 25, 2015
From an information security perspective, there is nothing overly onerous with the HIPAA security and privacy requirements. But like all regulations, the devil is in the details. While HIPAA is meant to protect large-scale disclosure of patient data, some of it includes absurd requirements such as ensuring white-boards in hospital wards don't have full patient information and that intravenous bags have tags over the patient names.

In The Practical Guide to HIPAA Privacy and Security Compliance, authors Rebecca Herold and Kevin Beaver (full disclosure: Rebecca and Kevin are friends of mine) have created a most useful reference that will provide the reader with a great reference to assist with both their understanding of HIPAA, and their HIPAA compliance endeavors.

The first edition of the book came out in 2003. This second edition fills in the many gaps in the previous 12 years, which saw significant changes to both the regulation and the industry.

The book details the many updates to HIPAA, including the security rule, HITECH Act, 2013 Omnibus Rule, and a number of rules pending.

As noted in the title, the book is highly practical with many charts and tables detailing specifically what needs to be done for HIPAA compliance. Specific examples include numerous decision charts, a state by state detailed list of websites for data breach notification, and much more.

A prime advantage of the book is that it takes a practical and real-world approach to HIPAA compliance, rather than simply regurgitating the already publicly available HIPAA regulation. The authors have many years of applied experience in the topics, and show the reader how to achieve HIPAA compliance, all without technical jargon.

The only thing that is missing from the book is a companion web site or CD-ROM where all of the helpful charts and tables could be downloaded or accessed.

Those who are tasked with HIPAA compliance, or anyone who needs a single-source reference to all of the core details around HIPAA compliance will find The Practical Guide to HIPAA Privacy and Security Compliance to be an invaluable resource.


Enterprise Software Security: A Confluence of Disciplines (Addison-Wesley Software Security Series)
Enterprise Software Security: A Confluence of Disciplines (Addison-Wesley Software Security Series)
by Kenneth R. Van Wyk
Edition: Paperback
Price: $40.62
56 used & new from $19.90

1 of 1 people found the following review helpful
4.0 out of 5 stars Provides a different approach on ensuring software security, January 15, 2015
To date, most software security books have focused solely on writing secure code and educating developers on how to do that.

In Enterprise Software Security: A Confluence of Disciplines, authors Kenneth van Wyk, Mark Graff, Dan Peters and Diana Burley take a different, and ultimately necessary approach. Their tactic is that treating software security as an autonomous discipline doesn’t work. With is needed is, as the titles notes, a confluence, a process of merging two autonomous groups. In this case, those groups are software development security and network security.

By having enterprise security interact with their software engineers and developers (which is in truth, not such a radical idea), the ability to fully protect software can be actualized.

The authors note that it is an imperative for these two groups to collaborate to ensure effective enterprise security. Obviously, just placing these two groups in a conference room and telling them to work security out is a method that is bound to fail. Hence, the book provides a holistic approach and method in which they can work together.

The book shows how this confluence will work throughout the entire software development lifecycle; from inception, design, implementation, testing, deployment, operation, to software maintenance and more.

As noted, this is not secure software guide, such as Robert Seacord’s superb CERT C Coding Standard: 98 Rules for Developing Safe, Reliable, and Secure Systems or Java Coding Guidelines: 75 Recommendations for Reliable and Secure Programs. Readers looking for detailed coding guidelines or ways to write secure code against the OWASP Top 10 won’t find it in this title.

What the book does offer is a method to enhance software security by ensuring those who are expected to create and maintain it, and support the platforms it runs on, play nicely. That act of having software development and enterprise security place nicely in the corporate IT word is not a trivial endeavor. With that, Enterprise Software Security: A Confluence of Disciplines details a timely approach on how to take this confluence, and make it work in an enterprise IT environment.


The Iranian Talmud: Reading the Bavli in Its Sasanian Context (Divinations: Rereading Late Ancient Religion)
The Iranian Talmud: Reading the Bavli in Its Sasanian Context (Divinations: Rereading Late Ancient Religion)
by Shai Secunda
Edition: Hardcover
Price: $49.50
41 used & new from $39.95

4 of 4 people found the following review helpful
5.0 out of 5 stars Excellent book about Talmudo-Iranica, January 6, 2015
In November, the Taiwanese embassy in Japan detailed a number of tips for Taiwanese citizen’s s visiting Japan. These include minor items like not putting chopsticks in the serving bowl, and more significant ones like stopping for pedestrians at crosswalks. Japanese society is a distinctive society with strict rules that are not always obvious to visitors. Knowing these rules can make a significant difference.

Similarly, for those who study the Talmud, there are myriad events detailed, whose context may not be always obvious to the reader. Understanding those details and nuances can make a significant difference in understanding the reading of a specific Talmudic passage.

In The Iranian Talmud: Reading the Bavli in Its Sasanian Context, Dr. Shai Secunda of the Hebrew University of Jerusalem has written a fascinating monograph that attempts to connect some features of the Babylonian Talmud, or Bavli, to aspects of Sasanian culture.

Secunda builds on the notable work of Professor Yaakov Elman of Yeshiva University, who produced a series of studies that considered the impact of Persian culture on the Bavli. Elman created the scholarly field known as Talmudo-Iranica, which seeks to understand the Babylonian Talmud in its Middle-Persian context.

Secunda’s book details the relationship between Zoroastrian texts and the Bavli, and the interaction between the Zoroastrians and Jews in the Sasanian empire. It’s unclear exactly just how much interaction there was between the Zoroastrian priests and Babylonian rabbis; but the book provides a number of arguments to show that it was not an insignificant amount.

As to the Sasanian dynasty which the book is about, it existed from about 225 CE to 650 CE in Persian speaking Mesopotamia, where the main religion was Zoroastrianism.

Secunda writes that by understanding the Bavli in an Iranian context, the Talmudist is better able to understand the Bavli. He writes that there are a few hundred Iranian-- usually Middle Persian-loanwords (a word borrowed from a donor language and incorporated into a recipient language without translation) in Babylonian Jewish Aramaic. This is a small amount compared to the amount of Greek and Latin terms. But by knowing when these Iranian words occur, the serious reader of the Talmud is better able to have a more accurate understanding of those topics in the Bavli.

In addition, he quotes a number of Talmudic passages, and provides an added Sasanian context, which can change the dynamic of the debate or story at hand.

Besides the language, another focal point of the book is the Zoroastrian religion, which was the main denomination in the area at the time. By understanding the Zoroastrian culture and the interaction between the Jews and Zoroastrians in various matters, the reader is better able to understand the deeper meaning of certain Talmudic passages.

Secunda quotes a Talmudic passage that stumped scholars Jacob Neusner and Albert de Jong. He then writes that had they better understood the Zoroastrian culture, they would have been better positioned to unravel the meaning of the Talmudic story and appreciate the intercultural dynamics that it reflected.

Secunda goes so far to write that not only did Neusner and de Jong not understand the full context, but boldly, and somewhat incredibly, that had Rashi, the great medieval French commentator, better understood the context of the Talmudic passage, he may have provided an answer that did not seem to have been forced.

Secunda readily admits that the material and textual remains that are available for reconstructing Jewish and Zoroastrian life in Sasanian Iran are; quantitatively speaking - rather meager. That creates a challenge when looking to gain a broader and deeper understanding of the interactions between the cultures.

It should be noted that for those that don’t have a background or interest in Talmudo-Iranica, it is not as if their study of the Talmud will be significantly obstructed. Rather, knowing; -or having an appreciation for the Talmudo-Iranica nuances will augment their Talmudic studies.

The book is a brief 150 page text, with 60 pages of footnotes and references. Secunda does a superb job of building on Elman’s Talmudo-Iranica. Anyone who studies the Bavli and wants to understand the bigger picture of the text and context will certainly find The Iranian Talmud: Reading the Bavli in Its Sasanian Context an interesting and invaluable reference.


Cyber Crime and Cyber Terrorism Investigator's Handbook
Cyber Crime and Cyber Terrorism Investigator's Handbook
by Laurence A. Cole
Edition: Paperback
Price: $47.45
48 used & new from $33.46

4 of 5 people found the following review helpful
4.0 out of 5 stars Good initial reference to the topic, January 5, 2015
While the perpetrator of the recent Sony hack is still to be determined, it was certainly an act of either cybercrime or cyberterrorism. With that, in Cyber Crime and Cyber Terrorism Investigator's Handbook, editors Babak Akhgar, Andrew Staniforth and Francesca Bosco have assembled a team of over 25 writers to give the reader an detailed overview of the topic.

The authors and contributors are all from Europe and the Middle East; which gives the book a geographic focus from that end of the globe. The European Union Data Protection guidelines (Directive 95/46/EC) regulate the processing of personal data within the European Union. The Directive is relevant when investing a crime, and the books gets into those details.

The book provides a good introduction to the topic, with a good mixture of introduction and technical discussions.

The book is not a comprehensive reference of the topics. In just over 250 pages, the book provides a quick overview of the space. For those that want a more comprehensive reference, there are a number of book books available.

But for those looking for a quick overview to the core areas, Cyber Crime and Cyber Terrorism Investigator's Handbook is a good reference to start with.


The Talmud - A Biography: Banned, censored and burned. The book they couldn't suppress
The Talmud - A Biography: Banned, censored and burned. The book they couldn't suppress
by Harry Freedman
Edition: Hardcover
Price: $19.25
78 used & new from $11.37

6 of 6 people found the following review helpful
4.0 out of 5 stars Overview of the Talmud for the perplexed, December 23, 2014
Professor Shai Secunda of the Hebrew University of Jerusalem astutely noted in his book The Iranian Talmud: Reading the Bavli in Its Sasanian Context that the Babylonian Talmud is “a complex literary artifact with a multi-vocal textual architecture that frequently confounds attempts to read for consistency”. The very nature of its composition precludes many from any attempt to study it.

While the Talmud itself may be impenetrable for many, in The Talmud - A Biography: Banned, censored and burned. The book they couldn't suppress, author Harry Freedman has written an engaging account of the book itself. For those who may be fascinated by the Talmud and at the same time intimidated by it, the book is a great resource that profiles what the Talmud is.

Freedman wrote the book not to tell you the text of the book or to delve into its myriad contents and subjects; rather to show the reader how instrumental it has been to the Jews and world history, in addition to other cultures and religions.

Freedman details where the Talmud came from, its creation almost 2,000 years ago; to its development and use in current times. He provides an interesting, albeit brief overview of its development, copyediting, printing, burning and banning.

For those looking for a detailed and much more technical introduction to the Talmud, The Essential Talmud by Rabbi Adin Steinsaltz provides a superb overview. What Freedman provides is a much higher overview of the topic, and details what the Talmud is, but does not get into its lower level abstractions, which can be so frustrating to the beginner.

Freedman writes that for all its complex composition, the Talmud appears to the reader to be a seamless work. He writes that although it was written in Babylon (modern day Iraq), it can quote the opinions of people who lived their entire lives elsewhere; yet make it read as though they were in the same study hall in Babylon. Also, a characteristic Talmudic discussion contains the opinions of people who may have lived centuries apart, and is woven together to sound as if they are having an actual conversation.

The book does an excellent job of showing the genius of the Talmud and its creators. That specific genius of the Talmud lies in taking the detailed case law of the Mishnah, defining the principles and concepts the underlie it and advancing arguments that can be used to underpin a subsequent legal ruling.

Freedman details the myriad instances where the study, print or possession of the Talmud was banned. And even with all that, he notes that the Talmud’s capacity for survival is boundless; as it’s currently studied by more people than at any time in its history.

Freedman shows how the Talmud has survived every catastrophe that it has been put through. It has not only survived, it has in fact thrived within the challenges of modernity. The haskalah movement that tried to extinguish the Talmud, has in fact itself been extinguished, while the Talmud thrives.

As 234 pages, Freedman provides a very brief overview, but an interesting one at that. The only issue with the book is that its brevity may not give the reader a feeling for the inherent complexities of the Talmud itself. Nothing in the Talmud is taken for granted; yet Freedman at times presents a subject or problem in an overly simplified form. Part of that is due to the fact that Freedman is an Aramaic scholar, not an academic Talmudist. Nonetheless, the book is of great value for the audience it is written for.

After the Bible, the Talmud is the defining document in Jewish life. In The Talmud - A Biography, Freedman provides an excellent overview on how an eternal book is seminal to an eternal people.


Fire in the Valley: The Birth and Death of the Personal Computer
Fire in the Valley: The Birth and Death of the Personal Computer
by Paul Freiberger
Edition: Paperback
Price: $24.74
56 used & new from $13.77

4 of 4 people found the following review helpful
5.0 out of 5 stars Easy and enjoyable read of the history of the birth, development and revolution of the PC, December 18, 2014
In Fire in the Valley: The Birth and Death of the Personal Computer, authors Michael Swaine and Paul Freiberger provide a thoroughly enjoyable read of the history and development of the PC.

As timing would have it, Michael Swain was editor of Dr. Dobb's Journal, which this week announced it would be ceasing publication in 2015 after nearly 40 years in print. The valley in the title is Silicon Valley, where both authors worked at InfoWorld during the 1980s, and their knowledge of the events comes from being there with the key players. Their vantage point provides a unique perspective to the story.

This is the third edition of the book; with the first two editions coming out in 1984 and 2000. While the historical facts are pretty much the same from the first edition; the third edition adds to the story by putting the facts into a historical perspective from a 2014 perspective.

The book details the many individuals who were responsible for the development of the PC. Names you have likely not heard of such as Ted Hoff of Intel, Lee Felsenstein of Processor Technology, Ed Roberts from MITS, to the more prominent names like Douglas Engelbart, Bill Gates and Steve Jobs.

The book details the major people players involved in the early and middle yeas of the PC revolution, and also provides a historical background to historically important computer firms such as Altair, Commodore, Compaq, Digital and many more.

Some books have downplayed the role Steve Ballmer and Bill Gates of Microsoft played in the overall development of the PC. The book notes that their role was not just being in the right place at the right time, but having the skills to make it work.

For those looking for the history of the birth, development and revolution of the PC, Fire in the Valley: The Birth and Death of the Personal Computer is an easy and enjoyable read, and a fascinating one at that.


Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door
Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door
by Brian Krebs
Edition: Hardcover
Price: $18.68
72 used & new from $9.72

2 of 3 people found the following review helpful
5.0 out of 5 stars Excellent expose on why cybercrime pays and what you can do about it, December 8, 2014
There are really two stories within Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door. The first is how Brian Krebs uncovered the Russian cybergangs that sent trillions of spam emails for years. As interesting and compelling as that part of the story is; the second storyline is much more surprising and fascinating.

Along with George V. Hulme and Steve Ragan, Krebs is one of the premier cybersecurity journalists. From 1995 to 2009, he was a reporter for The Washington Post, where he covered Internet security, technology policy, cybercrime and privacy issues. When Krebs presented the Post with his story about the Russian spammers, rather than run with it, the Post lawyers got in the way and were terrified of being sued for libel by the Russians. Many of the stories Krebs ran took months to get approval and many were rejected. It was the extreme reticence by the Post to deal with the issue and their nervous lawyers that led Krebs to leave the paper.

Before Krebs wrote this interesting book and did his groundbreaking research, it was clear that there were bad guys abroad spamming American’s with countless emails for pharmaceuticals which led to a global spam problem.

Much of the story details the doings of two of the major Russian pharmacy spammer factions, Rx-Promotion and GlavMed. In uncovering the story, Krebs had the good fortune that there was significant animosity between Rx-Promotion and GlavMed, which lead to an internal employee leaking a huge amount of emails and documents. Krebs obtained this treasure trove which he used to get a deep look at every significant aspect of these spam organizations. Hackers loyal to the heads of Rx-Promotion and GlavMed leaked this information to law enforcement officials and Krebs in an attempt to sabotage each other.

Krebs writes that the databases offered an unvarnished look at the hidden but burgeoning demand for cheap prescription drugs; a demand that appears driven in large part by Americans seeking more affordable and discreetly available medications.

Like many, I had thought that much of the pharmaceutical spam it was simply an issue of clueless end-users clicking on spam and getting scammed. This is where the second storyline comes in. Krebs notes that the argument goes that if people simply stopped buying from sites advertised via the spam that floods our inboxes, the problem would for the most part go away. It’s not that the spam is a technology issue; it’s that the products fill an economic need and void.

Krebs shows that most people who buy from the spammers are not idiots, clueless or crazy. The majority of them are performing rational, if not potentially risky choices based on a number of legitimate motivations. Krebs lists 4 primary motivations as: price and affordability, confidentiality, convenience & recreation or dependence.

Most of the purchasers from the Russian spammers are based in the US, which has the highest prescription drug prices in the world. The price and affordability that the spammers offer is a tremendous lure to these US consumers, many of whom are uninsured or underinsured.

Krebs then addresses the obvious question that this begs: if the spammers are selling huge amounts of bogus pharmaceuticals to unsuspecting Americans, why doesn’t the extremely powerful and well-to-do pharmaceutical industry do something about it. Krebs writes that the pharmaceutical industry is in fact keenly aware of the issue but scared to do anything about it. Should the reality be that the unauthorized pharmaceuticals are effective, then the pharmaceutical industry would be placed in a quandary. They have therefore decided to take a passive approach and do nothing.

The book quotes John Horton, founder and president of LegitScript, a verification and monitoring service for online pharmacies. It’s the only service recognized by the National Association of Boards of Pharmacy as adhering to its standards.

Horton observed that only 1% of online pharmacies are legitimate. But worse than that, he believes that the single biggest reason neither the FDA nor the pharmaceutical industry has put much effort into testing, is that they are worried that such tests may show that the drugs being sold by many so-called rogue pharmacies are by and large chemically indistinguishable from those sold by approved pharmacies.

So while the Russian spammers may be annoying for many, they have found an economic incentive that is driving many people to become repeat customers.

As to the efficacy of these pharmaceuticals being shipped from India, Turkey and other countries, it would seem pretty straightforward to perform laboratory tests. Yet the university labs that could perform these tests have found their hands-tied. In order to test the pharmaceuticals, they would have to order them, which is likely an illegal act. Also, the vast amount of factories making these pharmaceuticals makes it difficult to get a consistent set of findings.

As to getting paid for the products, Krebs writes how the thing the spammers relied on most was the ability to process credit card payments. What they feared the most were chargebacks; which is when the merchant has to forcibly refund the customer. If the chargeback rate goes over a certain threshold, then the vendor is forced to pay higher fees to the credit card company or many find their merchant agreement cancelled. The spammers were therefore extremely receptive to customer complaints and would do anything to make a basic refund than a chargeback. This was yet another economic incentive that motivated the spammers.

As to the main storyline, the book does a great job of detailing how the spam operations worked and how powerful they became. The spammers became so powerful, that even with all the work firms like Blue Security Inc. did, and organizations such as Spamhaus tried to do, they were almost impossible to stop.

Krebs writes how spammers now have moved into new areas such as scareware and ransomware. The victims are told to pay the ransom by purchasing a prepaid debit card and then to send the attackers the card number to they can redeem it for cash.

The book concludes with Krebs’s 3 Rules for Online Safety namely: if you didn’t go looking for it, don’t install it; if you installed it, update it and if you no longer need it, remove it.

The scammers and online attackers are inherent forces in the world of e-commerce and it’s foolhardy to think any technology or regulation can make them go away. Spam Nation does a great job of telling an important aspect of the story, and what small things you can do to make a large difference, such that you won’t fall victim to these scammers. At just under 250 pages, Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door is a quick read and a most important one at that.


Page: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11-20