Profile for Ben Rothke > Reviews

Browse

Ben Rothke's Profile

Customer Reviews: 407
Top Reviewer Ranking: 2,671
Helpful Votes: 3432




Community Features
Review Discussion Boards
Top Reviewers

Guidelines: Learn more about the ins and outs of Your Profile.

Reviews Written by
Ben Rothke "Information security professional" RSS Feed (USA)
(REAL NAME)   

Show:  
Page: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11-20
pixel
Social Engineering in IT Security: Tools, Tactics, and Techniques
Social Engineering in IT Security: Tools, Tactics, and Techniques
by Sharon Conheady
Edition: Paperback
Price: $28.52
33 used & new from $20.39

2 of 2 people found the following review helpful
5.0 out of 5 stars Effective guide on which to build a social engineering testing program, August 21, 2014
When I first got a copy of Social Engineering in IT Security Tools, Tactics, and Techniques by Sharon Conheady, my first thought was that it likely could not have much that Christopher Hadnagy didn't already detail in the definitive text on the topic: Social Engineering: The Art of Human Hacking. Obviously Hadnagy thought differently, as he wrote the foreward to the book; which he found to be a valuable resource.

While there is overlap between the two books; Hadnagy takes a somewhat more aggressive tool-based approach, while Conheady's book takes a somewhat more passive, purely social approach to the topic. There are many more software tools in Hadnagy; while Conheady doesn't reference software tools until nearly half-way through the book.

This book provides an extensive introduction to the topic and details how social engineering has evolved through the centuries. Conheady writes how the overall tactics and goals have stayed the same; while the tools and techniques have been modified to suit the times.

Coming in at about 250 pages, the book finds a good balance between high-level details and actionable tactical things to execute on. Without getting bogged down in filler.

Since the social engineering tools and techniques only get better, the advantage Conheady's book has it that it details a lot that has changed in the 4 years since Hadnagy's book came out.

Conheady writes about mumble attacks, which are telephone-based social engineering attacks that are targeted at call center agents. The social engineer will pose as a speech-impaired customer or as a person calling on behalf of the speech-impaired customer. The goal of this method is to make the victims; in this case call center agents feel awkward or embarrassed and release the desired information. Given the pressure in which most call center agents are under; this is a simple yet highly effective attack.

Like Hadnagy, this also has a detailed social engineering test methodology. Conheady details a methodology with 5 stages: planning and target identification, research and reconnaissance, scenario creation, attack execution and exit, and reporting. She notes that one does not have to be a slave to the methodology, and it can be modified depending on the project.

Social engineering can often operate on the limit of what is legal and ethical. The author goes to great lengths to write what the ethical and legal obligations are for the tester.
The book is filled with lots of practical advice as Conheady is seasoned and experienced in the topic. From advice to dealing with bathrooms as a holding location, gaining laptop connectivity and more; she writes of the many small details that can make the difference between a successful social engineering test and a failed one.

The book also details many areas where the job of the social engineer is made easy based on poor security practices at the location. Chapter 7 details how many locations have access codes on doors often don't do much to keep social engineers out. Many doors have 4-character codes, and she writes that she has seen keypads where the combination numbers have been so worn down that you can spot them straightaway.

As noted earlier, the book focuses more on the human techniques of social engineering than on software tools. She does not ignore that tools and in chapter 9 provides a list of some of the more popular tools to use, including Maltego, Cree.py and others. She also has lists of other tools to use such as recording devices, bugging devices, phone tools and more.

With all those, she still notes that the cell phone is the single most useful item you can bring with you on a social engineering test. She writes that some of the many uses a cell phone has is to discourage challengers, fake a call to look busy, use the camera and more.

While most of the book is about how to execute a social engineering test, chapter 10 details how you can defend against social engineering. She notes that it is notoriously difficult to defend against social engineering because it targets the weakest link in the security chain: the end-user. She astutely notes that a firm can't simply roll out a patch and immunize its staff against the latest social engineering attack. Even though there are vendors who make it seem like you can.

The chapter also lists a number of indicators that a firm may be experiencing a social engineering attack.

Hadnagy's Social Engineering: The Art of Human Hacking is still the gold-standard on the topic. But Social Engineering in IT Security Tools, Tactics, and Techniques certainly will give it a run for the money.

Hadnagy's approach to social engineering is quite broad and aggressive. Conheady takes more of a kinder, gentler approach to the topic.

For those that are looking for an effective guide on which to build their social engineering testing program on, this certainly provides all of the core areas and nearly everything they need to know about the fundamentals of the topic.


Carry On: Sound Advice from Schneier on Security
Carry On: Sound Advice from Schneier on Security
by Bruce Schneier
Edition: Hardcover
Price: $21.64
66 used & new from $3.98

3 of 3 people found the following review helpful
5.0 out of 5 stars Schneier writes the playbook that Washington should have been following all along, August 11, 2014
Bruce Schenier has been called an information security rock star. If that’s the case, then Carry On: Sound Advice from Schneier on Security is his greatest hits collection 2008-2013.

The roughly 175 essays in the book represent a collection of articles Schneier wrote for this Crypto-Gram newsletter, his blog and other blogs, magazines, newspapers and other periodicals.

Some of the articles, such as the 2008 piece Chinese Cyberattacks: Myth of Menace are clearly dated. A number of the other articles are somewhat redundant in that they were written on the same topic for different audiences.

But the vast majority of the essays reveal Schneier’s insight and pragmatic approach, which makes this a most important book to read. You may not agree with Schenier on every point, but every point of his is well researched and defended. Personally, I think his approach to CCTV’s and public cameras as a method for crime reduction needs to be reviewed against current data on the topic.

Many of the essays show his deep frustration with Washington and the politics of security; which has resulted in creating a security theatre dealing with movie-plot threats. Billions of dollars have been spent in this area, with almost nothing to show for it.

Another premise of the book is that most people don’t understand how to deal with risk and end up worrying about things that pose very little risk to them; of which a large number of essays are dedicated to this topic. Schenier notes the fears people have of school shootings, child abduction, mass food poisonings and the like, all of which are extremely rare. They worry about these while being oblivious do automobile deaths, DUI deaths and similar, which pose real and daily risks.

When it comes to post-9/11 security, Schneier feels most of the time, money and effort has gone to waste, protecting against imaginary threats. He notes that two things have made airplane travel safe post 9/11, namely: reinforcing the cockpit door, and convincing passengers that they need to fight back. But having tens of thousands of clueless and incompetent TSA agents seizing water bottles and patting down wheelchair-bound grannies have done absolutely nothing to increase air safety.

The book is both fascinating and frustrating. Fascinating in that the book will open your eyes to how to deal with risk and security, and ultimately how to carry on. But frustrating in that those in Washington who have been trusted to do this, have rarely done it right.

In Carry On: Sound Advice from Schneier on Security, Schneier writes the playbook that Washington should have been following all along.


Introduction to Cyber-Warfare: A Multidisciplinary Approach
Introduction to Cyber-Warfare: A Multidisciplinary Approach
by Paulo Shakarian
Edition: Paperback
Price: $44.62
43 used & new from $38.23

1 of 1 people found the following review helpful
5.0 out of 5 stars Provides a great introduction to cyberwarfare, August 4, 2014
Cyberwarfare is a most controversial topic. At the 2014 MISTI Infosec World Conference, noted security curmudgeon Marcus Ranum gave a talk on Cyberwar: Putting Civilian Infrastructure on the Front Lines, Again. Be it the topic or Marcus being Marcus, a third of the participants left within the first 15 minutes. They should have stayed, as Ranum, agree with him or not, provided some riveting insights on the topic.

While a somewhat broad term, in Wikipedia, cyberwarfare (often called information warfare) is defined as politically motivated hacking to conduct sabotage and espionage. It is a form of information warfare sometimes seen as analogous to conventional warfare.

The authors define cyber war as an extension of policy by actions taken in cyber space by state or nonstate actors that either constitute a serious threat to a nation’s security or are conducted in response to a perceived threat against a nation’s security.

As to a book on the topic, for most readers, cyberwarfare is something that they may be victims of, but will rarely be an actively part of.

In Introduction to Cyber-Warfare: A Multidisciplinary Approach, authors Paulo Shakarian, Jana Shakarian and Andrew Ruef provide an excellent overview of the topic. The book takes a holistic, or as they call it multidisciplinary, approach to the topic. It looks at the information security aspect of cyberwarfare, as well the military, sociological and other aspects of the topic.

The book is divided into 3 parts and 13 densely packed and extremely well-researched and footnoted chapters, namely:
Part I: Cyber Attack
Chapter 2: Political Cyber Attack Comes of Age in 2007
Chapter 3: How Cyber Attacks Augmented Russian Military Operations
Chapter 4: When Who Tells the Best Story Wins: Cyber and Information Operations in the Middle East
Chapter 5: Limiting Free Speech on the Internet: Cyber Attack Against Internal Dissidents in Iran and Russia
Chapter 6: Cyber Attacks by Nonstate Hacking Groups: The Case of Anonymous and Its Affiliates

Part II: Cyber Espionage and Exploitation
Chapter 7: Enter the Dragon: Why Cyber Espionage Against Militaries, Dissidents, and Nondefense Corporations Is a Key
Component of Chinese Cyber Strategy
Chapter 8: Duqu, Flame, Gauss, the Next Generation of Cyber Exploitation
Chapter 9: Losing Trust in Your Friends: Social Network Exploitation
Chapter 10: How Iraqi Insurgents Watched U.S. Predator Video—Information Theft on the Tactical Battlefield

Part III: Cyber Operations for Infrastructure Attack
Chapter 11: Cyber Warfare Against Industry
Chapter 12: Can Cyber Warfare Leave a Nation in the Dark? Cyber Attacks Against Electrical Infrastructure
Chapter 13: Attacking Iranian Nuclear Facilities: Stuxnet

The book provides numerous case studies of the largest cyberwarfare events to date. Issues around China and their use of cyberwarfare constitute a part of the book. Chapter 7 details the Chinese cyber strategy and shows how the Chinese cyber doctrine and mindset is radically different from that of those in the west.

The book compares the board games of chess (a Western game) and Go (a Chinese game) and how the outcomes and strategies of the games are manifest in each doctrine.

The chapter also shows how the Chinese government outlawed hacking, while at the same time the military identified the best and most talented hackers in China, and integrated them into Chinese security firms, consulting organizations, academia and the military.

One of the more fascinating case studies details the cyber war against the corporate world from China. The book provides a number of examples and details the methodologies they used, in addition to providing evidence of how the Chinese were involved.

For an adversary, one of the means of getting information is via social networks. This is often used in parallel by those launching some sort of cyberwarfare attack. LinkedIn is one of the favorite tools for such an effort. The authors write of the dangers of transitive trust; where user A trusts user B, and user B trusts user C. Via a transitive trust, user A will then trust user C based simply on the fact that user B does. This was most manifest in the Robin Sage exercise.

This was where Thomas Ryan created a fictitious information security professional names Robin Sage. He used her fake identity and profile to make friends with others in the information security world, both commercial, federal and military and he was able to fool even seasoned security professionals. Joan Goodchild wrote a good overview of the experiment here.

In chapter 10, the book details how Iraqi insurgents viewed Predator drones video feeds. Woody Allen said that eighty percent of success is just showing up. In this case, all the insurgents had to do was download the feed, as it was being transmitted unencrypted. Very little cyberwarfare required.

When the drone was being designed, the designers used security by obscurity in their decision not to encrypt the video feed. They felt that since the Predator video feeds were being transmitted on frequencies that were not publically known, no access control, encryption or other security mechanisms would be needed.

The downside is that once the precise frequency was determined by the insurgency, in the case of the Predator drone, the Ku-band, the use of the SkyGrabber satellite internet downloader made it possible for them to effortless view the video feeds.

The only negative about the book is a minor one. It has over 100 pictures and illustrations. Each one states: for the color version of this figure, the reader is referred to the online version of the book. Having that after every picture is a bit annoying. Also, the book never says where you can find the online version of the book.

How good is this book? In his review of it, Krypt3ia said it best when he wrote: I would love to start a kickstarter and get this book into the hands of each and every moron in Congress and the House. The reality is that this book should indeed be read by everyone in Washington, as they are making decisions on the topic, without truly understanding it.

For most readers, this will be the book that tells them everyone they need to know that their congressman should know. Most people will never be involved with any sort of warfare, and most corporate information security professional will not get involved with cyberwarfare. Nonetheless, Introduction to Cyber-Warfare: A Multidisciplinary Approach is a fascinating read about a most important topic.


Security Awareness: Applying Practical Security in Your World
Security Awareness: Applying Practical Security in Your World
by Mark D. Ciampa
Edition: Paperback
Price: $81.79
72 used & new from $69.69

1 of 1 people found the following review helpful
4.0 out of 5 stars Good resource to add to any information security awareness program, July 22, 2014
Security awareness is a vital part of information security. Just how important is it? In September, the 10-day SANS Security Awareness Summit 2014 will cover every aspect of the topic.

For those that want to get an appreciation for the topic but can’t make it to Dallas for the Summit, Security Awareness: Applying Practical Security in Your World is a good resource for the reader that wants both an understanding of the theoretical awareness issues, and how to practically address them.

Author Mark Ciampa is a computer science professor Western Kentucky University with an expansive background on the topic.

The book has an awareness focus for Windows users. The reader is expected to be somewhat technical, and relatively comfortable with using Windows tools.

For those looking for a mid-level reference on the topic, a book that’s not too basic, and also not so broad, Security Awareness: Applying Practical Security in Your World is a good resource to add to any information security awareness program.


Data-Driven Security: Analysis, Visualization and Dashboards
Data-Driven Security: Analysis, Visualization and Dashboards
by Bob Rudis
Edition: Paperback
Price: $40.10
33 used & new from $30.30

2 of 2 people found the following review helpful
5.0 out of 5 stars Superb book for effective use of data to drive information security, July 7, 2014
There is a not so fine line between data dashboards and other information displays that provide pretty but otherwise useless and unactionable information; and those that provide effective answers to key questions. Data-Driven Security: Analysis, Visualization and Dashboards is all about the later.

In this extremely valuable book, authors and noted experts Jay Jacobs and Bob Rudis bring their decades of experience to the reader and show you how to find security patterns in your data logs and extract enough information from it to create effective information security countermeasures. By using data correctly and truly understanding what that data means, the authors show how you can achieve much greater levels of security.

The book is meant for a serious reader who is willing to put in the time and effort to learn the programming necessary (mainly in Python and R) to truly understand what information exists deep in the recesses of their logs. As to R, it is a GNU project and a free software programming language and software environment for statistical computing and graphics. The R language is widely used among statisticians and data miners for developing statistical software and data analysis. For analysis the level of which Jacobs and Rudis prescribe, R is a godsend.

The following are the 12 densely packed chapters in the book:

1 : The Journey to Data-Driven Security
2 : Building Your Analytics Toolbox: A Primer on Using R and Python for Security Analysis
3 : Learning the "Hello World" of Security Data Analysis
4 : Performing Exploratory Security Data Analysis
5 : From Maps to Regression
6 : Visualizing Security Data
7 : Learning from Security Breaches
8 : Breaking Up with Your Relational Database
9 : Demystifying Machine Learning
10 : Designing Effective Security Dashboards
11 : Building Interactive Security Visualizations
12 : Moving Toward Data-Driven Security

After completing the book, the reader will have the ability to know which questions to ask to gain security insights, and use that data to ensure the overall security of their data and networks. Getting to that level is not a trivial at all a trivial task; even if there are vendors who can promise to do that.

For many people performing data analysis, the dependable Excel spreadsheet is their basic choice for data manipulation. The book calls the spreadsheet a gateway tool between a text editor and programming. The book notes that spreadsheets work as long as the data is not too large or complex. The book quotes a 2013 report to shareholders from J.P. Morgan in which parts of their 2012 $6 billion in losses was due in part to problems with their Excel spreadsheets.

The authors suggest using Excel as a temporary solution for quick one-shot tasks. For those that have repeating analytical tasks or models that are used repeatedly, it's best to move to some type of structured programming language, specifically those that the book suggest and for provides significant amounts of code examples.

The goal of all data extraction is to use data analysis to answer real questions. A large part of the book focuses on how to ask the right question. In chapter 1, the authors write that every good data analysis project begins with setting a goal and creating one or more research questions. Without a well-formed question guiding the analysis, you may wasting time and energy seeking convenient answers in the data, or worse, you may end up answering a question that nobody was asking in the first place.

The value of the book is that it shows the reader how to focus on context and purpose of the data analysis by setting the research question appropriately; rather than simply parsing large amounts of data. It's ultimately irrelevant if you can use Hadoop to process petabytes of data if you don't know what you are looking for.

Visualization is a large part of what this book is about, and in chapter 6 - Visualizing Security Data, the book notes that the most efficient path to human understanding is via the visual sense. It goes on to details the many advantages data visualization has, and the key to making it work.

As important as visualization is, describing the data is equally important. In chapter 7, the book introduces the VERIS (Vocabulary for Event Recording and Incident Sharing) framework. VERIS is a set of metrics designed to provide a common language for describing security incidents in a structured and repeatable manner. VERIS helps organizations collect useful incident-related information and to share that information, anonymously and responsibly with others.

The book shows how you can use dashboards for effective data visualization. But the authors warn that a dashboard is not an art show. They caution that given the graphical nature of dashboards, it's easy to fall into the trap of making them look like pieces of modern or fringe art; when they are far more akin to architectural and industrial diagrams that require more controlled, deliberate and constrained design.

The book uses the definition of dashboard according to Stephen Few, in that it's a "visual display of the most important information needed to achieve one or more objectives that has been consolidated in a single computer screen so it can be monitored at a glance". The book enables the reader to create dashboards like that.

Data-Driven Security: Analysis, Visualization and Dashboards is a superb book written by two experts who provide significant amounts of valuable information in every chapter. For those that are willing to put the time and effort into the serious amount of work that the book requires, they will find it a vital resource that will certainly help them achieve much higher levels of security.


Cyber Crime, Security and Digital Intelligence
Cyber Crime, Security and Digital Intelligence
by Mark Johnson
Edition: Hardcover
Price: $113.95
30 used & new from $71.34

1 of 1 people found the following review helpful
4.0 out of 5 stars Very good information security resource, June 30, 2014
Cyber Crime, Security and Digital Intelligence by Mark Johnson is a high-level introductory text to information security.

The books 12 chapters cover the following topics:

1. Threats to key sectors
2. Cyber security fundamentals
3. Cyber-attack fundamentals
4. Organized cyber attacks
5. Cloud risks
6. Web 2.0 risks
7. Cyber security threat actors
8. Common vulnerabilities
9. Cyber security control frameworks
10. Cyber security
11. Digital intelligence
12. The future of cyber security

The book focuses on how cybercrime has developed and is continuously evolving.

For those that want a good and thorough technical introduction to the topic, in a book that won't make you feel like a dummy, Cyber Crime, Security and Digital Intelligence is a good resource.


Security without Obscurity: A Guide to Confidentiality, Authentication, and Integrity
Security without Obscurity: A Guide to Confidentiality, Authentication, and Integrity
by Jeffrey James Stapleton
Edition: Hardcover
Price: $68.59
26 used & new from $59.49

3 of 4 people found the following review helpful
4.0 out of 5 stars Great guide to enterprise authentication from an expert, June 16, 2014
Having worked at the same consulting firm and also on a project with author J.J. Stapleton (yes, that was full disclosure); I knew he was a really smart guy. In Security without Obscurity: A Guide to Confidentiality, Authentication and Integrity, Stapleton shows how broad his security knowledge is to the world.

When it comes to the world of encryption and cryptography, Stapleton has had his hand in a lot of different cryptographic pies. He has been part of cryptographic accreditation committees for many different standard bodies across the globe. From ANSI, ISO, X9 and more.

The premise of the author and the need for the book is that the traditional information security CIA triad (confidentiality, integrity, availability) has led to the situation where authentication has to a large part gotten short shrift. This is a significant issue since much of information security is built around the need for strong and effective authentication. Without effective authentication, networks and data are at direct risk for compromise.

The topic itself is not exactly compelling (that is, unless you like to read standards such as ANSI X9.42-2003: Public Key Cryptography for the Financial Services Industry: Agreement of Symmetric Keys Using Discrete Logarithm Cryptography, ISO/IEC 9798-1:2010: Information technology -- Security techniques -- Entity authentication, etc.), so the book is more of a detailed technical reference. Those looking for a highly technical overview, interoperability guidance, and overall reference will find the book most rewarding.

For those who don’t have a general background on the topic of authentication and advanced security; it may be a book too deep and technical for those looking for something more in line of a CISSP preparation guide.

For those that want to know the deep underpinnings of how encryption algorithms work; they can simply read the RFC’s and standards themselves. What the book brings to the table are details about how to effectively implement the standards and algorithms in the enterprise; be it in applications, policies; or the specific procedures to meet compliance and standards requirements. And that is where Stapleton’s many decades of experience provide significant and inestimable value.

There are many reasons why authentication systems fail and many times it is due to interoperability issues. Stapleton details how to ensure to minimize those faults in order to achieve seamless authentication across multiple technologies and operating systems.

The 7 chapters cover a dense amount of information around the 3 core topics. The book is for the reader with a solid technical background. While it may be listed as an exploratory text, it is not like a For Dummies title.

As per its title, it covers confidentiality, authentication and integrity; in addition to other fundamental topics of non-repudiation, privacy and key management.

One of the ways Stapleton brings his broad experience to the book is in the many areas where he compares different types of cryptosystems, technologies and algorithms. This enables the reader to understand what the appropriate type of authentication is most beneficial for the specific requirement.

For example, in chapter 7, the book provides a really good comparison and summary of different cryptographic modules, including how they are linked to various standards from NIST, NSA, ANSI and ISO. It does the same for a comparison of cryptographic key strengths against various algorithms.

An interesting observation the book makes when discussing the DES encryption algorithm, is that all of the talk of the NSA placing backdoors in DES are essentially false. To date, no known flaws have been found against DES, and that after being around for over 30 years, the only attack against DES is an exhaustive key attack. This type of attack is where an adversary has to try each of the possible 72 quadrillion key (256 permutations – as the key is 56 bits long) until the right key is discovered.

That means that the backdoor rumors of the NSA shortening the length of the substitution ciphers (AKA s-boxes), was not to weaken it necessarily. Rather it was meant to block DES against specific types of cryptanalytic attacks.

While the book is tactical; the author does bring in one bit of trivia when he writes that the ISO, often known as the International Organization for Standardization, does not in truth realty stand for that. He notes that the organizations clearly states on its web page that because International Organization for Standardization would have different acronyms in different languages (IOS in English, OIN in French for Organisation internationale de normalization, etc.); its founders decided to give it the short form ISO. ISO is derived from the Greek isos, meaning equal. Whatever the country, whatever the language, the short form of the name is always ISO.

While Stapleton modifies the CIA triad, the book is not one of a security curmudgeon, rather of a security doyen. For anyone looking for an authoritative text on how to fully implement cross-platform security and authentication across the enterprise, Security without Obscurity: A Guide to Confidentiality, Authentication and Integrity is a valuable reference to get that job done.


The Rogatchover Gaon
The Rogatchover Gaon
by R. Dovber Schwartz
Edition: Paperback
Price: $22.14
6 used & new from $22.14

6 of 6 people found the following review helpful
5.0 out of 5 stars Remarkable book about a remarkable genius, June 8, 2014
This review is from: The Rogatchover Gaon (Paperback)
One of the most well-known characteristics of Rabbi Yosef Rosin, the Rogatchover Gaon, was his long hair. Ultimately, it is also one of the most meaningless traits of one of the greatest minds in the history of Jewish thought. Fortunately, in this fascinating biography of Rosin, author Dovber Schwartz spends a page on that fact, and leave the nearly 300 other pages to a mesmerizing overview of the Rogatchover’s methodology and worldview.

In chapter 2, Schwartz notes that as a means of conceptualizing halachic minutiae, the Rogatchover used 9 analytical frameworks to extract the core concepts from halachas. In the book, he provides an overview of 4 of the 9 frameworks.

Schwartz writes that the Rogatchover was one of the greatest rabbinic minds of the last 1,000 years. Yet 3 facts lead to his lack of overall prominence. Those are his extremely cryptic and terse writing style, that he did not have a Yeshiva, and his lack of direct students.

Contrast that with his contemporary Rabbi Chaim Soloveitchik, whose 6 main students in turn created myriad Yeshivas and other students.

The Rogatchover himself was a master of Talmud, all writings of Maimonides, and much more. This combined with his photographic memory and breathtaking analytical skills enabled him to show the complete unity of Torah. Schwartz provides many examples of his ability to connect many seemingly disassociated ideas and shows their symmetry.

Schwartz also provides scores of examples of seemingly Talmudic contradictions, and how the Rogatchover is able to easily reconcile them.

The book succeeds on numerous fronts. It provides and honest and respectable biography of the Rogatchover. More importantly, it shows how the Rogatchover was able to provide the equivalent of a unified field theory of all of Jewish thought.

Schwartz does a marvelous job of bringing the Rogatchover’s worldview to English speaking readers. Let’s hope he has much more to come.


Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions
Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions
by Slava Gomzin
Edition: Paperback
Price: $48.00
47 used & new from $18.55

6 of 7 people found the following review helpful
5.0 out of 5 stars Superb book with expert advice on POS, PCI and payment security, May 26, 2014
The only negative thing to say about Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions is its title. A cursory look at it may lead the reader that this is a book for a script kiddie, when it is in fact a necessary read for anyone involved with payment systems. The book provides a wealth of information that is completely pragmatic and actionable. The problem is, as the book notes in many places, that one is constantly patching a system that is inherently flawed and broken.

Often after a major information security breach incidents, a public official (always in front of cameras and with many serious looking people standing in the wings) will go on TV and say something akin to “we have to make sure this never happens again”.

Last year, Target and Neiman Marcus were the major victims. This month, it’s eBay. What next month will bring isn’t known, but it will be major. But after hundreds of millions of records breached, it’s not that anyone is saying it won’t happen again. Rather, it’s inevitable it will happen many more times.

There are a number of good books on PCI, but this is the first one that looks at the entire spectrum of credit card processing. Author Slava Gomzin is a security and payments technologist at HP and as clearly evident in the book, he lives and breathes payment technology and his expert knowledge is manifest in every chapter. His technical expertise is certain to make the reader much better informed and understand the myriad issues involved.

The book provides an excellent overview to the workings of payment systems and Gomzin is not shy about showing how insecure many payment systems are. Its 9 chapters provide a good combination of deep technical and general detail.

The reader comes out with a very good overview of how payment systems work and what the various parts of it are. For many people, this may be the first time they are made aware of entities such as processors, acquirers and gateways.

An interesting point the book raises is that it has been observed there are less breaches in Europe since they use EMV (also known as chip and pin) instead of insecure magnetic-stripe cards which are used in the US. This leads to a perception that EMV is by default much stronger. But the book notes that EMV was never designed to secure the cardholder data after the point of sale. The recent breaches at Target and Neiman Marcus were such that cardholder data was pilfered after it was in the system.

Another major weakness with EMV is it doesn't provide added security to web and online transactions. When a customer goes to a site and makes a transaction with an EMV card, it is fundamentally the same as if they would have used a magnetic stripe card. What many people don’t realize also is that EMV is not some new technology. It’s been around for a while. What it did was reduce the amount of fraud for physical use amongst European merchants. But the unintended consequence was that it simply moved the fraud online, where EMV is powerless.

As noted, the book provides the details and vulnerabilities of every aspect of the life of a payment card, including physical security. In chapter 4, he notes that there are numerous features that are supposed to distinguish between a genuine payment card from a counterfeited one. These include logo, embossed primary account number (PAN), card verification values and ultraviolet (UV) marks. Each one of them has their own set of limits. For the supposed security of UV marks, these are relatively easily replicated by a regular inkjet printer with UV ink.

In fact, Gomzin writes that all payment cards as they are in use today are insecure by design due to the fact that there are multiple physical security features that don’t provide adequate protection from theft, and that the sensitive cardholder data information is encoded on a magnetic strip in clear text.

Gomzin has numerous PCI certifications and with all that, doesn’t see PCI as the boon to payment card security as many do. He astutely observes that PCI places a somewhat myopic approach that data at rest is all that matters. Given that PCI doesn’t require payment software vendors or users to encrypt application configuration data, which is usually stored in plaintext and opened to uncontrolled modification; this can allow payment application to be compromised through misconfiguration.

Even with PCI, Gomzin shows that credit card numbers are rather predictable in that their number space is in truth rather small, even though they may be 15-19 digits in length. This is due to the fact that PCI allows the first 6 and last 4 digits to be exposed in plaintext, so it’s only 6 digits that need to be guessed. This enables a relatively easy brute force attack, and even easier if rainbow tables are used.

The Target breach was attributed to memory scraping and the book notes that as devastating an attack memory scraping is, there are no existing reliable security mechanisms that would prevent memory scraping.

The appendix includes a POS vulnerability rank calculator which can provide a quick and dirty risk assessment of the POS and associated payments application and hardware. The 20 questions in the calculator can’t replace a formal assessment. But the initial results would likely mimic what that formal assessment would enumerate.

So what will it take to fix the mess that POS and payment systems are in now? The book notes that the system has to be completely overhauled for POS security to truly work. He notes that point-to-point encryption is one of the best ways to do that. What is stopping that is the huge costs involved in redoing the payment infrastructure. But until then, breaches will be daily news.

Hacking Point of Sale: Payment Application Secrets, Threats, and Solutions is an invaluable resource that it highly relevant to a wide audience. Be it those in compliance, information security, development, research or in your payment security group. If you are involved with payment systems, this is a necessary book.

When an expert like Slava Gomzin writes, his words should be listened to. He knows that payment breaches are inevitable. But he also shows you how to potentially avoid that tidal wave of inevitability.


The CISSP companion handbook: A collection of tales, experiences and straight up fabrications fitted into the 10 CISSP domains of information security
The CISSP companion handbook: A collection of tales, experiences and straight up fabrications fitted into the 10 CISSP domains of information security
Price: $0.99

3 of 4 people found the following review helpful
4.0 out of 5 stars This is the book where irony, information security, CISSP and Bell–LaPadula meet, May 15, 2014
If you are looking for a formal vade mecum in your quest for CISSP certification, then The CISSP companion handbook: A collection of tales, experiences and straight up fabrications fitted into the 10 CISSP domains of information security by Javvad Malik should not be your reference guide.

But if you are looking for an entertaining and educational book to give a break to the monotonous work of CISSP preparation; this is your guide, and a very funny one at that. Even for those security gurus that have the treasured and adored CISSP certification (and all the more so for those with SANS certifications), the book is a witty look at the world of information security, and ones man’s observation of it.

What are Malik’s accomplishments? Well, he really knows information security and brings a lot of experience to the table. He won the RSA Social Security Blogger award for the most entertaining blogger, as well as the best security video blogger and most entertaining blog at the European Security Blogger Awards. The book is entertaining in the sense that he doesn’t drone on about information security abbreviations and acronyms.

When discussing TCP/IP, the book uses rock music as an analogy. Drums are TCP, an electric guitar is UDP; vocals are IP, with the band manager as ARP and the record label are RARP. While those analogies certainly won’t help you pass the test; they will definitely give you a more realistic understanding of what the protocols really do.

No CISSP guide would be complete without a reference to the Bell-LaPadula model, which the book mentions on page 107. The book doesn’t really define it, but notes that it may be used and implemented in pencil pushing governmental departments.

As an aside, I once worked with a really smart guy who once worked with Len LaPadula at Bell Labs. He couldn’t tell me what the model was either. But he did note that most people mispronounced his name as La-pa-doo-la. When Dr. LaPadula himself pronounced it as le-pad-you-lah.

In movies such as Cars, much of the humor is lost on the children, while the adults will laugh. This book is very much like that in the sense that those have been in the industry for a while will get the humor and irony Malik’s writing. In Domain 3: Information Security Governance & Risk Management, he writes that if you do things just because they are best practices, you end up becoming an auditor, and notes that nobody likes an auditor. In the footnote, he clarifies hat despite the sweeping generalization, there are some good and effective auditors in existence… a few. Only those who have been in information security for a while can appreciate the humor there.

The book is only available for the Kindle, and at 99 cents, that comes out to less than 10 cents per CBK domain. Note that in the book, he never defines what CBK stands for, which would leave a CISSP candidate grasping in horror for an acronym without a definition.

When it comes to pure CISSP guides, a best practice is to use the CISSP All-in-One Exam Guide by Shon Harris, all 1,500 pages of it.

If you want the funniest and cheapest and downright educational guide around, nothing beats The CISSP companion handbook: A collection of tales, experiences and straight up fabrications fitted into the 10 CISSP domains of information security.


Page: 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11-20