Slashdot Mirror
Book Review: Social Engineering: The Art of Human Hacking
brothke writes "One can sum up all of Social Engineering: The Art of Human Hacking in two sentences from page 297, where author Christopher Hadnagy writes 'tools are an important aspect of social engineering, but they do not make the social engineer. A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable.' Far too many people think that information security and data protection is simply about running tools, without understanding how to use them. In this tremendous book, Hadnagy shows how crucial the human element is within information security." Keep reading for the rest of Ben's review.
Social Engineering: The Art of Human Hacking
author
Christopher Hadnagy
pages
408
publisher
Wiley
rating
10/10
reviewer
Ben Rothke
ISBN
0470639539
summary
Definitive text on social engineering
With that, Social Engineering: The Art of Human Hacking is a fascinating and engrossing book on an important topic. The author takes the reader on a vast journey of the many aspects of social engineering. Since social engineering is such a people oriented topic, a large part of the book is dedicated to sociological and psychological topics. This is an important area, as far too many technology books focus on the hardware and software elements, completely ignoring the people element. The social engineer can then use that gap to their advantage.
By the time that you start chapter 2 on page 23, it is abundantly clear that the author knows what he is talking about. This is in stark contrast with How To Become The Worlds No. 1 Hacker, where that author uses plagiarism to try to weave a tale of being the world’s greatest security expert. Here, Hadnagy uses his real knowledge and experience to take the reader on a long and engaging ride on the subject. Coming in at 9 chapters and 360 pages, the author brings an encyclopedic knowledge and dishes it out in every chapter.
Two of the most popular books to date on social engineering to date have been Kevin Mitnick’s The Art of Deception: Controlling the Human Element of Security and The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers. The difference between those books and Hadnagy, is that Mitnick for the most part details the events and stories around the attacks; while Hadnagy details the myriad specifics on how to carry out the social engineering attack.
The book digs deep and details how the social engineer needs to use a formal context for the attack, and breaks down the specific details and line-items on how to execute on that. That approach is much more suited to performing social engineering, than simply reading about social engineering.
Chapter 1 goes though the necessary introduction to the topic, with chapter 2 detailing the various aspects of information gathering. Once I started reading, it was hard to put the book down.
Social engineering is often misportrayed as the art of asking a question or two and then gaining root access. In chapter 3 on elicitation, the author details the reality of the requirements on how to carefully and cautiously elicit information from the target. Elicitation is not something for the social engineer alone, even the US Department of Homeland Security has a pamphlet(Pdf) that is uses to assist agents with elicitation.
After elicitation, chapter 4 details the art of pretexting, which is when an attacker creates an invented scenario to use to extract information from the victim.
Chapter 5 on mind tricks starts getting into the psychological element of social engineering. The author details topics such as micro expressions, modes of thinking, interrogation, neuro-linguistic programming and more.
Chapter 6 is on influence and the power of persuasion. The author notes that people are trained from a young age in nearly every culture to listen to and respect authority. When the social engineer takes on that role, it becomes a most powerful tool; far more powerful than any script or piece of software.
The author wisely waits until chapter 7 to discuss software tools used during a social engineering engagement. One of the author’s favorite and most powerful tools is Maltego, which is an open source intelligence and forensics application. While the author concludes that it is the human element that is the most powerful, and that a great tool in the hand of a novice is worthless; the other side is that good tools (of which the author lists many), in the hands of an experienced social engineer, is an extremely powerful and often overwhelming combination.
Every chapter in the book is superb, but chapter 9 – Prevention and Mitigation stands out. After spending 338 pages about how to use social engineering; chapter 9 details the steps a firm must put in place to ensure they do not become a victim of a social engineering attack. The chapter lists the following six steps that must be executed upon:
Learning to identify social engineering attacks
Creating a personal security awareness program
Creating awareness of the value of the information that is being sought by social engineers
Keeping software updated
Developing scripts
Learning from social engineering audits
The author astutely notes that security awareness is not about 45- or 90-minute programs that only occur annually; rather it is about creating a culture and set of information security standards that each person in the organization is committed to using their entire life. This is definitely not a small undertaking. Firms must create awareness and security engineering programs to deal with the above six items. If they do not, they are them placing themselves at significant risk of being unable to effectively deal with social network attacks.
As to awareness, if nothing else, Social Engineering: The Art of Human Hacking demonstrates the importance of ensuring that social engineering is an integral part of an information security awareness program. This can’t be underemphasized as even the definitive book on security awareness Managing an Information Security and Privacy Awareness and Training Program only has about 10 pages on social engineering attacks.
There are plenty of security books on hardware, software, certification and more. Those were perhaps the easy ones to write. Until now, very few have dealt with the human element, and the costs associated with ignoring that have been devastating. Social Engineering: The Art of Human Hacking is a book that is a long time in coming, but worth every page.
While seemingly geared to the information security staff, this is a book should be read by everyone, whether they are in technology or not. Social engineering is not something that just occurs behind a keyboard. Social attackers know that. It is about time everyone else did also.
Reviewer Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know
You can purchase Social Engineering: The Art of Human Hacking from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
By the time that you start chapter 2 on page 23, it is abundantly clear that the author knows what he is talking about. This is in stark contrast with How To Become The Worlds No. 1 Hacker, where that author uses plagiarism to try to weave a tale of being the world’s greatest security expert. Here, Hadnagy uses his real knowledge and experience to take the reader on a long and engaging ride on the subject. Coming in at 9 chapters and 360 pages, the author brings an encyclopedic knowledge and dishes it out in every chapter.
Two of the most popular books to date on social engineering to date have been Kevin Mitnick’s The Art of Deception: Controlling the Human Element of Security and The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers. The difference between those books and Hadnagy, is that Mitnick for the most part details the events and stories around the attacks; while Hadnagy details the myriad specifics on how to carry out the social engineering attack.
The book digs deep and details how the social engineer needs to use a formal context for the attack, and breaks down the specific details and line-items on how to execute on that. That approach is much more suited to performing social engineering, than simply reading about social engineering.
Chapter 1 goes though the necessary introduction to the topic, with chapter 2 detailing the various aspects of information gathering. Once I started reading, it was hard to put the book down.
Social engineering is often misportrayed as the art of asking a question or two and then gaining root access. In chapter 3 on elicitation, the author details the reality of the requirements on how to carefully and cautiously elicit information from the target. Elicitation is not something for the social engineer alone, even the US Department of Homeland Security has a pamphlet(Pdf) that is uses to assist agents with elicitation.
After elicitation, chapter 4 details the art of pretexting, which is when an attacker creates an invented scenario to use to extract information from the victim.
Chapter 5 on mind tricks starts getting into the psychological element of social engineering. The author details topics such as micro expressions, modes of thinking, interrogation, neuro-linguistic programming and more.
Chapter 6 is on influence and the power of persuasion. The author notes that people are trained from a young age in nearly every culture to listen to and respect authority. When the social engineer takes on that role, it becomes a most powerful tool; far more powerful than any script or piece of software.
The author wisely waits until chapter 7 to discuss software tools used during a social engineering engagement. One of the author’s favorite and most powerful tools is Maltego, which is an open source intelligence and forensics application. While the author concludes that it is the human element that is the most powerful, and that a great tool in the hand of a novice is worthless; the other side is that good tools (of which the author lists many), in the hands of an experienced social engineer, is an extremely powerful and often overwhelming combination.
Every chapter in the book is superb, but chapter 9 – Prevention and Mitigation stands out. After spending 338 pages about how to use social engineering; chapter 9 details the steps a firm must put in place to ensure they do not become a victim of a social engineering attack. The chapter lists the following six steps that must be executed upon:
Learning to identify social engineering attacks
Creating a personal security awareness program
Creating awareness of the value of the information that is being sought by social engineers
Keeping software updated
Developing scripts
Learning from social engineering audits
The author astutely notes that security awareness is not about 45- or 90-minute programs that only occur annually; rather it is about creating a culture and set of information security standards that each person in the organization is committed to using their entire life. This is definitely not a small undertaking. Firms must create awareness and security engineering programs to deal with the above six items. If they do not, they are them placing themselves at significant risk of being unable to effectively deal with social network attacks.
As to awareness, if nothing else, Social Engineering: The Art of Human Hacking demonstrates the importance of ensuring that social engineering is an integral part of an information security awareness program. This can’t be underemphasized as even the definitive book on security awareness Managing an Information Security and Privacy Awareness and Training Program only has about 10 pages on social engineering attacks.
There are plenty of security books on hardware, software, certification and more. Those were perhaps the easy ones to write. Until now, very few have dealt with the human element, and the costs associated with ignoring that have been devastating. Social Engineering: The Art of Human Hacking is a book that is a long time in coming, but worth every page.
While seemingly geared to the information security staff, this is a book should be read by everyone, whether they are in technology or not. Social engineering is not something that just occurs behind a keyboard. Social attackers know that. It is about time everyone else did also.
Reviewer Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know
You can purchase Social Engineering: The Art of Human Hacking from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
I'm pretty social engineer myself.
Buy my book.
Agree with the author completely. In order to eliminate the vulnerabilities arising out of the human factor, we have instituted the following password guidelines:
Password Security Guidelines V2.2b
Due to new security policies, the following guidelines have been issued to assist in choosing new passwords. Please follow them closely.
Passwords must conform to at least 12 of the following attributes.
1. Minimum length 12 characters.
2. Must contain both upper and lower case characters as well as at least 2 numbers.
3. Not in any dictionary.
4. No word or phrase bearing any connection to the holder.
5. Containing no characters in the ASCII character set.
6. Must be quantum theoretically secure, i.e. must automatically change if observed (to protect against net sniffing).
7. Binary representation must not contain any of the sequences 00 01 10 11, commonly known about in hacker circles.
8. Changed prior to every use.
9. Contain tissue samples of at least 3 vital organs.
10. Undecodable by virtue of application of 0-way hash function.
11. Contain non-linear random S-boxes (without a backdoor).
It works! We haven't had any login attempts into our systems - legitimate or otherwise.
..."swindling". It is not new.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Second!
It seems like a rehash of every security book to come before it. I feel like i'm practically lip-syncing Kevin Mitnick's book "the art of deception".
If Kevin Mitnick didn't write this book, then I am not reading it.
Didn't Mitnick do this 8 years ago with Art of Deception. Even the title is sort of stolen. Is there anything new in here that hasn't already been written about by one of the world's greatest social engineers?
Good thing I always have my social firewall up....of course this mostly means not looking at anyone and mumbling and running away whenever someone talks to me.
A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable
Was this just a polite way ti say "most people are total tools?"
Someone had to do it.
...a social engineering scheme to make people buy the book?
There's no -1 for "I don't get it."
I am curious as to what the reviewer means by "social network" attacks though. (New term for me)
-DeAngelo
CheerThis -hassle free sharing with NO login and infinite voting
SheenNation - hassle free sharing Sheen! (no login and infinite voting)
Braincano
If you get a moment, check out my blog Braincano
Yo Mr Engineer, I'm really happy for you, and imma let you finish, but Surgeons are the best human hackers evar.
A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable.
Wow! Two content-less marketing terms in one sentence. But they look so sad and lonely without "synergy" there beside them.
Microsoft is to software what Budweiser is to beer.
So i was picking out some books to read (pleasure and reference) and this one caught my eye....tech books are so expensive that the stack I had picked out cost more than a Nook. Made a deal with the Nook dude to sell me one with a gift card and got the Nook and most of the books i picked out digitally for almost same price. Random comment i know but this is the book that caused it, I havent finished it yet but i give a +1 to this review, very well written so far.
Those interested in social engineering might also want to read chapter 5 of my book High-Assurance Design (website at http://www.assuredbydesign.com/haa/). It contains a complete taxonomy of social engineering techniques and compares them to commonly known "con schemes" (e.g., "pigeon drop", "Spanish prisoner", "pump-and-dump"....) Chapter 5 happens to be available as a complementary download here: http://www.assuredbydesign.com/haa/chs/Berg_ch05.pdf
"The Art of Human Hacking"
Jack the Ripper and Jeffrey Dahmer would definitely be interested!
Oh, please. Save that bullshit for frat boys who think that saying "penetrating" often enough will get them laid.
Great book and great reference. It covers a wide range of topics and is very clear about each of them. Provides great example situations, real case studies, and ways to defend against SE attacks. Would recommend it to anyone!
Dude if you can sum up the whole book by two sentences on p. 297, it kind of doesn't sound like it's worth buying.
that's why its called a spoiler :)
Will this help me get root privileges on my sexy neighbor?
As I said before. http://slashdot.org/comments.pl?sid=1177241&cid=27351843
In GOD we trust, all others we monitor.
From the title I thought this discussion was going to be about Jeffery Dahmer.
Well I enjoyed it. Curious about the book now.
"that is uses "
It looks like you were typing in the passive voice (initial sentence fragment was probably "that is used"), made a passive verb active to get rid of the passive voice in your writing (a noble goal!) but forgot to remove the 'is.'
Can someone fix that?
otherwise, it sounds quite interesting, though I wonder how far Hadnagy goes into NLP and if the book provides any examples in the context of social engineering. Most of those techniques need to be executed in person, and exposing your face can be a risk.
In the future, I would want to not be isolated from my friends in the Space Station.
It will be interesting to see what effect this has on customer service generally. Is it possible to have sensible, non-theatrical security procedures that are preliminary and don't interfere with an essentially friendly relationship? Or will the attitude of security consciousness turn into a strange form of paranoid bureaucracy that colors everything?
If you had perhaps a smaller # you might realize that what you
are doing here will actually have a net negative effect.
In this community, the merits of the book will be all that is /.rs here will not
necessary. All the bloating and bellowing by
affect the sales. Shilling, will.
-@|