This week I read Spies Among Us: How to Stop the Spies, Terrorists, Hackers, and Criminals You Don’t Even Know You Encounter Every Day, which incidentally wins the award for longest book title so far this year. It’s a nonfiction spy book. And yes, maybe I am on something of an espionage kick right now.
I remember reading Spies Among Us a few years ago and really liking it. It’s designed to help businesses and every day people secure themselves from crime and corporate espionage. The book is divided into three sections. In the first, author Ira Winkler draws parallels between the ways spies compromise government secrets (like troop movements), the ways industrial spies compromise corporate secrets (like an upcoming product spec), and the ways criminals compromise personal information (like your credit card information).
The second section is case studies. Winkler works as a penetration tester, so his job is to break into companies and steal their information. He then shows the company (who had hired him beforehand) exactly how he got in and what information he was able to obtain without their knowledge. The last section describes countermeasures that people and companies can use to protect themselves.
In the first section, Winkler points out a lot of vulnerabilities that people and companies leave themselves exposed to both online and offline. Things like phishing, not shredding documents, and not updating their virus software. This whole section was well laid out, but I felt like the information was all very well known and common knowledge. Then again, he gives one example of criminal charges against the former head of the CIA when he let his children play on his work laptop, so maybe these vulnerabilities aren’t so common knowledge after all.
The second section, the case studies, was great. It’s a lot of fun to read about how Winkler fakes ID badges, conducts surveillance, steals information, and in one instance simulates a terrorist attack. Winkler’s may not be as suave as James Bond, but he probably does more actual spying. At the end of each case study, Winkler breaks down exactly the vulnerabilities he exploited so that we can learn from these companies’ mistakes. What’s incredible is that a lot of times the security staff weren’t even trying. He’s constantly able to walk past them with no credentials better than a smile. Other times, the company has very lax security policies that let him log into computers or shuffle through unattended filing cabinets.
The last section is Winkler’s advice on how to close the vulnerabilities he’s outlined. This section was the weakest. This book was written in 2005, and it shows. Especially when it comes to computer advice, although the attacks have remained the same (spam emails, viruses, spyware), the tools and the market have changed a lot. He gives other, operational, countermeasures, although if you read the first section closely you would already know all of that information.
Overall, this book is great for the first two sections, and for the last one it’s forgettable. Honestly, this book is worth it just for the case studies, because those are just fun reading.
See the full list of books that I’ve read for this project here.
Leave a Reply