Art of Deception or The Buffalo Creek Disaster

Art of Deception: Controlling the Human Element of Security

Author: Kevin D Mitnick

The world's most infamous hacker offers an insider's view of the low-tech threats to high-tech security Kevin Mitnick's exploits as a cyber-desperado and fugitive form one of the most exhaustive FBI manhunts in history and have spawned dozens of articles, books, films, and documentaries. Since his release from federal prison, in 1998, Mitnick has turned his life around and established himself as one of the most sought-after computer security experts worldwide. Now, in The Art of Deception, the world's most notorious hacker gives new meaning to the old adage, "It takes a thief to catch a thief."
Focusing on the human factors involved with information security, Mitnick explains why all the firewalls and encryption protocols in the world will never be enough to stop a savvy grifter intent on rifling a corporate database or an irate employee determined to crash a system. With the help of many fascinating true stories of successful attacks on business and government, he illustrates just how susceptible even the most locked-down information systems are to a slick con artist impersonating an IRS agent. Narrating from the points of view of both the attacker and the victims, he explains why each attack was so successful and how it could have been prevented in an engaging and highly readable style reminiscent of a true-crime novel. And, perhaps most importantly, Mitnick offers advice for preventing these types of social engineering hacks through security protocols, training programs, and manuals that address the human element of security.

Wired Magazine

He was the FBI's most-wanted hacker. But in his own eyes, Mitnick was simply a small-time con artist with an incredible memory, a knack for social engineering, and an enemy at The New York Times. That foe, John Markoff, made big bucks selling two books about Mitnick -- without ever interviewing him. This is Mitnick's account, complete with advice for how to protect yourself from similar attacks. I believe his story.

Stephen Manes - Forbes

Finally someone is on to the real cause of data security breaches--stupid humans. Notorious hacker Kevin Mit-nick--released from federal prison in January 2000 and still on probation--reveals clever tricks of the "social engineer-ing" trade and shows how to fend them off in The Art of Deception: Controlling the Human Element of Security (Wiley, $27.50).

Most of the book, coauthored by William Simon (not the one running for governor of California), is a series of fictional episodes depicting the many breathtakingly clever ways that hackers can dupe trusting souls into breaching corporate and personal security--information as simple as an unlisted phone number or as complicated as plans for a top-secret product under development. The rest lays out a fairly draconian plan of action for companies that want to strengthen their defenses. Takeaway: You can put all the technology you want around critical information, but all it takes to break through is one dolt who gives up his password to a "colleague" who claims to be working from the Peoria office.

What's useful about this book is its explanation of risks in seemingly innocuous systems few people think about. The caller ID notification that proves you're talking to a top executive of your firm? Easily forged. The password your assistant logs in with? Easily guessed. The memos you tossinto the cheap office shredder? Easily reconstructed. The extension that you call in the IT department? Easily forwarded.

Physical security can be compromised, too. It's not hard to gain access to a building by "piggybacking" your way in the door amid the happy throng returning from lunch. You'd better have confidence in your IT professionals,because they're likely to have access to everything on the corporate system, including your salary and personal informa-tion. Mitnick offers some ideas for plugging these holes, like color-coded ID cards with really big photos.

Implementing the book's security action plan in full seems impossible, but it's a good idea to warn employees from the boss down to the receptionist and janitors not to give out even innocuous information to people claiming to be helpful IT folks without confirming their identity--and to use things like encryption technology as fallbacks. Plenty of would-be Mitnicks--and worse--still ply their trade in spaces cyber and psychological.

Publishers Weekly

Mitnick is the most famous computer hacker in the world. Since his first arrest in 1981, at age 17, he has spent nearly half his adult life either in prison or as a fugitive. He has been the subject of three books and his alleged 1982 hack into NORAD inspired the movie War Games. Since his plea-bargain release in 2000, he says he has reformed and is devoting his talents to helping computer security. It's not clear whether this book is a means toward that end or a, wink-wink, fictionalized account of his exploits, with his name changed to protect his parole terms. Either way, it's a tour de force, a series of tales of how some old-fashioned blarney and high-tech skills can pry any information from anyone. As entertainment, it's like reading the climaxes of a dozen complex thrillers, one after the other. As a security education, it's a great series of cautionary tales; however, the advice to employees not to give anyone their passwords is bland compared to the depth and energy of Mitnick's descriptions of how he actually hacked into systems. As a manual for a would-be hacker, it's dated and nonspecific better stuff is available on the Internet but it teaches the timeless spirit of the hack. Between the lines, a portrait emerges of the old-fashioned hacker stereotype: a socially challenged, obsessive loser addicted to an intoxicating sense of power that comes only from stalking and spying. (Oct.) Forecast: Mitnick's notoriety and his well-written, entertaining stories should generate positive word-of-mouth. With the double appeal of a true-crime memoir and a manual for computer security, this book will enjoy good sales. Copyright 2002 Cahners Business Information.

Library Journal

The world's most famous computer hacker and cybercult hero, once the subject of a massive FBI manhunt for computer fraud, has written a blueprint for system security based on his own experiences. Mitnick, who was released from federal prison in 1998 after serving a 22-month term, explains that unauthorized intrusion into computer networks is not limited to exploiting security holes in hardware and software. He focuses instead on a common hacker technique known as social engineering in which a cybercriminal deceives an individual into providing key information rather than trying to use technology to reveal it. Mitnick illustrates the tactics comprising this "art of deception" through actual case studies, showing that even state-of-the-art security software can't protect businesses from the dangers of human error. With Mitnick's recommended security policies, readers gain the information their organizations need to detect and ward off the threat of social engineering. Required reading for IT professionals, this book is highly recommended for public, academic, and corporate libraries. [This should not be confused with Ridley Pearson's new thriller, The Art of Deception. Ed.] Joe Accardi, William Rainey Harper Coll. Lib., Palatine, IL

Table of Contents:

	Foreword	vii
	Preface	ix
	Introduction	xv
Part 1	Behind the Scenes	1
Chapter 1	Security's Weakest Link	3
Part 2	The Art of the Attacker	13
Chapter 2	When Innocuous Information Isn't	15
Chapter 3	The Direct Attack: Just Asking for It	31
Chapter 4	Building Trust	41
Chapter 5	"Let Me Help You"	55
Chapter 6	"Can You Help Me?"	77
Chapter 7	Phony Sites and Dangerous Attachments	93
Chapter 8	Using Sympathy, Guilt, and Intimidation	105
Chapter 9	The Reverse Sting	133
Part 3	Intruder Alert	147
Chapter 10	Entering the Premises	149
Chapter 11	Combining Technology and Social Engineering	173
Chapter 12	Attacks on the Entry-Level Employee	195
Chapter 13	Clever Cons	209
Chapter 14	Industrial Espionage	225
Part 4	Raising the Bar	243
Chapter 15	Information Security Awareness and Training	245
Chapter 16	Recommended Corporate Information Security Policies	259
	Security at a Glance	331
	Sources	339
	Acknowledgments	341
	Index	347

Interesting book: Recovery from Compulsive Eating or Group Psychotherapy with Addicted Populations

The Buffalo Creek Disaster: The Story of the Surviviors' Unprecedented Lawsuit

Author: Gerald M Stern

One Saturday morning in February 1972, an impoundment dam owned by the Pittston Coal Company burst, sending a 130 million gallon, 25 foot tidal wave of water, sludge, and debris crashing into southern West Virginia's Buffalo Creek hollow. It was one of the deadliest floods in U.S. history. 125 people were killed instantly, more than 1,000 were injured, and over 4,000 were suddenly homeless. Instead of accepting the small settlements offered by the coal company's insurance offices, a few hundred of the survivors banded together to sue. This is the story of their triumph over incredible odds and corporate irresponsibility, as told by Gerald M. Stern, who as a young lawyer and took on the case and won.