Tag Archive for: Security Book Review

You are here: / Security Book Review

Posts

A Book Review of Mobile Security: How to Secure, Privatize, and Recover Your Device

The “Mobile Security: How to Secure, Privatize, and Recover Your Devices” by Tim Speed, Joseph Anderson, Darla Nykamp, Jaya Nampalli and Mari Heiser, published by Packt Publishing contains an abundance of information pertaining to the threats mobile devices are susceptible to as well as providing guidelines on how protect them from the assorted threats.

The book provides a blue print that can be used by information security practitioners in charge of protecting mobile devices as well as others seeking to better understand the mobile security landscape.

The table of contents represents an orderly and organized method to learning the subjects in the book.  The book begins with introductory topics and builds to more advance concepts and practices in later chapters.  The body of the book consists of eight chapters and an appendix section.  Each chapter in the book ends with a chapter summary recapping the main topics.

Chapters 1 through 4 presented a great introduction to the book as well as some key matters and definitions that were useful and used in later chapters.  Chapter 1: Living in a Mobile World (Chapter 1), Users and Mobile Device Management (Chapter 2), Privacy – Small Word, Big Consequences (Chapter 3) and Mobile and Social – the Threats You Should _Know About (Chapter 4).  While these chapters covered certain basic operational and security concepts, the information was comprehensive enough to educate and inform even mobile security professionals in the industry.  I found the use of figures, diagrams and screenshots to be extremely effective as well as the web links in those chapters.

In chapter 5, “Protecting Your Mobile Devices” the authors offered protective measures from the earlier threats discussed against mobile devices.  They offered recommendations on how to reduce the likelihood of your device or devices you are charged with protecting from being compromised.  In addition, the authors also discussed protective controls such as using strong authentication practices, encryption and antiviruses, which are often overlooked as additional elements.  Lastly, instructions are provided in the unfortunate situation were to occur if the mobile device were to get hack.

Chapter 6 “Support and Warranty Insurance” as well as Chapter 7: “Baby Boomers, Teens, and Tweens” took an alternate depiction pertaining to mobile security.  In chapter 6, the author provided a story titled “Toby’s Story” which touches on BYOD (Bring Your Own Devices) and the issues pertaining to that matter.  They also explained some key information as it relates to customer service, technical support, service level agreements and warranties in the mobile space.  The information was very enlightened and I learned some fascinating concepts that would be very useful.  In chapter 7, the authors discussed topics pertaining to the different generations using mobile devices and some of the operational, safety and security issues encompassed.

Finally in chapter 8 “Getting Your Life Back After You’ve Been Hacked”, provided the readers with some guidelines to bet back to production status after a mobile device has been hacked.  The topics expressed by the authors focused on, understanding the different variations of being hacked, such as a device hack or a profile hack.  In addition, an informative explanation on device wiping was also presented in the chapter offering valuable information on when or if it should occur.

The Appendices also provided some additional information the reader should be able to build on.  The topics were as followed below:

Appendix A: IBM Notes Traveler

Appendix B: Mobile Device Management

Appendix C: Tips to Help You Protect Your Mobile Device

Appendix D: Mobile Acceptable Use Policy Template

Appendix E: The History of Social Networking, the Internet, _and Smartphones

The author’s coverage of the book was comprehensive for both the technical and non-technical individual.  In addition, the information would serve useful in a personal capacity as well as in the business environment.  It was written in a manner suitable for a novice interested in the mobile security field, to the seasoned mobile security practitioner trying to obtain additional information.  This book is a contribution to the information security community and will likely aid in producing knowledgeable information security practitioners in the future.  I personally enjoyed topics pertaining to the threats mobile devices faced by attackers.

The book is available online and can be purchased at Packt Publishing website here.

References

Tim Speed, Joseph Anderson, Darla Nykamp, Jaya Nampalli and Mari Heiser (2013). Mobile Security: How to Secure, Privatize, and Recover Your Devices. Packt Publishing

A Review of CEH Certified Ethical Hacker Study Guide by Kimberly Graves

The “Certified Ethical Hacker: Study Guide” by Kimberly Graves have gained considerable attention and popularity in recent years in response to the need for professional information security practitioners to increase their awareness in the techniques, tools and motives used by hackers.  In doing so, the information security practitioner will understand what is needed to implement better protection for the corporate networks.  The book has been used for more than just a tool to obtain the Certified Ethical Hacker (CEH) certification administered by EC-Council, but as knowledge source to better understand networking concepts, computer operating systems, hacking tools and hacking concepts.  Graves has aided the information security community by releasing “Certified Ethical Hacker: Study Guide.”  This book is the key to protecting the infrastructure and according to the author, “By learning the same skills and employing the software tools used by hackers, you will be able to defend your computer networks and systems against malicious attacks.”

The table of contents depicts an orderly and organized method to learning the subjects in the book.  The book begins with introductory topics and builds to more advance concepts and techniques in later chapters.  I appreciated the details provided in the table of content and how it served as an outline to perform penetration testing.  In reviewing the list of detailed topics per chapter, it provided insight of the organizational structure and the progression of the book.

The body of the book consists of fifteen chapters, an appendix and glossary.  Each chapter ends with a chapter summary, exam essentials, review questions and the answers to the review questions.  I found the review questions to be extremely useful by testing my knowledge of key concepts in each chapter.

Chapters 1 through 3 offered a great introduction to the book as well as some key issues and definitions used in later chapters.  Introduction to ethical hacking, ethics and legality (Chapter 1), gathering target information (Chapter 2) and gathering network and host information (Chapter 3).  Although these chapters covered basic material, most readers including advance security professionals should find them useful as a refresher.  I found the use of figures, diagrams and screenshots to be extremely effective in those chapters.

Chapters 4 through 7 discussed typical hacking attacks that are performed by hackers. System hacking (Chapter 4), Trojan, backdoors, viruses and worms (Chapter 5), gathering data from networks (Chapter 6) and denial of service and session hijacking (Chapter 7).  The author covered key topics by providing definitions, concepts, tools and techniques on how to use the various hacking tools, then provided details on how to detect and protect against the attack implemented by those same tools.

Chapters 8 through 11 discussed additional hacking techniques that were less typical but common amongst hackers. These chapters encompassed hacking material relating to web hacking (Chapter 8), attacking applications (Chapter 9) and wireless network hacking (Chapter 10).  In addition, the author also discussed non-technical attacks to physical site security (Chapter 11).  I found these chapters to be very detailed in its content and found (Chapter 11) physical site security to be very informative due to the lack of concern often placed on the location where information security functions are being performed.

The final four chapters covered advanced and evasive hacking techniques.  Hacking Linux systems (Chapter 12), bypassing network security (Chapter 13), cryptography (Chapter 14) and finally performing penetration test (Chapter 15).  Many of the concepts from earlier chapters came into play on (chapter 15) performing a penetration test.  Graves discussed the penetration testing steps that consist of the pre-attack phase, the attack phase and the post-attack phase.  The subjects discussed in earlier chapters set the stage to successfully implement the penetration testing steps successfully.

Graves’ coverage of the subjects in Certified Ethical Hacker: Study Guide went far beyond a book to aid a person obtain a certification.  It was written in a manner suitable for a novice interested in the information security field, to the seasoned information security practitioner trying to obtain additional information to assist in the protective and detective posture of the corporate network.  This book is an important contribution to the information security community and will likely aid in producing knowledgeable information security practitioners in the future.

References

Graves, K. (2010). Certified Ethical Hacker: Study Guide. Wiley Publishing, Inc. Indianapolis, Indiana