27-11draft

Reviewing
Books for professionals
GUN violence and what to do about it:
Hacking the Hacker: Learn
From the Experts Who Take
Down Hackers, by Roger
Grimes. Published 2017
by Wiley, ISBN 978-1-
119-39621-5, 320 pages,
paperback, £20.99. Visit
eu.wiley.com.
These reviews in full, and
others, are on the ‘reviews’
part of our website.
62
UNHAPPY
‘People’s personal data
is protected by law and
employees should not
be helping themselves
to information if they
decide to set up a new
business or move to a
new position.’
Head of ICO Enforcement
Steve Eckersley.
A land of
rampages
and victims
How did you react to the recent news
of the mass shooting in Las Vegas,
writes Mark Rowe.
Did it shock, or leave you
fatigued; despite the dozens
dead and hundreds injured,
you had heard it before, and will do
again, from the United States? Just
as the debate between reformers and
the pro-gun lobby standing on their
rights does not change. An insightful
American book on this topic is
Rampage Nation, by Louis Klarevas.
It begins with the author telling how,
on holiday on a Greek island, he
witnessed a shooter; and (when the
shooter returned to the village square
hours later for a second go) helped
to pacify him. That sets the tone for
the book; ‘mass shootings are just
as much a threat to the American
public as are terrorist attacks’. The
author, though an academic, isn’t
just sounding off morally; he has
been through it (and describes the
experience, vividly).
For the US
You could argue that gun ownership
is an issue only for the US, not
Britain. In the US, their guardforces
at universities for instance look
like police and their police (thanks
to second-hand kit from the Iraq
War) look like an army. Imagine the
London Bridge terror attack of June,
if the terrorists had carried not knives
but semi-automatic rifles. As the
book came out last year, it does not
cover the most recent shootings as in
Orlando. Briefly, he argues that new
laws, policies, to control guns would
make a difference; as having guns tips
the mentally unstable into going on
killing sprees. As in his own Greek
case, and Las Vegas and so many
others, the rampages are not lunatic
but lengthy and planned. Klarevas
gets down to practicalities; his Greek
gunman ‘only’ had a shotgun; if
NOVEMBER 2017 PROFESSIONAL SECURITY
he’d had a higher-powered weapon,
Klarevas and others probably would
have been shot dead. Or as a chapter
heading puts it, ‘Guns kill, some
more than others’. The US is the
‘rampage nation’, Americans are (as
Klarevas was once) ‘sitting ducks’,
thanks to what the author terms a
‘three-pronged calculus of unstable
perpetrators, vulnerable targets, lethal
weapons’. The problem, he argues is
growing, and - where this book speaks
most directly to private security
people - emotionally disturbed
people allowed to own guns are able
to carry those weapons, in the case
of Las Vegas into a hotel. Klarevas
writes powerfully of the split-second
decisions that victims take. p
Rampage Nation: Securing America
from Mass Shootings, by Louis Klarevas.
Published 2016 by Prometheus Books, 340
pages. Visit www.prometheusbooks.com.
LEARN FROM A HACKER
‘Hackers don’t have to be brilliant.
I’m living proof of that,’ is a
disarming remark by the author of
Hacking the Hacker: Learn From the
Experts Who Take Down Hackers.
He introduces two dozen or more
cyber-security people (mainly men,
but some women), starting with the
author Bruce Schneier. For the author,
their stories and his own are proof that
‘the best and most intelligent hackers
work for the good side’. They get to
exercise their minds, and get well
paid. The author soon disabuses us
of the Hollywood idea that hackers
are automatically bad people, who
can guess or steal any passwords,
living on energy drinks. Roger Grimes
suggests that hackers can be good
or bad, defenders or maliciously
criminal, wreckers. “It’s just that the
attacker usually gets more press.”
Testing boundaries
Hackers, Grimes argues, are people
with curiosity, who test boundaries,
without crossing those boundaries to
do harm or commit a crime. Hackers,
whether defenders or malicious, are
looking for weaknesses; so they have
to be persistent, until they find the
weakness that undermines the whole
defence perimeter. Grimes sets out
how hacking is an ethical matter; like
private investigators, they have to
decide whether they are to stay in the
law (which implies knowing what it
is) or not. Are you going to break into
a mobile phone, or emails, or a server,
because an employer or client or mate
asks you to? Are you a white-hat (who
does good) or a black-hat (who does
unethical or illegal things) or a greyhat
(someone who pretends they are a
white-hat, but do black-hat things).
Style
As that implies, in computer matters
things can be invisible. Grimes’
achievement in Hacking the Hacker,
that’s true of far from all cyber books,
is that besides an easy, engaging
style of writing he shows us, without
cinema or other illusions, people
working on computer security to
be thinking people like the rest of
us, with choices. And, as the case
of another of the two dozen shows,
someone can change, start as a
black-hat but become a white-hat,
like famously Kevin Mitnick. Besides
having the endearing trait of naming
several books in the same field as
his that he rates, Grimes makes a
powerful and useful case that ‘the
defenders are the smartest hackers’;
they are the really impressive ones,
who not only have to know what
the malicious hackers might do, but
are builders, and closers of holes in
code. As someone doing penetration
testing for a living, Grimes broke into
every network he was hired to try to
break; but only so as to better defend
it against others. To break in out of
malice or for criminal purposes is
not only wrong; Grimes makes the
arguably more compelling case that
it’s not personally or professionally
satisfying. Grimes, then, does take
us through computer issues such as
connected cars and cryptography,
firewalls, DDoS attacks and ‘intrusion
detection’, but is mercifully light on
computing terms; instead he talks
in more human terms, of ‘social
engineering’ and penetration testing.
The only hitch is that in the case of
Schneier and Brian Krebs, you can
read for free their blogs. It would be
a pity not to do something as oldfashioned
as buy Grimes’ book, and
offer it to a young man or woman who
shows an aptitude for computers. p
www.professionalsecurity.co.uk
p62 Books 27-11.indd 1 10/10/2017 16:31