Inside the Security Mind: Making the Tough Decisions by Kevin Day
A representative from a leading Irish security consultancy recently gave the following, idiotic advice on one of Ireland's most-listened to radio phone-in shows: “Install a personal firewall, then sit back and relax—you'll never have to do anything again.” If I had been anywhere near this “expert”, I would have thrown the book I was currently reading at him. My only regret is it does not come in hardback.
Inside the Security Mind: Making the Tough Decisions by Kevin Day is a must-read security text. Unlike IT security how-to books designed to teach the mechanics, Day's book looks at IT security from a higher perspective, with the emphasis firmly on enabling the reader to think with a security mind. Day's goal is to raise consideration and awareness of security to a new level.
Day presents the art of IT security in four virtues, eight rules and eight concepts. Rather than drowning in the details of IT security, Day suggests transcending them. For instance and by way of example, it does not matter that you spent 50 hours configuring your firewall and locking it down tight if a user on your network has a modem set up to accept incoming telephone connections.
The first six chapters contain the bulk of Day's original material. The remaining six chapters are more standard IT security fare, including a discussion of various types of attackers, vulnerabilities, targets and exploits. Chapter 8, “Practical Security Assessments”, presents the Relational Security Assessment Model, a risk/threat assessment model developed at the author's company. This material is written in a style different from the rest of the book, and I would have preferred that this material, which is the driest in the book, be given the same treatment as the rest. The closing chapters of the book present some discussion of how the earlier ideas can be applied in practice.
If you are looking for advice on securing your brand X router, switch or firewall, you will be disappointed. Day's book is about the bigger picture, and in many respects, he succeeds in presenting exactly that.
Unfortunately, excellent presentation of the material is marred by Day's use of the term hacker to refer to the bad guys. On page 124 he writes, “I will make life easy and continue the misuse of this term.” I would have preferred that he set the record straight. There's also a collection of embarrassing typos that should have been caught by somebody before the book went to press. A more extensive index also would be welcome.
These gripes aside, you would be ill-advised to think of yourself as a security expert until you have absorbed this book's message. The first six chapters easily form the basis of an interesting IT security curriculum, so all you academics out there, take note of this title.
Fast/Flexible Linux OS Recovery
On Demand Now
In this live one-hour webinar, learn how to enhance your existing backup strategies for complete disaster recovery preparedness using Storix System Backup Administrator (SBAdmin), a highly flexible full-system recovery solution for UNIX and Linux systems.
Join Linux Journal's Shawn Powers and David Huffman, President/CEO, Storix, Inc.
Free to Linux Journal readers.Register Now!
- Server Hardening
- EnterpriseDB's EDB Postgres Advanced Server and EDB Postgres Enterprise Manager
- The Death of RoboVM
- BitTorrent Inc.'s Sync
- The US Government and Open-Source Software
- The Humble Hacker?
- ACI Worldwide's UP Retail Payments
- Open-Source Project Secretly Funded by CIA
- New Container Image Standard Promises More Portable Apps
- AdaCore's SPARK Pro
In modern computer systems, privacy and security are mandatory. However, connections from the outside over public networks automatically imply risks. One easily available solution to avoid eavesdroppers’ attempts is SSH. But, its wide adoption during the past 21 years has made it a target for attackers, so hardening your system properly is a must.
Additionally, in highly regulated markets, you must comply with specific operational requirements, proving that you conform to standards and even that you have included new mandatory authentication methods, such as two-factor authentication. In this ebook, I discuss SSH and how to configure and manage it to guarantee that your network is safe, your data is secure and that you comply with relevant regulations.Get the Guide