This book is a must-read security text.
A representative from a leading Irish security consultancy recently gave the following, idiotic advice on one of Ireland's most-listened to radio phone-in shows: “Install a personal firewall, then sit back and relax—you'll never have to do anything again.” If I had been anywhere near this “expert”, I would have thrown the book I was currently reading at him. My only regret is it does not come in hardback.
Inside the Security Mind: Making the Tough Decisions by Kevin Day is a must-read security text. Unlike IT security how-to books designed to teach the mechanics, Day's book looks at IT security from a higher perspective, with the emphasis firmly on enabling the reader to think with a security mind. Day's goal is to raise consideration and awareness of security to a new level.
Day presents the art of IT security in four virtues, eight rules and eight concepts. Rather than drowning in the details of IT security, Day suggests transcending them. For instance and by way of example, it does not matter that you spent 50 hours configuring your firewall and locking it down tight if a user on your network has a modem set up to accept incoming telephone connections.
The first six chapters contain the bulk of Day's original material. The remaining six chapters are more standard IT security fare, including a discussion of various types of attackers, vulnerabilities, targets and exploits. Chapter 8, “Practical Security Assessments”, presents the Relational Security Assessment Model, a risk/threat assessment model developed at the author's company. This material is written in a style different from the rest of the book, and I would have preferred that this material, which is the driest in the book, be given the same treatment as the rest. The closing chapters of the book present some discussion of how the earlier ideas can be applied in practice.
If you are looking for advice on securing your brand X router, switch or firewall, you will be disappointed. Day's book is about the bigger picture, and in many respects, he succeeds in presenting exactly that.
Unfortunately, excellent presentation of the material is marred by Day's use of the term hacker to refer to the bad guys. On page 124 he writes, “I will make life easy and continue the misuse of this term.” I would have preferred that he set the record straight. There's also a collection of embarrassing typos that should have been caught by somebody before the book went to press. A more extensive index also would be welcome.
These gripes aside, you would be ill-advised to think of yourself as a security expert until you have absorbed this book's message. The first six chapters easily form the basis of an interesting IT security curriculum, so all you academics out there, take note of this title.
