Best Book Bejtlich Read in 2011

It's time to name the winner of the Best Book Bejtlich Read award for 2011!

I've been reading and reviewing digital security books seriously since 2000. This is the 6th time I've formally announced a winner; see my bestbook label for previous winners.

Compared to 2010 (31 books), 2011 saw a decrease to 22 books. Remember all reading is neither equal nor fast. When I review a book, I am sure to read it and not just skim it. For 10 books last year, I chose not to read them but to instead post impressions. Posts called "impressions" provide my sense of the book but I do not publish them in my Amazon.com reviews.

My ratings for 2011 can be summarized as follows:

• 5 stars: 10 books


• 4 stars: 7 books


• 3 stars: 4 books


• 2 stars: 1 book


• 1 stars: 0 books

Please remember that I try to avoid reading bad books. If I read a book and I give it a lower rating (generally 3 or less stars), it's because I had higher hopes.

Here's my overall ranking of the five star reviews; this means all of the following are excellent books. The links point to my reviews.

• 10. pfSense by Jim Pingle; Reed Media Services.


• 9. Beginning Visual C++ 2010 by Ivor Horton; Wrox


• 8. Windows System Programming, 4th Ed by Johnson M. Hart; Addison-Wesley.


• 7. Beginning C, 4th Ed by Ivor Horton; Apress


• 6. Robust Control System Networks by Ralph Langner; Momentum Press.


• 5. Managed Code Rootkits by Erez Metula; Syngress.


• 4. Ghost in the Wires by Kevin Mitnick and William L. Simon; Little, Brown and Company.


• 3. America the Vulnerable by Joel Brenner; Penguin Press HC.


• 2. Windows Internals, 5th Ed by Mark Russinovich, David A. Solomon, and Alex Ionescu; Microsoft Press.

And, the winner of the Best Book Bejtlich Read in 2011 award is...

• Hacking: The Art of Exploitation, 2nd Ed by Jon Erickson; No Starch. My review said in part:
  
  Jon Erickson's Hacking, 2nd Ed (H2E) is one of the most remarkable books in the group I just read. H2E is in some senses amazing because the author takes the reader on a journey through programming, exploitation, shellcode, and so forth, yet helps the reader climb each mountain. While the material is sufficiently technical to scare some readers away, those that remain will definitely learn more about the craft.

Looking at publishers, for the first year I can remember no publisher won more than one title. No Starch breaks the string of 3 straight previous BBBR victories held by Syngress.

Thank you to all publishers who sent me books in 2011. I have plenty more to read in 2012.

Congratulations to all the authors who wrote great books in 2011, and who are publishing titles in 2012!

Tweet

Read More

Telling a Security Story with Charts

The image at left appeared in the 31 December 2011 edition of The Economist magazine in the article Economics focus -- How to get a date: The year when the Chinese economy will truly eclipse America’s is in sight. It depicts 15 measurements of the US and Chinese economies, with historical and projected data. There is a version available at this page with more statistics comparing the two nations.

The Economist presents these charts for the following reason:

In the spring of 2011 the Pew Global Attitudes Survey asked thousands of people worldwide which country they thought was the leading economic power. Half of the Chinese polled reckoned that America remains number one, twice as many as said “China”. Americans are no longer sure: 43% of US respondents answered “China”; only 38% thought America was still the top dog. The answer depends on which measure you pick. (emphasis added)

The reason I like these charts is that they remind me of how many security practitioners think about "being secure." Managers likely often ask security staff "Are we secure?" The truth is there is no single number, so anyone selling you a "risk" number is wasting your time (and probably your money). However, it would be much more useful to display a chart like that created by the Economist. The security staff could choose a dozen or more simple metrics to paint a picture, and let the viewer interpret the answer using his or her own emphasis and bias.

Another reason I like the Economist chart is that the magazine built it using specified assumptions of future activity, listed in the article. If you disagree with these assumptions you can visit the second link I posted to devise your own charts. Although not shown here, what would be even more useful is showing these charts as a time series, with snapshots for January, then February, and so on. This "small multiples" approach (promoted by Tufte) capitalizes on the skill of the human eye and brain to observe and observe differences in similar objects.

If you had to pick a dozen or so indicators of security for a chart, what would you depict? The two I consider non-negotiable are 1) incidents per unit time and 2) time to containment for incidents.

Tweet

Read More

Happy 9th Birthday TaoSecurity Blog

Today, 8 January 2012, is the 9th birthday of TaoSecurity Blog. I wrote my first post on 8 January 2003 while working as an incident response consultant for Foundstone. 2843 posts later, I am still blogging. Looking at all 9 years of blogging, I averaged 315 per year, but in the age of Twitter (2009-2011) I averaged only 171 blog posts per year.

I plan to continue blogging, but I expect around the same number as last year -- somewhere in the 60 to 100 post range. I spend a lot more time expressing my views to the press and market researchers and analysts, so I'm often less inclined to do more of that in my free time through this blog. I plan to devote any decent chunks of free time to more traditional writing. I love to use Twitter for quick commentary. Thanks for joining me these 9 years -- I hope to have a 10 year post in 2013!

If you're a security blogger, and you like this blog, please consider voting for me via the 2012 Social Security Bloggers Awards. I'm nominated for "Most Educational Security Blog" and the Hall of Fame. Thank you again!

Don't forget -- today is Elvis Presley's birthday. Coincidence? You decide.

The image shows Elvis training with Ed Parker, founder of American Kenpo. As I like to tell my students, Elvis' stance is so wide it would take him a week to react to an attack. Then again, he's Elvis.

I studied Kenpo in San Antonio, TX but I'm going to try Tai Chi again, something I first practiced about 16 years ago in Billerica, MA during grad school.

Tweet

Read More