As stories continue to mount about security breaches in organizations and government agencies—such as the 2016 US Department of Justice hack—many people believe there’s really nothing they can do about it. Fact is, you can do quite a bit. In this report, security professional Andrew Peterson addresses several widespread misconceptions about the hacking world so that you can be better prepared to join the fight. You may believe hackers today are too clever and attacks are too sophisticated for you to do anything, or that your organization isn’t worth a hacker’s time. But that isn’t the case. All organizations—from small, owner-operated businesses to large, multinational corporations—own data worth stealing and are potential, and even likely, targets for an attack. If you’re ready to take security seriously, you need to involve everyone in the company, including security and non-security professionals alike. This report provides you with an accurate picture, rather than conjecture or half-truths propagated by the media.
Andrew Peterson is the internationally bestselling author of the Nathan McBride series. Born and raised in San Diego, California, he attended La Jolla High School before enrolling at the University of Oklahoma, where he earned a Bachelor of Science Degree in Architecture.
An excellent marksman, he holds the classification of Master in the NRA’s High Power Rifle ranking system. His familiarity with weapons and dedication to research has resulted in many speaking engagements ranging from craft workshops to ATF canine demonstrations.
Andrew began writing fiction in 1990 and sold a short story, Mr. Haggarty’s Stop, to San Diego Writers Monthly in October, 1992. After attending his first writer’s conference in 2005, where he met Ridley Pearson, he became serious about writing the Nathan McBride stories.
FIRST TO KILL (FTK) is Andrew’s debut thriller which features Nathan McBride, the brutally effective, trained Marine scout sniper and former CIA operations officer. FTK was originally published in 2008 by Dorchester Publishing as a mass market paperback. Early in January 2011, Andrew signed with Thomas and Mercer. Then in 2012, FTK was re-released in trade paperback, eBook, and audiobook editions. FTK has been translated into six languages.
Andrew had the privilege of attending Operation Thriller II, a 2011 USO tour to Afghanistan where he personally thanked our troops for their service. He traveled with fellow authors Sandra Brown, Kathy Reichs, Clive Cussler and Mark Bowden. He considers the USO tour one of the highlights of his life. To date, Andrew has donated over 3,000 books to our troops serving overseas and to our wounded warriors recovering in Naval and Army hospitals worldwide.
When he’s not writing the popular Nathan McBride series, Andrew enjoys scuba diving, target shooting, flying helicopters, hiking and camping, and an occasional (and questionable) round of golf. Andrew and his wife, Carla, live in Monterey County, California with their two Giant Schnauzers.
Every security professional is likely to quibble with some details in some other security professional's writings. I have, in various forms and at various times, been a security professional before settling into my current career path as a software developer, including several years during which I wrote professionally about security (among other things).
There were several points on which I might disagree with some of Andrew Peterson's commentary on the state and practice of information security in today's world, but I found that I agreed with what he said more often than not -- and even when I disagreed, it was typically not a strong disagreement. In fact, his ability to extract meaningful concepts from the chaotic swirl of information, misinformation, and disinformation in the broad field of information security was quite a bit better than I expected, having been disappointed by books whose authors claimed far greater expertise than Peterson claims in Cracking Security Misconceptions, and some of his points that dig a little deeper than mainstream "best practices" commentary actually read eerily like some of my own articles when I wrote professionally about security. If you have the time and inclination, for instance, compare what he has to say about security standards and checklists with what I have said about the same subject matter in articles I wrote for TechRepublic.
This is a succinct book, organized a bit like the typical "top ten list" style of blog posts (though much more in depth than a typical blog post), but it conveys a surprising weight and breadth of good advice about how to think about security in its short length. Most people who are not security professionals but could benefit from some idea of how to consider the practical realities of information security can gain much from reading this book, and some self-described security professionals I have observed in the past would do themselves a great favor by reading and learning from it as well -- except perhaps those whose entire livelihoods are based on acting as though Peterson's insights are irrelevant or inaccurate, because sometimes feeding a culture of ignorance is more lucrative than actually solving problems.