Enemy at the Water Cooler: Real-Life Stories of Insider ... (ISBN 1597491292)

Explores an important often neglected topic:
Even though hacker Kevin Mitnick's notorious exploits are more than a decade old, the media, and even some security professionals, continue to be obsessed with him. In early October 2006 alone, his name came up a few dozen times in a search of the prior month of Google News. Those obsessed with hackers are missing the far greater threat: trusted insiders. The insider threat shouldn't be a surprise: employee theft takes a bigger bite out of retailers than does shoplifting, and company personnel give away more secrets than are stolen by spies. On average, authorized network users gain access to 10 to 20 times more resources than they need to perform their jobs, and this extra access leads to most network security breaches. With that as its starting point, Enemy at the Water Cooler looks at the problem of the trusted insider and how to reduce both the threat and the vulnerability. Author Brian Contos astutely notes that insider attacks are the hardest ones to defend against, detect, and manage. The first part of the book sketches the risks that insiders pose to an organization. It also details mechanisms that can be used to control these risks. One such solution is ESM (Enterprise Security Management) software. (Full disclosure: the author is the CSO for a leading ESM vendor and some of the illustrations in the book are screenshots from this vendor's product.) ESM software centrally collects and analyzes log data from various entities within a network. When correctly deployed, ESM can be used to discover internal risks, in addition to correlating security information and performing other valuable tasks. The final chapters of the book run through real-life case studies in which Contos shows how ESM mitigated, or could have mitigated, the risk. Although the book has a lot of information, at $49.95 for fewer than 250 pages, the book is overpriced. Even though it can come across as self-serving, the book should be commended for tackling a vital and often neglected topic.

"If the only tool you have is a hammer, then every problem is a nail.":
Ignore the main title - look at the subtitle. This book is little more than a sales pitch for Enterprise Security Management systems, or more specifically the ESM sold by the author's company, with a random assortment of largely unattributed and barely analyzed anecdotes on information security incidents mostly relating to ESM. The link to "insider threats' is tenuous at best and in the most part is merely used as an excuse to hype the wonders of ESM. If you are seriously interested in ESM, you probably wrote the gushing "review notes" on the cover or the foreword (written by Hugh Njemanze, CTO of - you guessed it - the same ESM company). I'm far from convinced that anyone else (except perhaps from the ESM company and its customers who may be happy with an extremely biased view of the value of ESM) would benefit from this book, even if it is "vendor neutral" (page xxii). If you are looking for some meaningful insight into and analysis of the "insider threat", and perhaps some practical and worthwhile countermeasures apart from ESM, look elsewhere.

Real Life Security Stories:
'Enemy at the Water Cooler: Real-Life Stories of Insider Threats and Enterprise Security Management Countermeasures' by Brian Contos is an interesting look at some real-life situations that have occurred where nasties have gotten into systems and wrecked the havoc that they are looking to cause. While some reviewers have argued that this book is just a sales pitch to go out and buy anti-hacker software and hardware to combat these criminals, they are probably right!!! Security is always a matter of finding the right balance but certainly erring on the side of caution certainly is the safer way to go in most cases!! Good book for IT people and specifically security whizzes to take a look at. **** RECOMMENDED

too relevant for today's security world:
great problem statement and introduction to the overall issues and background surrounding insider threat. Insider threat is one of the hardest problems to understand and address in today's fast moving technology rich organizations. The author seems to have real world experience in dealing with these types of issues and I really enjoyed the insights especially in the use case examples. A nice read. thanks

Great information and case studies - great book:
This book was extremely easy to read and enjoyable. The case studies made complex concepts such as collaborative attacks and advanced intruder discovery/remediation techniques understandable. I've even shared the case studies with my management as examples of risk to help push our insider threat program forward. I found that sharing key case studies that are relevant to our business helped to make my point about why we need to pay more attention to threats from the inside. And the way the book is written, I don't need to translate tech talk to business talk. In addition to the insider threat information, the initial chapter that gives an overview of computer-based threats from organized crime, nation-states and terrorist was an eyeopener. The author does an excellent job explaining how these groups use insiders (employees mostly) to help carryout their agendas. Since reading the book I've also listened to several webcasts and podcasts from the author. I found these to be informative and in several instances, the case studies from the book are explored in even more detail as the author discusses subtitle points that aren't necessarily covered in the book. I've read a few books on insider threat now, and this is by far one of my favorites, and more so, it has shown great utility at work. Engineers like it, and so does my senior management.