After Mitnick's first dozen examples anyone responsible for organisational security is going to lose the will to live. It's been said before but people and security are antithetical. Organisations exist to provide a good or service and want helpful friendly employees to promote the good or service. People are social animals who want to be liked. Controlling the human aspects of security means denying someone something. This circle can't be squared.

Considering Mitnick's reputation as a hacker guru the least and last point of attack for hackers using social engineering are computers. Most of the scenarios in The Art of Deception work just as well against computer-free organisations and were probably known to the Pheonicians. Technology simply makes it all easier. Phones are faster than letters after all and large organisations mean dealing with lots of strangers.

Much of Mitnick's security advice sounds practical until you think about implementation, when you realise more effective security means reducing organisational efficiency: an impossible trade in competitive business. And anyway, who wants to work in an organisation where the rule is "Trust no one"? Mitnick shows how easily security is breached by trust, but without trust people can't live and work together. In the real world effective organisations have to acknowledge total security is a chimera--and carry more insurance. --Steve Patient

The book is full of entertaining little stories about how 'social engineers' are able to obtain sensitive information, just by 'asking for it', along with explainations of the techniques used, why it worked, and how you can prevent something similar happening to you.

Given the content, and the quality of the book, it is definitely worth the money. Just dont be dissapointed if you were looking to be able to go and do it yourself.


Well worth reading   June 24, 2004
 3 out of 3 found this review helpful

An excellent read giving a great insight into how people can be easily duped. Not a handbook to begin hacking but an overview of techniques so that anybody who is worried about Information Security can be aware of the methods employed by Hackers and put in place procedures to prevent unauthorised access to data. Written by the "definitive" hacker who has now turned his energy and expertise to the benefit of all. Well written and easy to read even if you're not a techi'. Not full of jargon or assumptions. BUY IT NOW