The Security Skeptic

Book Review: The Little Book of Big Scams

The Metropolitan Police Service have published a thoughtfully prepared book to raise public awareness of online scams. The Little Book of Big Scams covers the most important messages any government agency, community, or private organization should convey to citizens and members to help them understand scams they will undoubtedly be exposed to when they are online, at work, or at home.

The book begins by debunking myths about the Internet and Internet websites. MPS debunks the most basic misconceptions - "All Internet Websites are legitimate" - to misconceptions that are often held by trusting people ("All companies, businesses and organisations are legitimate because they are approved and monitored by the government."). The MPS then presents 10 Golden Rules to help you beat the scammers. The rules are similar to many I've recommended in my posts and commonly found elsewhere (1, 2, 3)

The real meat of the book follows. MPS does a fine job of describing ten *big* scams (see panel). For each, MPS explains the nature of the scam, what the scammers are after, and offers clues you should look for that will help distinguish a scam from a legitimate transaction or solicitation. Intentional or otherwise, I liked the fact that the MPS messaging style is similar to the STOP.THINK.CONNECT. program in the United States.

Each scam comes with its own sidebar labeled REMEMBER. CAUTION. THINK. INVESTIGATE. and gives the reader a summary or takeway message. The book continues with a discussion of frequent scamming tools and several case studies, and concludes with Handy Hints to Protect Yourself and resource should you fall victim to a scammer.

MPS acknowledges that a similar book created by the Australian Competition and Consumer Commission inspired their publication. You can find the ACC's Little Black Book of Scams here.

Both books are worth making available to your community, your organization and friends.

Book Review: Counting to Zero

Counting to Zero (Kindle, paperback) is another of my recent reads in the security suspense genre. Like The Alexandria Project, the plot of Alan Johnston's novel is built around a malware threat. Alan spins his plot around a zero-day attack that his protaganist, Mick O'Malley, is uniquely positioned (both in terms of having the talent and opportunity) to prevent.

Alan's Mick O'Malley is a very interesting character. A blend of engaging nerd and savant, Mick has the tech savvy and hacking skills you expect in a cyber hero, but he's not so embedded in cyberspace that he isn't equally able to think fast in the real world, even in the heat of a chase (a nerd with motorcycle mechanic and crazy riding skillz no less). He even lands himself in a relationship with an attractive female Romanian firewall expert as he pits his skills against his adversaries.

Johnston incorporates blog posts and email exchanges by Mick O'Malley to expose non-technical readers to technical jargon: keylogging, botnets, encrypted (PGP) email and more are inserted in most chapters to demystify the dialog and the plot as it unfolds. These are distinguished using Courier font (of course). Some of these will seem too fundamental to security professionals or practitioners but I suspect it works well for non tech readers. 

The plot works well and the suspense builds nicely to conclusion. Counting to Zero is a fun read, with a fun protaganist. I finished the book looking forward to seeing more adventures with Mick O'Malley in the future.

Disclosure: I know Alan Johnston well yet we have never met. We co-authored  Understanding Voice over IP Security. I was hesitant to publish a review at first but then I realized that I'm not getting any compensation, I enjoyed the book, I hope you will, too.