Social Engineering: The Art of Human Hacking [Paperback]

One can sum up all of Social Engineering: The Art of Human Hacking in two sentences from page 297, where author Christopher Hadnagy writes "tools are an important aspect of social engineering, but they do not make the social engineer. A tool alone is useless; but the knowledge of how to leverage and utilize that tool is invaluable". Far too many people think that information security and data protection is simply about running tools, without understanding how to use them. In this tremendous book, Hadnagy shows how crucial the human element is within information security.

With that, Social Engineering: The Art of Human Hacking is a fascinating and engrossing book on an important topic. The author takes the reader on a vast journey of the many aspects of social engineering. Since social engineering is such a people oriented topic, a large part of the book is dedicated to sociological and psychological topics. This is an important area, as far too many technology books focus on the hardware and software elements, completely ignoring the people element. The social engineer can then use that gap to their advantage.

By the time that you start chapter 2 on page 23, it is abundantly clear that the author knows what he is talking about. This is in stark contrast with How To Become The Worlds No. 1 Hacker, where that author uses plagiarism to try to weave a tale of being the world's greatest security expert. Here, Hadnagy uses his real knowledge and experience to take the reader on a long and engaging ride on the subject. Coming in at 9 chapters and 360 pages, the author brings an encyclopedic knowledge and dishes it out in every chapter.

Two of the most popular books to date on social engineering to date have been Kevin Mitnick's The Art of Deception: Controlling the Human Element of Security and The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers. The difference between those books and Hadnagy, is that Mitnick for the most part details the events and stories around the attacks; while Hadnagy details the myriad specifics on how to carry out the social engineering attack.

The book digs deep and details how the social engineer needs to use a formal context for the attack, and breaks down the specific details and line-items on how to execute on that. That approach is much more suited to performing social engineering, than simply reading about social engineering.

Chapter 1 goes though the necessary introduction to the topic, with chapter 2 detailing the various aspects of information gathering. Once I started reading, it was hard to put the book down.

Social engineering is often misportrayed as the art of asking a question or two and then gaining root access. In chapter 3 on elicitation, the author details the reality of the requirements on how to carefully and cautiously elicit information from the target. Elicitation is not something for the social engineer alone, even the US Department of Homeland Security has a pamphlet that is uses to assist agents with elicitation.

After elicitation, chapter 4 details the art of pretexting, which is when an attacker creates an invented scenario to use to extract information from the victim.

Chapter 5 on mind tricks starts getting into the psychological element of social engineering. The author details topics such as micro expressions, modes of thinking, interrogation, neuro-linguistic programming and more.

Chapter 6 is on influence and the power of persuasion. The author notes that people are trained from a young age in nearly every culture to listen to and respect authority. When the social engineer takes on that role, it becomes a most powerful tool; far more powerful than any script or piece of software.

The author wisely waits until chapter 7 to discuss software tools used during a social engineering engagement. One of the author's favorite and most powerful tools is Maltego, which is an open source intelligence and forensics application. While the author concludes that it is the human element that is the most powerful, and that a great tool in the hand of a novice is worthless; the other side is that good tools (of which the author lists many), in the hands of an experienced social engineer, is an extremely powerful and often overwhelming combination.

Every chapter in the book is superb, but chapter 9 - Prevention and Mitigation stands out. After spending 338 pages about how to use social engineering; chapter 9 details the steps a firm must put in place to ensure they do not become a victim of a social engineering attack. The chapter lists the following six steps that must be executed upon:

* Learning to identify social engineering attacks
* Creating a personal security awareness program
* Creating awareness of the value of the information that is being sought by social engineers
* Keeping software updated
* Developing scripts
* Learning from social engineering audits

The author astutely notes that security awareness is not about 45- or 90-minute programs that only occur annually; rather it is about creating a culture and set of information security standards that each person in the organization is committed to using their entire life. This is definitely not a small undertaking. Firms must create awareness and security engineering programs to deal with the above six items. If they do not, they are them placing themselves at significant risk of being unable to effectively deal with social network attacks.

As to awareness, if nothing else, Social Engineering: The Art of Human Hacking demonstrates the importance of ensuring that social engineering is an integral part of an information security awareness program. This can't be underemphasized as even the definitive book on security awareness Managing an Information Security and Privacy Awareness and Training Program only has about 10 pages on social engineering attacks.

There are plenty of security books on hardware, software, certification and more. Those were perhaps the easy ones to write. Until now, very few have dealt with the human element, and the costs associated with ignoring that have been devastating. Social Engineering: The Art of Human Hacking is a book that is a long time in coming, but worth every page.

While seemingly geared to the information security staff, this is a book should be read by everyone, whether they are in technology or not. Social engineering is not something that just occurs behind a keyboard. Social attackers know that. It is about time everyone else did also.

Finally, we have a book on hacking humans that contains details of psychology and human factors related to security. There is no other book like it. For that reason, it's a must read for all security professionals.
Humans are and always will be the weakest security link. PERIOD. Up to now, there hasn't been a comprehensive book on (1) how to orchestrate a Social Engineering campaign; (2) how to prevent a Social Engineer from breaching your defenses; and (3) psychological principals of how humans think and operate. This book has all three. It includes the details necessary to fully understand critical concepts for Social Engineering such as pretexting, elicitation, and influence, which provides a great framework on how to manipulate humans to take the actions you want. I've found that many computer security professionals aren't fluent in human factors. By reading this book, they will glean that knowledge.
BUT WAIT, THERE'S MORE, Chris also includes case studies to see the principles in action. These studies from Chris' experience as a professional Social Engineer round out this outstanding book.
Security professionals: If you read only one book in 2011, make it Social Engineering: The Art of Human Hacking by Chris Hadnagy.

This book is one of the best books I read in regards to (IT) security. I do absolutely recommend this book to any pentester, security officer or person interested in this very interesting aspect of security. Performing penetration tests and security audits myself I try to especially implement SE in tests and audits since it is the best way to find issues and the human factor is neglected in most of the tests and reviews.

There was no book like this book before dealing with Social Engineering. At best SE has been mentioned in a book about security and only a couple pages were dedicated to it. But nowadays SE is becoming more and more important to keep in mind. The times when attackers and pentesters could exploit weaknesses in applications and services without the need of user interaction are mostly over. Usually the user has to open a malicious file for example a PDF file. This book explains how this can be achieved and also what to keep in mind when preparing an awareness training.

Reading this book will teach you how SE attacks are being performed, the background and underlying principles of them as well how to detect and mitigate them.

Chris explains everything in a very good and understandable way giving a lot of examples and infos on where to start with further research on the explained techniques (e.g. NLP, microexpressions...).

It is definately a must have.

› Go to Amazon.com to see all 58 reviews  4.7 out of 5 stars