Don't forget to write

It sometimes seems that the security industry is still divided into the ‘user education is vital’ camp and the ‘if education was going to work, it would have happened by now’ camp [1]. Still, I doubt if even the most diehard proponent of the latter viewpoint really believes that matters would be no worse if we didn’t make any attempt to teach the end user anything about security.

There is, of course, no shortage of excellent user-oriented security blogs, white papers and conference papers relating to malware management (which I assume to be a major concern for readers of this publication). Good books are rather scarcer, and those of us in the industry who have attempted to write one have tended to find an audience either within the security industry itself, or among security administrators and managers. Books that have found a significant audience among end users and home users and that devote significant wordage to malware issues are less common. In fact, despite having either written or contributed to around a dozen security oriented books myself, I’ve never managed to interest a mainstream publisher in a malware-oriented book that specifically targets consumers. Perhaps it’s true, as it has been suggested, that Joe Average isn’t interested enough in his own security to buy a book about it – though there are enough rather bad, consumer-facing books with a small amount of malware discussion to indicate that some publishers see a market there.

Nevertheless, from time to time, someone with real security knowledge does attempt to share that knowledge with the people who generally know the least. Regrettably, Eddy Willems’ recent book Cybergevaar [2] (in Dutch) is beyond my linguistic skills (though hopefully there will be an English translation eventually). However, Sorin Mustaca’s eBook Improve Your Security: Everything you wanted to know about IT security and didn’t know who to ask [3] and Tony Anscombe’s eBook One Parent to Another: Managing technology and your teen [4] are within my linguistic and technical competence, or so I’d like to believe. Both authors are well known in the security industry. Indeed, Anscombe’s book is published under the aegis of his employer, AVG, as a free PDF download. Mustaca’s book is published by Leanpub, though his employer, Avira, gets a mention on the Acknowledgements page and some of the advice given is Avira-centric. Improve Your Security is available in PDF, EPUB and MOBI formats with a recommended price of $4.99, but the actual sum is left to the buyer.

Mustaca’s book, as its subtitle suggests, is wider in scope than Anscombe’s, and in some areas has a more technical bias. It is divided into five main sections:

The first section, which deals with accounts and passwords, explains what a cryptographic hash function is and what salting is. It describes a few simple strategies for making a password harder to guess, and provides some useful advice on what not to do. There’s some good advice here, but I suspect that some readers will find it a little scary and even confusing, visually. Mustaca also includes some thoughts on the deficiencies of password storage, advocating memorization as a better course of action. There is also some consideration of the high-level implications of password and account management, and the very sound recommendation to change default passwords. (Think that you don’t need to worry about account management on a home computer? You might think differently when you read the story of the child who nearly bought a Harrier jump-jet.) Password strategies are a contentious subject, but this should at least start readers thinking beyond ‘qwerty’ and ‘123456’. This is a topic that could usefully be expanded in a future version of the book. It’s true that there are many resources out there offering advice for password selection, but their quality is extraordinarily variable. I’d like to see a section on PIN selection strategies added at some point, too.

Tony Anscombe’s book is more polished, and takes more of a ‘Guide for Dummies’ approach, going to some lengths to play down the use of technical terms and acronyms. It is divided into a number of chapters:

Finally, a concluding section reminds us of ‘the big things to keep in mind’.

While Anscombe summarizes: ‘everyone who is a parent or in loco parentis should read this book’, Chapter 1 is actually a well-argued high-level justification of the need for the book. I can’t help thinking, though, that the people who have gone to the trouble of downloading the book were probably already aware that they needed to be prepared to help young people to meet the challenges of somewhat scary new( ish) technology.

Chapter 2 makes the point that a wide range of objects we don’t necessarily think of as computers have become capable of being connected to the Internet, but focuses mostly on the fairly current examples of smartphones and (other) photographic devices with geo tagging capabilities.

Chapter 3 is a little more overtly technical, expounding on and explaining some acronyms that someone new to the technology and concerned about how it works needs to know. It also touches on some basic password strategies and gives a non-technical explanation of two factor authentication. A look at the fundamentals of using email includes a brief consideration of spam and a fuller consideration of phishing that should go a fair way to educating both child and parent as regards the recognition of scam messages delivered by various media. That’s followed by a look at the dangers of public Wi-Fi, especially when it comes to sensitive transactions.

The section that follows looks at the security implications of Internet transactions away from home, using public access points and hotel Wi-Fi networks. Considerations of privacy lead into a brief description of the risks of geo tagging and a longer summary of the issues around social networking, in particular Facebook and YouTube.

While in some instances these two books cover similar ground, they approach it from different directions. Mustaca’s book is wider in scope and sometimes reads a little more technically than was probably intended. Anscombe’s parent-to-parent approach is sometimes more about parenting than security (not that there’s anything wrong with that) and makes virtually no assumptions about the technical knowledge of the reader, sometimes being almost too simplistic. Nonetheless, both are way ahead of most of the ‘lowest common denominator’ guides I’ve seen, and I’d be happy to recommend either or both of them to their target audiences. It seems to me that there is still a need for a reliable but more comprehensive resource, in terms of scope, level of (non-technical) detail, and pointers to other reliable and independent resources. These books, however, are several steps in the right direction.