Books Every InfoSec Professional Should Read
Every field of study has a list of certain titles that people should have read. The "Western canon" includes Plato's The Republic. Evolutionary biology has Charles Darwin's The Origin of Species. Linguists have Noam Chomsky's On Language. What books make up the information security canon?
There are hundreds, if not thousands, of books about security, whether we are talking about hackers, cyber-crime, or technology protocols. How is a busy information security professional to know which ones to read? Richard Howard, CSO of Palo Alto Networks, has a list of 20 books he believes information security professionals need to read. When Security Watch pointed out that 20 titles may seem a little intimdiating, Howard distilled his list down to the following top five, in no particular order: Cryptonomicon by Neal Stephenson, Kingpin by Kevin Poulson, We are Anonymous by Parmy Olson, Confront and Conceal by David Sanger, and Cuckoo's Egg by Clifford Stollhave.
Each book on Howard's top 20 list had to meet three rules in order to be included: It had to accurately represent the field without over-exaggerating the issues, be concise, and be well-written. Howard wound up with a mix of technical books, non-fiction, and even some fiction titles. Fiction books were important because they help communicate complex issues to a broader audience. The technical books didn't need to be how-to manuals or focused on specific networking protocols so long as they developed or strengthened practical skills. For example, Howard included the CERT Guide to Insider Threats on the top 20 list.
Non-fiction books offer readers context about the nature of the threats they are facing, as well as the motivations of their adversaries. Security professionals frequently focus on being tactical, and don't always understand "how we got here," Howard said.
And now, the top five titles:
Cryptonomicon, by Neal Stephenson
With its mix of real figures in history and made-up characters, Cryptonomicon is the "quintessential hacker novel," Howard said. It's also arguably the best book about cyber-security because it provides important historical context and does so without exaggerating the issues at hand, Howard said. While not an easy book to read, it is packed with a ton of ideas.
Confront and Conceal: Obama's Secret Wars and the Surprising Use of American Power by David E Sanger
This book is essential in understanding how cyber-warfare has evolved. Sanger outlines operation "Olympic Games" in great detail, which led to Stuxnet, and how cyper-weapons could be used to cause physical damage on a wide scale.
Kingpin: How One Hacker Took Over the Billion-Dollar Cyber-Crime Underground by Kevin Poulsen
Kingpin is the premier title on cyber-crime and should be mandatory reading for all CSO-types, Howard said. It lays out the cyber-criminal underground in a way that makes it possible for anyone to understand modern cyber-crimes.
The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage by Clifford Stollhave
Even though Cuckoo's Egg was published in the 1980s, it is surprisingly still very relevant, covering persistent information security issues such as information sharing, privacy versus security, cyber espionage and the intelligence dilemma.
We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous and the Global Cyber Insurgency by Parmy Olson
Olson lists a comprehensive timeline of significant hacktivist events, but does not get bogged down trying to cover all aspects of the Anonymous movement. This book should be a must-read because of the historical context it provides, Howard said.
Unlike most literary canons, this list will evolve because information security is a continuously evolving field. In fact, Howard is eagerly anticipating the book from security writer Brian Krebs, as it will likely expand our knowledge of cyber-crime, he said.