Information Security Expert Kevin Beaver

What Decades of Penetration Testing Taught Me (and what Ben Rothke confirmed)

After decades of testing systems for security flaws, many (arguably most) things haven’t changed. One in particular: most security failures still come down to basics that were assumed, ignored, or never verified.

The sophisticated attacks that media and Hollywood prop up are rarely the real problem. The gaps no one is following up on are. That’s what keeps me busy… It’s things like the crazy simple stuff that people overlook or take for granted. That’s what I’ve worked to capture in Hacking For Dummies over the past two decade – keeping things practical and focused on the security issues that actually matter in business environments.

My long-time colleague, Ben Rothke, recently reviewed the recently-released eighth edition in ASIS International’s Security Management . He’s been evaluating security books seriously for years and understands the difference between something that looks good on a shelf and something practitioners actually use. Here’s a snippet of what Ben said:

“For those seeking a high-level theoretical approach to network defense, look elsewhere. This is an in-the-trenches guide to help ensure your organization’s systems and network are secure.”

That’s the point of Hacking For Dummies…and it always has been.

Ben’s review reinforces a few realities I see quite often. Security is less about tools and more about willingness, discipline, and follow-through. Proper testing is one of the only reliable ways to separate security assumptions from reality. And from the sharpest IT staff to careless end users, people making bad choices…or choices based on bad information…are routinely at the root of the problem. No tool solves this security challenge on its own. You can even have well-written policies, up-to-date software, and ongoing quarterly reports and still have exploits sitting on your network that many users on your network could find. The only way to know what’s actually there is to look.

You can’t secure what you don’t acknowledge. And you can’t acknowledge it if no one’s testing for it. Consider making my book and all the blood, sweat, and experience I’ve put into it part of your IT/security program