So I'm late getting this out....  Syngress was really late getting the book out, so we're close to even.  Better late than never though and I especially appreciate the book, it was a joy to read.

This book is broken into two sections.  The first section is a fictional story about a penetration event.  The author went out of his way to cover all the bases: nation state hacking sponsors, the feds, 'geek' kids who get in over their heads, industrial espionage, insider threats, and probably some I've missed.  The second section is a walk-through of the terminology and techniques used in hacking events in the book.  Enough to get the idea and pointers on where to go for more information.  It isn't 'Hacking Exposed' style reading where the authors are trying to walk you through the steps needed to replicate the technique.  Think more from a higher level of the "so what" factor that management often misses.

Lets face it, the author isn't going to win any awards for the fictional story.  It was readable, but it isn't holding court with Dean Koontz.  It is however technically accurate in almost every regard, something that most good fiction isn't.  Also, smattered throughout the fiction are notes on where to find the associated content in the second portion of the book.  This is where the book really comes out on its own.  It is a readable piece of technically accurate fiction that has immediate links to more in depth resources in the back of the same text.  If the topic interests you or you don't understand, simply hop to the back of the book, read a page or two and then jump back in with a working understanding of what is going on.

The two book sections are named STAR (Security Threats Are Real) 1.0 and 2.0.  This should give you an idea of who the book was written for (disbelievers).  I can't say that I learned a lot reading this book, but I've been in the business for more than a decade.  That doesn't mean I'm sorry I read the book.  Again, the fiction was entertaining and I have a new tool in my arsenal when dealing with uninformed management.  No joke, the next time I get questioned on something covered in this book, I'm going to recommend the book to management and then ask them to come talk to me again afterward (and hopefully before making drastic policy decisions).  I think all of us have dealt with far too many CTO's that don't know security (and aren't backed by a good CISO).  This is a good primer to get them to understand the threats involved and even some of the lingo.  The fiction portion was a little over 100 pages and could easily be digested in a good night of reading.  Even with none of the technical backing, I'd still rather talk to a CTO who read (and appreciated) the fiction portion than nothing at all.  System admins without security knowledge are becoming more rare these days, but they would also benefit from this book.  I mean that seriously, even "security aware" system admins often don't understand the range of topics this book covers.  Just having the knowledge of what's out there makes you a better administrator.

An added bonus was a nice list of conferences in the back of the book with mini-reviews of each.  If you are new to the field, this might be worth looking at.

Overall, this is a book that needs the right audience.  If you are just getting into the game, buy the book.  You are guaranteed to learn something and be entertained at the same time.  If you've been in the security field more than a couple of years, you probably won't learn much from this, but I'd recommend you invest in a "loaner copy" for the reasons stated above.

I'd give this 4.5/5 for passing to management, a 4/5 for those just getting in the field, and a solid "buy this as a loaner book" for anyone who's been around.  It's cheap, so it will pay for itself (in time and frustration saved) after loaning it once.

former33t - aka Jake Williams