Bests & Worsts Reviews from Amazon

This book really isn't about computer safety, or about personal safety - it's just kind of all over. By page 40 I was skimming paragraphs, but page 100 I was skipping entire pages. This book is not written for people in the security field, nor is it really written for people who want to know more about their personal security. I think that if you know enough already to be aware of what social engineering is in the first place and have a decent understanding of personal computing safety - you already know what this book can give you. I would classify this book as a collegiate "survey 101" level textbook on communications - the book focuses on very general processes and only the last 60 pages discuss actual examples. While deciding whether to buy this book or not, I joked with a friend that the fact that the first 28 people who reviewed it gave it 5 stars, was ITSELF an act of social engineering. I am not so sure that is a joke anymore. I've been buying books on Amazon for 12 some years now, and I don't think I've seen a book get that many fanatically raving reviews right off the bat. Looking back again at all those reviews, I guess perhaps if you know absolutely nothing at all about email scams and personal security, and happen to also be a CEO, then this book would be worth reading. The foreword and first 10 pages talk about what will be in the book. This is a common format, but that's an awful lot of pages wasted on material that is literally repeated again later in the book. And then up front we see material on The Nigerian Scam. If you are a security professional or a CEO, or anyone really - and have fallen prey to this or don't know what it is, seriously, you've got bigger problems to deal with. Perhaps that example is the crux of the matter - who exactly is the audience meant to be? The author really uses just one example, over and over, of him stalking a CEO at a bar. He learns a few things about the CEOs current life, including that he will be on vacation next week. The thief goes to the CEOs office when he knows he's gone, pretends he mixed up the date for an interview but wants to leave his resume for when the CEO returns. He hands the secretary a zip drive which has his document, which then also downloads malware onto the company's servers. Okay. While this is a valuable lesson on zip drives, do we need 50 pages of text to prove the point? And rather than focus on the inherent dangers of executable files (from media or emails/websites), the moral of this story focused on not ever talking to anyone in a bar. The author also spends most of the book on how to use SE (or basic thievery) against someone without any real solutions to the problems. For example, Chapter 7 talks about how to pick different kinds of locks - which has nothing to do with social engineering and I am not sure how someone uses that knowledge to protect them. Or how Doritos and FedEx hid symbols in their logos - this is SE sure, but what exactly will I do with this information? Pages 55 to 100 are all about communicating. Unless you never learned in high school or freshman college that every message needs a sender and a receiver - you can skip this part of the book. If you want an exorbitant amount of detail on how people can intentionally act angry or surprised or sad, or can emphasize certain words all to elicit different responses from people - you can skip to page 181. Again, who is the audience here? Some parts of this chapter talk about how Homeland Security agents are trained to use these "tricks" to interrogate people. How many normal people are faced with dumpster diving, stalking, psychologically trained thieves trying to steal information from your company? And if you ARE faced with these problems -your needs are way beyond the scope of this book. There are some good parts, like the section on microexpressions. The information on how people create their passwords was okay, though you can get those statistics almost anywhere. The search engine tools were interesting, though again that stuff is not social engineering and most computer savvy people likely know this material. The book was well edited, grammar and formatting, which is why I gave it the 2 stars. Overall the three things I took from this book are: 1) shred your trash so dumpster divers can't find sensitive information; 2) don't use company email for non-business matters because SE's can use that information to create enticing emails with malware hidden in them; and 3) every time you put information onto anything - Facebook, hobby sites, fan clubs, even Amazon - there are many software packages out there that SE's can use to collect all that information and make profiles to use against you.