Offensive Countermeasures: The Art of Active Defense
Book written by John Strand and Paul Asadoorian
Book review by Robert Clark
Executive Summary
John and Paul (PaulDotCom) state the intention of Offensive Countermeasures: The Art of Active Defense best, “It is our hope that this book is just the beginning of a wider conversation on the topic of hacking back.” According to numerous reviews found online, most feel it accomplishes that objective and I would agree that it is only a start. It is written for those already in the information security space who have an understanding of defending networks. However, with that said, many critiques found it light on substance and more of a cursory look at active defense. This and the subject matter make it a good read but not Canon-worthy. If the Canon requirement is “To identify a list of must-read books . . . where the content is timeless . . . if not read, will leave a hole in the cybersecurity professional’s education that will make the practitioner incomplete,” not reading this book will not leave a hole, only because there are now many other methods to obtain this information in an updated form. The book is an excellent introduction to many active defense methods. The introduction gives a cursory, but now dated, look at some legal cases, and then the text is divided into three core sections: Annoyance, Attribution and Attack.
About the People
The Story
As the book title states, Offensive Countermeasures breaks down the same into three categories: Annoyance, Attribution and Attack. Annoyance is basically wasting an attacker’s time introducing the readers to one of the military’s favorite acronyms OODA: observe, orient, decide and act. Attribution is just that, focusing on knowing not only who is attacking you but also their capabilities and tactics. Finally, Attack, helping one develop approaches to “planning and thought” and gaining access to an attacker’s systems. Bookending the three core sections are an introduction covering some dated legal decisions and a final chapter on Core Concepts.
For full disclosure, I am a cyberspace attorney with some decent technical understanding. So I defer to many of the supposed “techies” who have posted reviews online as to the technical content of the three main chapters. The majority state that this is a good overview, but short on substance, and even refer you to John and Paul’s podcasts. Moreover, John’s instruction on this topic can be found in numerous places, such as SANS, Blackhat, podcasts, etc. I would assume that information is more up-to-date than when this book was published in 2013.
Again I fall back on the authors’ intent, to get the discussion going. I think their introduction to the Attack section states it best, “This is the step of this book that you will need to work out with your legal department. You may also want to coordinate with law enforcement as required.” As one who tries to espouse Clark’s Law to rival Moore’s Law, Clark’s law is to get your lawyers involved early and often so they don’t slow down operations and can get you to yes. Explain the technology at a third-grade level to them (lawyers) so we can understand it and explain it to senior leaders (C-Suite) or others. So I appreciate John and Paul’s introduction of the book with the law and their caveats throughout the book.
Conclusion
I’ll leave it to an Amazon review of Offensive Countermeasures by a Mr. Anderson in September of 2013, “Overall this book provides a good review of high level concepts with some minor depth of what organizations can do to better protect their assets using both defensive and offensive strategies. I was just hoping for a more technical explanation, and more advanced techniques, but the book does cover what it states.”
And the final word goes to John’s SANS colleague, lawyer Benjamin Wright, who stated a couple of months before that, “This book helps the public debate about computer defense get beyond some old, worn-out taboos. Lawyers, politicians and government officials need to read this book and expand their understanding of effective, ethical digital security and privacy.”
