About this Book

What you are about to read is not a work of fiction. This is a collection of real security audits. Each chapter focuses on an audit that I actually conducted for a real, live, functioning company. If I'd used the actual company names, you would probably recognize that you'd personally done business with some of them.

Of course, I didn't use the real names of the companies, employees, or other parties for obvious legal and ethical reasons. But I did use the real facts regarding risk and my audit approach in each case.

Read closely, especially if you are an executive manager, line-level manager, system administrator, lawyer, or law enforcement professional. The risks described are risks that you need to understand.

In any case, the real risks are not only built-in to the operating systems. Serious risks lie in the way systems are installed, configured, supported, and managed. It is those factors that most determine the risk to your company.

In pointing out these risks, I'm hoping that the people responsible for data on networks start taking an active and serious approach to security.