Every security professional is likely to quibble with some details in some other security professional's writings. I have, in various forms and at various times, been a security professional before settling into my current career path as a software developer, including several years during which I wrote professionally about security (among other things).

There were several points on which I might disagree with some of Andrew Peterson's commentary on the state and practice of information security in today's world, but I found that I agreed with what he said more often than not -- and even when I disagreed, it was typically not a strong disagreement. In fact, his ability to extract meaningful concepts from the chaotic swirl of information, misinformation, and disinformation in the broad field of information security was quite a bit better than I expected, having been disappointed by books whose authors claimed far greater expertise than Peterson claims in Cracking Security Misconceptions, and some of his points that dig a little deeper than mainstream "best practices" commentary actually read eerily like some of my own articles when I wrote professionally about security. If you have the time and inclination, for instance, compare what he has to say about security standards and checklists with what I have said about the same subject matter in articles I wrote for TechRepublic.

This is a succinct book, organized a bit like the typical "top ten list" style of blog posts (though much more in depth than a typical blog post), but it conveys a surprising weight and breadth of good advice about how to think about security in its short length. Most people who are not security professionals but could benefit from some idea of how to consider the practical realities of information security can gain much from reading this book, and some self-described security professionals I have observed in the past would do themselves a great favor by reading and learning from it as well -- except perhaps those whose entire livelihoods are based on acting as though Peterson's insights are irrelevant or inaccurate, because sometimes feeding a culture of ignorance is more lucrative than actually solving problems. ( )