Cyberjutsu: Cybersecurity for the Modern Ninja

by Ben McCarty

Overview

Like Sun Tzu's Art of War for Modern Business, this book uses ancient ninja scrolls as the foundation for teaching readers about cyber-warfare, espionage and security.

Cyberjutsu is a practical cybersecurity field guide based on the techniques, tactics, and procedures of the ancient ninja. Cyber warfare specialist Ben McCarty’s analysis of declassified Japanese scrolls will show how you can apply ninja methods to combat today’s security challenges like information warfare, deceptive infiltration, espionage, and zero-day attacks.

Learn how to use key ninja techniques to find gaps in a target’s defense, strike where the enemy is negligent, master the art of invisibility, and more. McCarty outlines specific, in-depth security mitigations such as fending off social engineering attacks by being present with “the correct mind,” mapping your network like an adversary to prevent breaches, and leveraging ninja-like traps to protect your systems.

You’ll also learn how to:

Use threat modeling to reveal network vulnerabilities

Identify insider threats in your organization

Deploy countermeasures like network sensors, time-based controls, air gaps, and authentication protocols

Guard against malware command and-control servers

Detect attackers, prevent supply-chain attacks, and counter zero-day exploits

Cyberjutsu is the playbook that every modern cybersecurity professional needs to channel their inner ninja. Turn to the old ways to combat the latest cyber threats and stay one step ahead of your adversaries.

Product Details

ISBN-13:	9781718500549
Publisher:	No Starch Press
Publication date:	04/26/2021
Pages:	264
Sales rank:	626,440
Product dimensions:	5.90(w) x 8.90(h) x 1.00(d)

About the Author

Ben McCarty is a cybersecurity specialist and former developer for the NSA, where he created cyberspace tools used by the intelligence community and DoD. He served in the US Army’s Network Warfare Battalion and became the first fully qualified cyber warfare specialist (35Q) in US Army history. He is currently a quantum security researcher in the Washington, DC, area.

Table of Contents

Chapter 1: Mapping Networks
Chapter 2: Guarding with Special Care
Chapter 3: Xenophobic Security
Chapter 4: Identification Challenges
Chapter 5: Double-Sealed Password
Chapter 6: Hours of Infiltration
Chapter 7: Access to Time
Chapter 8: Tools
Chapter 9: Sensors
Chapter 10: Bridges and Ladders
Chapter 11: Locks
Chapter 12: Moon on the Water
Chapter 13: Worm Agent
Chapter 14: Ghost on the Moon
Chapter 15: The Art of the Fireflies
Chapter 16: Live Capture
Chapter 17: Fire Attack
Chapter 18: Covert Communication
Chapter 19: Call Signs
Chapter 20: Light, Noise, and Litter Discipline
Chapter 21: Circumstances of Infiltration
Chapter 22: Zero Days
Chapter 23: Hiring Shinobi
Chapter 24: Guardhouse Behavior
Chapter 25: Zero Suspicion Threat Management
Chapter 26: Shinobi Tradecraft

Editorial Reviews

04/26/2021

This helpful manual explores the field of cybersecurity, providing tips, tricks, and proven methods to help companies keep online information out of the hands of hackers. Shirking a traditional approach, McCarty, a former NSA developer, suggests that readers “think like a ninja,” comparing shinobi methods from feudal Japan to modern-day cyber warfare. He acknowledges straightaway that he comes to the term ninja from its playful use among cybersecurity experts rather than his own heritage or expertise, though he’s since devoted himself to researching actual ninja history and philosophy. Each chapter covers a classic shinobi technique (intricate mapping, worm agents, covert communication) and then discusses its computer-based equivalent (network mapping, insider threats, interconnected malware). Combining philosophical exercises with more concrete plans of action, McCarty blends new and old, complex and simple, to craft this intricate guide.

This book does not cover personal computer use or best practices. Instead it focuses on corporate cybersecurity — those protecting large companies and organizations from hacks and leaks. That focus means that much of the information included in this book is too advanced for a casual technology user. There is no glossary of terms, and, beyond a few sentences of explanation, some of the more complex cyber concepts do not get thoroughly introduced.

While this book may be too advanced for the average computer user, McCarty provides clear, actionable advice to cybersecurity professionals and IT departments, with each chapter suggesting “Recommended Security Controls and Mitigations” for each potential problem. He covers everything from more efficient network mapping to more robust recruitment for entry-level roles, but readers may also enjoy the book’s philosophical bent. McCarty includes a “Castle Theory Thought Exercise” at the end of each section, introducing a hypothetical threat scenario and challenging readers with open-ended questions about possible solutions. For those who already have a strong basis in cybersecurity, this book encourages critical thinking.

Takeaway: This advanced cybersecurity manual emphasizes intelligence, stealth, and critical thinking

Great for fans of: Matthew Hickey and Jennifer Arcuri’s Hands on Hacking, Joshua Picolet’s Operator Handbook, Chris Sanders’s Intrusion Detection Honeypots.

Production grades Cover: A- Design and typography: B+ Illustrations: N/A Editing: B Marketing copy: A

BookLife Reviews

"As novel as it is illuminating, as it looks deep into the past. . . . [McCarty] provides a remarkably comprehensive tour of his subject, which is especially impressive for such a concise work that’s well under 300 pages. In it, he covers such as topics as mapping networks and authentication, and provides unconventional tips, as well . . . A thoughtful, original, and thorough guide to cybersecurity."
—Kirkus Reviews

"Cyberjutsu is an innovative work that is both highly technical and very readable. . . . it’s packed with ideas, tips, and practical techniques for combating cyber threats. As such, the book is likely to prove an invaluable resource for individuals and organizations looking to improve their cybersecurity practices."
—Erin Britton, San Francisco Book Review

"A very well researched and clearly organized book that uses Japanese history quite cleverly to illustrate modern cybersecurity problems, suggesting ways to counter technological invaders and hackers based on techniques used to defend castles against attacks by clever and resourceful ninja."
—Catherine Langrehr, IndieReader, Starred Review

"Pairs modern information security methods with ancient Japanese traditions, elevating both subjects in order to elucidate elements of the former. . . . an easy resource whose reference material flows well."
—Foreword Reviews

"A good quality book."
—Antony Cummins, The Historical Ninjutsu Research Team

"This helpful manual explores the field of cybersecurity, providing tips, tricks, and proven methods to help companies keep online information out of the hands of hackers. . . . Combining philosophical exercises with more concrete plans of action, McCarty blends new and old, complex and simple, to craft this intricate guide."
—BookLife

"The exercises are of a kind that would deeply kindle readers’ interest and spur them on to intense problem-solving activity as well as hands-on experimentation in a naturally appealing manner, particularly if you grew up loving adventure/mystery stories involving castles, kings, and queens. . . . [geeks will] find it highly enjoyable and challenging!"
—Raju Chacko, Reedsy

"May appeal to CEOs in the same way they might turn to Sun Tzu’s The Art of War to level up their plan of attack. The book is also a good overview of cybersecurity for students and anyone considering a career in this expanding field. . . . Cyberjutsu, with its knowledge of the past and its applications for the future, is sure to inspire both cybersecurity insiders and the curious."
—Joanna Poncavage, BookTrib

"A labor of love . . . There is much value in the descriptions, analogies and schemes as described. The cyber technology presented is correct and complete. I am no expert in Ninja warfare, but the analogies absolutely makes sense."
—A Book Junkie Reviews

"I had a lot of fun reading this book. It is by far one of the easiest technical books that I have read in a while. I’m not sure whether that was due to the comparisons to Shinobi holding my interest. Or whether it was due to the authors writing style that made it easy to read. Either way I blitzed through this book quickly and have recommended it to a few of my colleagues in the Cybersecurity industry."
—HaXeZ, Medium

"Don’t let its whimsical title fool you; this book is a practical and prescient compendium of cybersecurity concepts that lends itself to anyone considering a career in this expanding field along with organizational leaders seeking to level up their plan of attack with ninja-fueled tactics, techniques and procedures."
—Herald & Review

From the Publisher

2021-04-12
McCarty draws from the techniques of feudal Japan’s ninja warriors in order to develop a complete cybersecurity plan.

The debut author, who once worked as a developer for the National Security Agency and was among the first class of Cyber Warfare Specialists to serve in the Army Network Warfare Battalion, observes that tight cybersecurity has never been more necessary or more difficult, as security specialists and their criminal counterparts are both constantly innovating—locked in what Accenture security research and development lead Malek Ben Salem, in a foreword, calls a “cyber arms race.” McCarty’s approach to the issue is as novel as it is illuminating, as it looks deep into the past. Deeply impressed by “ninja scrolls” written in the 17th century, which were essentially tactical manuals for espionage, he decided that the basic philosophy contained within them could be converted into a “practical cybersecurity field guide.” After more research, he concluded that ninja techniques were “essentially on-the-ground training in information assurance, security, infiltration, espionage, and destructive attacks that relied on covert access to heavily fortified organizations,” which, as a cybersecurity expert, he found highly familiar. At the heart of his strategy is what he calls the “castle theory thought exercise,” in which one pretends to be “the ruler of a medieval castle with valuable assets” and imagines various ways to defend the castle and anticipate invaders’ assaults. He provides a remarkably comprehensive tour of his subject, which is especially impressive for such a concise work that’s well under 300 pages. In it, he covers such topics as mapping networks and authentication, and provides unconventional tips, as well; for example, he advises that one be wary of possible “hours of infiltration”—overly predictable routines that provide opportunities for attack. The author has decades of credentialed experience in cybersecurity, and his professional background is evident throughout the book, which manages to convey his expertise in language that will be generally accessible to laypeople and immediately actionable. The running conceit of the work at first appears implausible—that warriors from a pre-technological era could teach modern readers something about cutting-edge cybersecurity. However, McCarty will convince skeptics, as he provides an elastic and forethoughtful approach to defense based on the warrior philosophy—one that involves constant improvisation and imagination to reveal every conceivable weakness in one’s cyberfortress. As he puts it in the book’s concluding chapter, his overriding message is that it’s always “critical to consume threat intelligence and respond against dynamic threats in innovative ways.” Along the way, he describes something far more aggressive than passive vigilance—a defensive approach that makes extensive use of historical anecdotes, such as a chapter that uses a small medieval village’s distrust of outsiders as an analogy for how permissions are established in a computer system. McCarty not only articulates the elements of his overall philosophy, but also explains its practical applications in rigorous detail, recommending “security controls and mitigations” and concluding every chapter with a helpful synopsis, or “debrief.”

A thoughtful, original, and thorough guide to cybersecurity.

Kirkus Reviews