How I Rob Banks

Foreword

It is a common complaint in cyber security that we don't relate our complex and important subject to ordinary life in an accessible way. There is no such problem with How I Rob Banks and Other Such Places, which is what makes its publication so welcome.

For some years now, FC has been at the fore in highlighting the multiple dimensions of cyber security and showing how a complicated and chaotic tapestry of vulnerabilities can be exploited. He is a living, breathing advertisement for ethical hacking and protected research. He thinks like a bad guy but acts (and writes) as a good guy. In that way, he exposes us to the worst tendencies of human life—malevolent intent on the aggressor's part; carelessness and complacency from the defenders—and points us toward achievable, practical ways of reducing harm.

I spent nearly seven years setting up and then running the UK's National Cyber Security Centre, part of the intelligence agency GCHQ, from the end of 2013 to the middle of 2020. This was an important period in cyber security, with the evolution of nation-state threats and the explosion of organized cyber criminality (particularly ransomware). But as things changed, patterns emerged in the way attacks were being carried out that caused us to think again. One of the most important areas of change was to banish the nonsensical phrase “people are the weakest link” and focus instead on how real people with real jobs working on real networks can manage the online mayhem FC charts ...