Book Review: If It's Smart, It's Vulnerable - Mikko Hyppönen

This is a curious book. It starts out as a look at the security of everyday objects, but quickly becomes a series of after-dinner anecdotes about various security related issues. That's not a bad thing, as such, but a little different from what I was expecting.

There's no doubt that Mikko walks the walk as well as talking the talk. Almost every page contains a bon mot. For example:

Working in information security is sometimes a bit like playing Tetris: your successes disappear but your failures accumulate. When information security works flawlessly, it is invisible. And rarely is anyone thanked for stopping a disaster that didn't happen.

There's a good deal of history in this. Even going so far as to interview the creators of (arguably) the first computer virus. It's also full of good little tips for practical evaluation of a security posture.

The book loses its way when it strays from the topic of security. The essays on Bitcoin and NFT feel like padded-out Wikipedia entries. And some of the claims desperately need citations. When talking about electric cars, for example, he makes the claim that:

if electric-powered vehicles had been popularized first, it would be hard to imagine gas-powered vehicles as competition at all.

As any student of transport knows - that is what happened. Electric vehicles were rather popular, but had a sustained campaign against them by the petrol lobby.

Some of the assertions he makes are controversial - but probably correct. For example:

Modern society requires being online, but how much information security know-how can we expect from pre-teens or pensioners, for example? The right answer may be to remove responsibility from users, who are incapable of bearing it, and shift it to where it belongs: with operating system creators, software companies, telecom operators—and information security companies.

Obviously, Mikko's employer stands to benefit from such an world - but I have a hard time disagreeing with it. We need to design a world with safety rails which makes it hard to commit life-altering mistakes.

It's a well written set of ideas, free of most technical jargon, and eminently readable.