I came across the Certification Exam Preparation Course in a Book for Passing the CISSP on Your First Try Certification Study Guide and requested a review copy from the publisher, The Art of Service based in Australia.

My initial perusal of the book showed that it is not an organized study guide.  Rather it seemed to be a collection of reference data that has been strewn together.  There are blatant mistakes throughout the book and significant inconsistencies. This makes it precisely the wrong book for any CISSP candidate.

My first thought that this simply a quick cut-and-paste plagiarism job akin to How To Become The Worlds No. 1 Hacker.  But the iThenticate Plagiarism Checker only showed an 8% plagiarism rate.  Notwithstanding that 8%, the author does not quote sources or external reference.  Other CISSP study guides will have hundreds of sources, references and external links.

Note that iThenticate found the author’s CISA and CISM study guides had plagiarism rates of 15% and 10% respectively.

An Amazon search showed that author William Manning is the author of scores of certification guides on a diverse set of highly-technical topics.

I reached out to the publisher for clarification of who this superhuman writer is.  He told me that Manning is indeed a real person who writes a certification guide every 1-2 weeks.

When asked about oversight, editorial review, basic fact checking and more (i.e., publishing 101), the publisher said there was none of that currently in place.

Manning seems to give new meaning to the term weekly reader; as in 2010 alone, he has written the following 32 guides, churning them out like weekly pulp fiction:

1. SCWCD: Sun Certified Web Component Developer CX-310-083 Exam Certification Exam Preparation Course in a Book for Passing the SCWCD Exam
2. SCDJWS: Sun Certified Developer for Java Web Services 5 CX-310-230 Exam Certification Exam Preparation Course
3. SCBCD: Sun Certified Business Component Developer CX-310-091 Exam Certification Exam Preparation Course
4. Basic Administration for Citrix NetScaler 9.0: 1Y0-A11 Exam Certification Exam Preparation Course
5. CCEA for XenApp Exam Certification Exam Preparation Course
6. CGEIT Exam Certification Exam Preparation Course
7. CIW v5 Foundations: 11D0-510 Exam Certification Exam Preparation Course
8. Implementing Citrix Provisioning Server 5.0: 1Y0-A06 Exam Certification Exam Preparation Course
9. MCSE 70: 290, 291, 293 and 294 Exams Certification Exam Preparation Course
10. SCJA Exam Certification Exam Preparation Course in a Book for Passing the SCJA CX-310-019 Exam
11. SCJD Exam Certification Exam Preparation Course in a Book for Passing the SCJD Exam
12. CWNA Certified Wireless Network Administrator Certification Exam Preparation Course
13. GSEC GIAC Security Essential Certification Exam Preparation Course
14. SCWCD Exam Certification Exam Preparation Course in a Book for Passing the SCWCD CX-310-083 Exam
15. Citrix Certified Administrator for Citrix XenDesktop 4 Certification Exam Preparation Course in a Book for Passing the CCA Exam
16. CISA Certified Information Systems Auditor Certification Exam Preparation Course in a Book for Passing the CISA Exam
17. Citrix Certified Administrator for Citrix XenApp 5 for Windows Server 2008 Certification Exam Preparation Course in a Book for Passing the CCA Exam
18. Sun Certified Network Administrator for the Solaris 10 Operating System Certification Exam Preparation Course
19. CISM Certified Information Security Manager Certification Exam Preparation Course in a Book for Passing the CISM Exam
20. CCSP Cisco Certified Security Professional Certification Exam Preparation Course in a Book for Passing the CCSP Exam
21. CCSP Cisco Certified Security Professional Certification Exam Preparation Course in a Book for Passing the CCSP Exam
22. CCDP Cisco Certified Design Professional Certification Exam Preparation Course in a Book for Passing the CCDP Exam
23. CCNP Cisco Certified Network Professional Certification Exam Preparation Course in a Book for Passing the CCNP Exam
24. CCIE Cisco Certified Internetwork Expert Wireless Certification Exam Preparation Course in a Book for Passing the CCIE Exam
25. CCIE Cisco Certified Internetwork Expert Voice Certification Exam Preparation Course in a Book for Passing the CCIE Exam
26. CCIE Cisco Certified Internetwork Expert Routing and Switching Certification Exam Preparation Course in a Book for Passing the CCIE Exam
27. CCIE Cisco Certified Internetwork Expert Storage Networking Certification Exam Preparation Course in a Book for Passing the CCIE Exam
28. CCIE Cisco Certified Internetwork Engineer Certification Exam Preparation Course in a Book for Passing the CCIE Exam
29. Cisco Certified Internetwork Expert - CCIE Certification Exam Preparation Course in a Book for Passing the CCIE Exam
30. CompTIA Strata - Green IT Certification Exam Preparation Course in a Book for Passing the CompTIA Strata - Green IT Exam
31. Check Point Certified Security Administrator (CCSA) Certification Exam Preparation Course in a Book for Passing the Check Point Certified Security Administrator
32. CompTIA Strata Certification Exam Preparation Course in a Book for Passing the CompTIA Strata Exam

First off, the breadth of technologies here is amazing. In fact, I doubt anyone on the planet has such diverse knowledge and experience in myriad technologies to author such detailed certification guides.

Upon pressing the publisher for more information, he told me that there is in truth no such person named William Manning.  He said it is a pseudonym for a retired senior IT Executive who lives in middle-America, and wants his anonymity now that his busy active career is behind him.

The man he would only refer to as Keith ran into family problems, and uses the writing of certification books as a way to cope with his troubles.

If that is the case, my heart goes out to the author; and I do hope he gets his life in order.  Unfortunately, for people in despair, it is hard to imagine that writing certification guides is a legitimate form of therapy.  Even if it somehow was therapeutic, the author’s gain is the reader’s loss, given the books limited value.

My hunch is that the publishers have simply outsourced the writing of these guides to countries where labor is cheap.  Given some of the spelling anomalies, and verbiage used, my guess is that these are written by a team of writers in India.

Between the CISSP, CISM and CISA books, there is significant use of the same text, including many of the same spelling and grammatical errors.

What the gatherers (hard to call them authors) would seemingly do is scour the web for data, reformat it to obviate plagiarism, and then print it in pulp fashion.  Using the CISSP guide, it is clear that the author is oblivious to the inner workings of information security.

While much of the certification questions are fact based; writing an effective certification reference is simply more than gathering multiple facts.

In the CISSP, CISM and CISA guides, there is not a single sentence written in the first-person, no real-world scenarios, or any indication that the author knew what they were writing about.  Good fact collection, but no insights or added value.

There are plenty of excellent study guide for the various certifications.  For those preparing for the CISSP exam, this is a book that should be avoided at all costs, literally and figuratively.  The newly printed CISSP Study Guide from Syngress for example, while twice the price of this book is significantly more helpful, and the Official (ISC)² Guide to the CISSP CBK is both authoritative and comprehensive.

/

When I first saw the title of How To Become The Worlds No. 1 Hacker by Gregory Evans, it reminded me a pitch I get from people trying to hawk Amway.  But just as there is a limit to the amount of people who can buy and sell soap, there can only be a single #1 hacker in the world.  With that, let’s hope no one buys this book, so Neo can keep his title.

The book does get your attention with its audacious title.  But a more appropriate title, albeit less flashy, would be The Not So Refined Art of Cut and Paste.

Using Princeton University’s definition of plagiarize of “take without referencing from someone else’s writing”, the book is a poster child for plagiarism. This is somewhat ironic in that the book has a disclaimer of “All rights reserved. No part of this book may be used or reproduced in any manner whatsoever without written permission except in the case of brief quotations embodied in critical articles and reviews”. 

This is a 342 page book, of which the first 25 pages are somewhat self-serving with an extended biography of the author, and dated letters of praise from former clients.

In short, this is merely a work of cut and paste.  In the parts of the book where the author attempts to write original text, it’s ripe with various errors.  I could list many such errors, but why bother.  In fact, the errors start in the preface, where the author calls GLBA the “Gramm-Leach-Billey Act”.

On page 5, the author states “first before you start any hack, security audit or any other computer security testing you must have all the write tools in place”.  Ironic that he meant to use the word right.

On the next page, he recursively writes about Wireshark when he says it was “originally named Wireshark, in May 2006 the project was renamed Wireshark due to trademark issues”.  It was actually originally named Ethereal.  But this is just one of many spelling, grammar, and factual errors in the book.  If nothing else, this book screams out for editorial review.  But it was self-published, with seemingly no oversight.

But the real offense is the author’s blatant use of unattributed sources.  I am not talking about a paragraph here or there, it is about wholesale plagiarism, often taking the form of an entire chapter.

Here are a few of the many examples of where the author copies extensively without attribution:

My approach until page 70 was to check the text against a Google search.  The results were immediate, apparent and undeniable: this book is a systematic cut and paste effort. 

Wanting a more sophisticated approach, I used the iThenticate plagiarism checker from iParadigms.  The iThenticate scan of the book confirmed what was obvious.  In fact, some sections averaged as high as a 95% plagiarism rate, with one chapter coming in at 100%.

While there is no hard and fast definition of where fair use ends and plagiarism begins, Bob Creutz, General Manager at iParadigms told me that “if I had to offer an average, I would say a 10% or greater similarity index warrants editorial scrutiny.”

Plagiarism.org notes that it comes down to the amount you've used.  The more you've borrowed, the less likely it is to be considered fair use. What percentage of your work is borrowed material? What percentage of the original did you use? The lower the better.

iThenticate is a powerful and fascinating tool, as it shows exactly what web sites the author copied from.  It identified the biggest plagiarized section, namely the 5,354 words, which is the entire chapter 12.  The author never mentions that he copied it verbatim from the Hacker’s Center Security Portal.

Even when plagiarizing, most authors will attempt to cover their tracks somewhat by making even trivial changes to the text; Evans never does that.  In the areas the original text has hyperlinks, he neglects to modify his text, in which the paragraph ends on a loose end, confusing the reader.

The author scoured the web and copied information from hundreds of web sites. And therein is the problem of such plagiarism; the output, in which the author calls a book, is a confused assortment of ideas, lacking a coherent stream of thought.

The books failure is not that it is plagiarized; even if the author would have attributed his myriad sources, the book still would have been equally incoherent.  This so called step by step guide is simply a disjointed set of topics, slurred together. 

For anyone who wants to learn the art of hacking, this book will only serve to give them a lukewarm taste at best, while confusing them the entire time.  Used copies of first edition of Hacking Exposed are available for 1 cent plus shipping in the used book section on Amazon.com.  Even though it is a decade old, it will serve you much better than this title.  As to How To Become The Worlds No. 1 Hacker, it’s an epic fail of a book.