Actually just realised. The CyberSecPolitics blog has book reviews. The guy clearly knows what he’s talking about so I have no qualms saying he probably can do better book recommendations than I can.