ISC2 Blog

Computer: 0, Toaster: 1

ISN sent out an interesting article, apparently a gentleman at Clubhack in India showed off his Computer hacking toaster. While this does scream "PR stunt" to me, the point he is trying to make still holds true - one must keep security in mind at all times, for when you least expect it, kitchen appliances might come after you, too... Read more →

Playing “Hide and Seek” with Obsolete Data

Many information security professionals have been giving considerable thought to the eradication of sensitive data that is no longer needed. Those of us who are responsible for regulatory and industry standards compliance must deal with potential information “leaks” that may occur when computer or network components are discarded or recycled. Unfortunately, none of the current regulations or industry standards includes the detailed steps that must be taken to avoid this problem. This means that each of us needs to consider the available options and then use his or her best judgment in choosing the approach to be followed. There are... Read more →

Security in process automation systems

How to protect process control systems (DCS / Scada) against cyber attacks? ISA SP 99 NIST SP800-82 OLF guideline 104 Read more →

How to let CS students learn about security

While reading a story about a security incident at the University of Pennsylvania, one particular line stood out: "In addition, Engineering students must now register for permission to run CGI script, a technology used in web servers." Having been out of the academic setting and being used to running security labs at corporations, this surprised me. The first thing I do nowadays when setting up a lab is place it in a DMZ separate from any other production equipment. One would think that a CS department would do the same thing, but after talking with several colleagues, this doesn't appear... Read more →

Enterprise Architecture and Information Assurance

As we all know the requirements of the federal government and enforcement of Information Assurance has hightened in the past years. With the incorporation of Gramm, Leach, Bliley Act (GLBA), the Sarbanes Oxley (SOX), and the Clinger-Cohen Act, it seems that we have multiple requirements with a mixture of standards. To couple the confusion [as some may see it] we have CoBit, ITIL, MOF, ISO, and other frameworks that our clients wish to incorporate into thier infrastructure. Business Service Management (BSM) holds many challenges; CSCI approaches BSM in a little different light than most organizations by identifying the lowest common... Read more →