ISC2 Blog

Security Certification – Standards for the Government IT Workforce

According to a recent GCN article, the federal government (civilian agencies) may be releasing a standardized list of security professional certifications required by the IT workforce that could see lasting benefits, however initial incur some immediate challenges. Benefits: The most obvious benefit would be the development of an assurance baseline for government security programs. Through the issuance of minimum qualification requirements for each staff position, the government could reduce staff qualification deficiencies, and optimize costs needed for an highly trained IT security workforce. The government must be agile, and must understand the competency of their security staff and IT professionals... Read more →

Are we crying wolf?

A short article by David Hobson on the Catalogue eBusiness site caught my imagination this morning. David deconstructs the costs that an organization incurs when it suffers a major information security breach. Summarizing and paraphrasing the article, the identified costs break down as follows: Obvious, direct or tangible costs such as: Replacing stolen equipment; Improving security controls to stop the losses and prevent recurrence; Notifying affected parties; Defense against litigation such as customer lawsuits, plus fines and damages; Further costs such as credit monitoring for affected customers and fraud settlements with banks/credit card companies; Concealed, Indirect or intangible costs such... Read more →

Education, Education, and Education

I've just been catching up with Gary Hinson's excellent piece on security awareness. We've been having a somewhat related debate in the anti-malware industry on the usefulness of user education and training for many years, on and off. In fact, I was engaged in a lively resurgence of the topic on a specialist mailing list just a few weeks ago. In general, the community tends to polarize into the "If education was ever going to work, it would have done so by now" faction and the "Education is the most important weapon in the security professional's armoury" faction. In fact,... Read more →

Ethical Hacking Careers

There was a presentation by Donald Donzal, CISSP, at the SANS "WhatWorks in Pen Testing Summit" on the subject of "Remodeling your career for little to no money down.". (If you are getting confused with all the links, this is the one to click.) Donald is giving a number of very useful hints that would be valid for all careers, such as "do what you love", "quitting a job is easy, making the decision is difficult". So the underlying theme is what you would expect from most articles about self improvement. That being said, it's still encouraging to hear someone... Read more →

Choosing the right security personnel

Simon Heron just published an interesting podcast on Help Net Security, covering the art of finding the right security personnel. I invite you to listen to it yourself, some key points include the requirement for experience ("there is no substitute"), training and the natural curiosity that security bring to work and the intellectual stimulation they crave. I have often found this confirmed, it's something that companies need to be aware of when the training budget seems like an easy target for cost saving, once again (it worked last year... and the year before...). In the long run, such companies will... Read more →

RBAC - How to Eat the Elephant

One of the current niche's within the Identity Management space is that of RBAC - roles based access control. RBAC is not a new 'niche' or indeed a new framework, but has seen a wave of interest in recent years with numerous small independent vendors (as well as the usual players) entering the market and creating a buzz. The increased interest has been driven by several factors including general audit compliance and the drive for simplified account administration. But the main one I believe to be is the general maturity of Identity Management and the missing link of roles enforcement.... Read more →

Where Is Your Sensitive Data?

Data, data everywhere, but nobody knows where it is. How much time have you spent looking for a particular document in an unstructured shared repository? When people collaborate they often haphazardly name documents and directories which does not necessarily make it easier for others to find it. Not knowing where the data is when you need it is a classic availability problem. When data is temporarily lost productivity drops, tempers flair, and frustration abounds. A lack of document management is not only a productivity problem, but a security one as well. Sensitive information misplaced may be located in a directory... Read more →

Security awareness: a 'How not to do it' guide

I spent a few hours at the weekend viewing/listening to a series of presentations to accompany the launch of the Information Security Awareness Forum (ISAF) in London. I won't bore you with all the details right now but one item in particular caught my eye/ear. One of the presenters essentially said that security awareness doesn't work, a somewhat curious point to make in support of a security awareness initiative. Anyway, it's not the first time I've heard the argument and I've been mulling it over ever since. My blood having dropped just below boiling point, it's time to respond. Today... Read more →

Incompetence or a deliferate mistale?

Hot on the heels of news in the British press last week about secret intelligence papers relating to Al Quaeda being found on a train comes news of a second incident, this time concerning Iran. Being a slightly paranoid CISSP, of course, my thoughts turned immediately to 'leaks' deliberately sanctioned by Whitehall or the government - misinformation, propaganda and counterintelligence, designed to throw Britain's enemies, Johnny Foreigner, off the scent. But then I started to wonder about the possibility that Al Quaeda themsleves might be implicated in the 'accidents', perhaps some sort of dispute with one of their agents/moles? Why... Read more →

What Does "In the Wild" Really Mean?

I imagine that anyone in our business who has any interest in malware matters is aware of the WildList Organization International, or at any rate of the WildList itself. The WildList is a list of viruses (not, generally speaking, non-replicative malware) known to be spreading "in the wild" (ItW, in AV jargon). How do we know it's spreading (or has been fairly recently)? Because to make the main list, it has to have been reported and a sample submitted by at least two WildList reporters (mostly representatives of anti-malware vendors, and invariably with proven expertise in the field). In fact,... Read more →

The ROI of Security Certification - Part 2

This is the sequel to my last post on "the ROI when we certify." Certification can sometimes be a tough sell to upper management. For some reason, C-suite executives "get" technology solutions now but have never fully appreciated the people side of the security equation. While certifications are just a piece of the puzzle when it comes to someone's qualifications, they are an important piece that indicates someone has an ethical and professional commitment to their field. Here are what I consider to be the top 10 business reasons for certification. I'm sure most of these have been mentioned before... Read more →

Security metrics are your friend

Benefits of Security Metrics In my opinion, one of the more valuable components of a security program that (unfortunately) doesn't receive the attention it should is metrics A successful security metrics program can benefit an organisation in various ways; It serves as a measuring stick for effectiveness of security controls; This can demonstrate to management (and the entire organisation) how effective the existing controls are compared to the number of threats being targeted againstt the network. e.g. 500 e-mail viruses detected and stopped at the gateway per day and none reported at the desktop or mail server -- provided there... Read more →

Challenges to sell Information Security products and services

Selling most of information security services and products is a challenge to the vast majority. The reason is that security is generally something to prevent the company from the possibility of losing money (whether by the leak of information, fraud or any other way), and it is neither just some money that you spend today to make profit tomorrow, nor something that you can use to cut costs and make your company more. Except for some mature companies, which, in general, take security seriously and consciously invest a lot of money in information security, most of the other companies have... Read more →

Are anti-virus applications a waste of money?

While browsing through the security headlines the other day, I came across an article where Cisco’s CSO, John Stewart, proclaimed that anti-virus software and security patches are, “… completely wasted money.” His justification for this statement was due to the large number of, “companies in the world that actually believe infection is just a cost of doing business and are getting used to doing it--as opposed to stopping it completely.” Now, though my work history, I have failed to witness organizations that view a virus infection as a commonplace occurrence. This was because the organizations that I have been associated... Read more →

Cyberbullying Defined in H.R. 2163

In The Top Ten Cybersecurity Threats for 2008 Revisited we mentioned that one of the top cybersecurity threats for 2008 was on-line masquerading to abuse, attack, blackmail, bully, extort, or molest others. Illustrating how important this threat has become, Rep. Linda Sanchez (D-Calif.) and Rep. Kenny Hulshof (R-Mo.) proposed a federal law that would criminalize acts of so-called cyberbullying (PDF). In this legislation, H.R. 2163, cyberbullying was defined as followed: Cyberbullying "a) Whoever transmits in interstate or foreign commerce any communication, with the intent to coerce, intimidate, harass, or cause substantial emotional distress to a person, using electronic means to... Read more →

WARPed and Proud of it

On Tuesday 4th June, the 4th Annual WARP forum was held in London. Unfortunately, I had to drop out at the last moment, but I retain a keen interest in the WARP (Warning, Advice and Reporting Point) concept, so I'm going to take the opportunity to introduce you to the idea, if you're one of the many security professionals who haven't come across it. A WARP is a sort of junior CERT/CSIRT ("small, personal and not-for-profit": it represents the interests of a fairly narrow community, and there isn't a presumption of high-grade security knowledge on the part of the WARP... Read more →

Data Leakage Protection in Europe?

Greetings, dear colleagues. It is my first blog in this forum, so I thought why not start with a question: do you think that DLP solutions will catch on in Europe, with its more stringent employee and data protection laws than N.America? In the interest of "full disclosure", I do not own equity in any firm producing any such software and this is not a product push. I was thinking that, surely, companies in Europe must face similar dangers (IPR loss, malicious employee behaviour, competitive pressures, etc), so will similar solutions be applied in Europe / the EU? It is... Read more →

Information Security & the ROI & Insurance Myth

Since its inception, the information security field has struggled with the issue of trying to provide a ROI on security initiatives when competing for budget dollars. But unlike other departments within an organization, security is handicapped from the very start when using the ROI approach. Many of us have created ROI numbers when developing our annual budgets or when attempting to purchase a piece of technology, but often times with limited success. I have read where many security practitioners have simply given up on the notion and goal of attempting to produce ROI numbers altogether. Some have gone as far... Read more →

The Top Ten Cybersecurity Threats for 2008 Revisited

Last year I published The Top Ten Cybersecurity Threats for 2008 at The CEP Blog, motivated by a plethora of "top 10 threat lists" that confuse vulnerabilities and threats. A number of fellow CISSPs and security colleagues on LinkedIn (thank you!) collaborated on the list: The Top Ten Cybersecurity Threats for 2008 On-line masquerading to abuse, attack, blackmail, bully, extort, or molest others. Criminal fraud by password and identity theft via phishing, spyware, malware and theft of hardware. Criminal use of botnets and botnet-like technologies for economic gain, for example email spam and denial of service attacks. Cyberterrorism, bulling, vandalism... Read more →