(ISC)² Blog

The Attack of the Spiders from the Clouds

We have seen a lot of discussions of cloud computing in the news recently, as a technology to permit "users to access technology-enabled services without knowledge of, expertise with, nor control over the technology infrastructure that supports them." This sounds great doesn't it?! Users with little to no IT expertise can log into the cloud and launch 8 instances of a server with the equivalence of 16 high performance CPU cores. However, as we all know, all things, including cool technologies, have the potential for both good and evil, opportunity or threat; and cloud computing is no different. It just... Read more →

Making the phishers' job easier

This morning I spotted an unusual phisher in my inbox, using "We've changed our privacy policy" as the lure. It came from a site I didn't immediately recognize, with a classic phisher call to action "Visit your profile page by logging into your account" and with displayed hyperlinks differing from the actual URLs. The alarm bells rang inside my little head, thinking that the phishers had found another cunning lure. Except that on closer inspection, this one appeared to be a legitimate email, not a phisher after all. The company in question had changed its website privacy policy and was... Read more →

The Cautionary Tale of the San Francisco Network Lockout

I'm sure most of you have seen the news of the San Francisco IT administrator who allegedly locked top administrators out of the city's network. While the mayor was able to obtain the codes from the city employee, the story has obviously been a PR nightmare for the city and a difficult challenge for the city's network administrators. It brings to mind basic questions for all information security professionals to consider, so a similar situation doesn't occur at your organization. This is a classic example of what a disgruntled person with elevated privileges can do in any enterprise, either encrypting... Read more →

Your Social Security Number (SSN) - Shouldn't you Control It?

Last week, I saw two stories on a local television network, about two different local organizations that exposed Social Security Numbers (SSN) through two different forms of media: electronic communications and the U.S. Mail. I have chosen to leave the names of the organization absent in this posting, because the stories are not important, but rather the level of importance these stories had as compared to other less related stories. In the total of roughly 5 minutes given to these individual stories through a local news station, the impact has left me thinking about how desensitized our society must be... Read more →

Advice for the Newbie IA Professional (Part 1)

For my first article, I thought it would appropriate to provide some advice on what it takes to be an Information Assurance Professional. I am doing this for a couple of reasons. First, as a new manager at my job, I find myself frequently mentoring up and coming IA professionals or those that want to join our ranks. Second, a father of a toddler who loves playing anything electronic (especially if it lights up and make sounds), I wanted to write an open letter to my son Jack in case he wants to follow in his dad's footsteps and I'm... Read more →

Introduction to Lawful Interception Systems

A lot of people are asking me about Lawful Interception Systems, so I had the idea to present some basic concepts about this technology here. Introduction Lawful interception is the legally sanctioned official access to private communications, such as telephone calls, e-mail messages, instant messages or VOIP communications. In general, LI is a security process in which a network operator or service provider gives law enforcement officials access to the communications of private individuals or organizations. Architecture Although the details may vary from country to country or vendor to vendor there are a general set of logical and physical requirements... Read more →