(ISC)² Blog

Ethical Dilema

You are at the practice for your child's sports team. You strike up a conversation with the manager of the sports organization. He is complaining that his company's PCs are on the fritz: running slower and slower, some programs don't work anymore, one crashed altogether. You say that this may be due to a virus or malware, and that you can take a look. He refuses politely, saying his PCs are managed under a contract with a vendor; they are the only one who can do maintenance under the agreement. You push back, saying it might be a security problem,... Read more →

Revising Enterprise Telework and Remote Access

NIST (National Institute of Standards and Technology) recently updated their guidance for Enterprise Telework and Remote Access Security, DRAFT NIST SP800-46 Rev.1. As many are aware, security professionals are constantly considering the security ramifications of employees accessing the corporate network from home and other insecure locations. This includes the use of home systems to connect to the network, corporate laptops from remote locations and the potential of infected mass storage device. This special publication is and update from the previous special publication - SP800-46, Security for Telecommuting and Broadband Communications intended to help organizations understand and mitigate the risks of... Read more →

Initial report of the Fast Flux Hosting Working Group of the GNSO

Fast flux, the rapid rotation of DNS records to point from a single domain name to a number of separate machines, is widely used in malware serving, phishing scams, and other related net nastiness. Unfortunately, the basic concepts are also used for legitimate purposes, such as performance enhancement on large and popular sites, or the prevention of net censorship. The initial report of the Fast Flux Hosting Working Group of the Generic Names Supporting Organization (GNSO)of ICANN (Internet Corporation for Assigned Names and Numbers)contains a good deal of information and thought, and should receive wider dissemination and consideration than it... Read more →

Resources and references

I keep forgetting there is already a lot of stuff I've put out there. I guess there have been some changes recently, so I guess I should send it out again. These might be useful for your own self-study, continuing education, and research, or you might want to pass it along to those who are studying for the certification. There's a list of books and resources by domain. Also a glossary of (newer and updated) security terms. A comparison of the various CISSP guides. At one time I set up a list of security sites of various types. With the... Read more →

Injecting the Common into Security

According to several news articles Friday, February 20th, and documented on hackersblog.org by the hacker named Unu, the Security and A/V "giant" Symantec had a bit of a website face lift as a result of a SQL-injection vulnerability within the website. The website was defaced as can be seen in the following image: The stories and associated blog references can be found at the following links: http://www.itp.net http://news.softpedia.com http://www.hackersblog.org Granted, based on the articles and information so far, the "ethical hacker" Unu used this method of notification to "help" alert Symantec to the problem. Outside of the ethical issues surrounding... Read more →

How to spot the next big thing that spots next big things

A new company is telling everyone which new companies are worth investing in. Is this something we should get into? http://news.bbc.co.uk/go/em/-/2/hi/technology/7900463.stm "The software measures the "buzz" surrounding a company via blogs and media reports along with a variety of factors including website traffic." We should all blog and Twitter about this. Then we should all blog about how blogging is so last year. (There are just so many things wrong with this ...) Read more →

BC (Canada) Provincial Emergency Program Hazard Plans

A good set of plans for emergency response, both as resources and as templates for your own emergency documents. Read more →

Disaster Management Canada

Free (electronic version) business continuity/disaster response magazine. Possibly only in Canada. (Pity.) Read more →

Read it and weep that you don't have a larger training budget ...

Wanna know what other security conferences you might be missing out on? Even this list isn't quite exhaustive. You might also want to check out http://iki.fi/japi/security.html#conf Read more →

NIST Special Publication (SP) 800-53 Rev. 3 (Initial Public Draft)

On February 5, 2009, NIST released a major revision to NIST SP 800-53. This is the third revision of the original document widely known among the federal government as the abbreviated 800-53, includes significant changes to the various control baselines ("Low", "Moderate", and "High") used as a basis for assessing the effectiveness of the security of federal information systems. The changes also reflect adding additional controls that have not been assigned to a control baseline, but may be assigned in the final release or added in future updates: AC-21 (User-Based Collaboration and Information Sharing) CM-9 (Configuration Management Plan) SC-25 (Thin... Read more →

The crypto hamster wheel

A recent public demonstration by a team of researchers from the Netherlands, Switzerland and California in which they successfully created fake digital certificates provides an interesting case study in lifecyle management for cryptography. The team exploited technical and procedural vulnerabilities in some public Certificate Authorities (CAs) to obtain fake SSL certificates that would be trusted by most web browsers. There are serious implications for the financial services industry, users of VPNs and others. Others have published more frivolous but equally worrying demonstrations of deliberately crafted MD5 hash collisions. Key to the SSL certificate exploit was a technical weakness in the... Read more →

Google's Self-Inflicted Denial-of-Service Attack

Over the years most of us who have "been around the block" in IT operations have always said, based on experience, that one of the biggest looming threats to IT operations is always a well intended employee who makes an honest mistake. I can recall discussing this topic almost daily with my honorable USAF colleagues, including Col. (R) Glenn Watt, Col. (R) David Gruber, and Maj. Gen. (R) Bill Donahue, all experts in IT operations and IT operational risk. Even before those memorable days consulting for the USAF, I can recall one of my first UNIX projects with General Electric... Read more →