(ISC)² Blog

The Promises and Perils of Twitter

One year ago I penned Event Processing in Twitter Space, and today parts of the net are buzzing about Twitter. In a nutshell, Twitter is a one-to-many communications service that uses short messages (140 chars or less). Following on the heels of the blogging phenomena, Twitter has been primarily used for microblogging and group communications. Twitter, and Twitter-like technologies, has great promise in many areas. For example, you could be subscribed to the @tsunamiwarning channel on your dream island vacation and get instant updates on potential disasters. A team of people working in network management could subscribe to the @myserverstatus... Read more →

Proceeds of crime

The Supreme Court of Canada has struck down a challenge to a provincial law enabling seizure of proceeds of crime. Under the provincial law, proceeds could be seized under a civil action, without a conviction for a crime having taken place. A report appeared in the Vancouver Sun. The challenge appears to have stressed the jurisdictional issues. (In Canada, criminal law is a matter for the federal government: the provinces do not make their own criminal laws.) However, there is also the matter of burden of proof. Under criminal law (under a Common Law system, at any rate), the charge... Read more →

Childnet International

In terms of security awareness for kids, Childnet has some publications and resources that you might find useful. The overall tone seems a tad commercial and self-promotional, but that doesn't mean that you can't take what has value and ignore the rest. Read more →

Telefônica Brasil hit by a massive DNS attack

Last week, Telefônica Brasil was victim of a large DNS attack that shut down all their DNS farms affecting millions of broadband users for 3 days. Additional info can be found at the following locations (portuguese): http://tecnologia.uol.com.br/ultnot/2009/04/09/ult4213u703.jhtm http://g1.globo.com/Noticias/Tecnologia/0,,MUL1079950-6174,00.html 6 months ago I wrote a post called "Securing DNS Servers" describing how to implement some security layers to increase the DNS farm performance and overall security. It's important for us, Security Professionals to show to companies (Telco, Gov or Enterprises) the risk involved with critical services (like DNS, but not only) and the value of implementing procedures like BCDR. Not forgetting... Read more →

Building Security In Maturity Model (BSIMM)

The Building Security In Maturity Model (BSIMM) is a good framework to follow for secure software development. Those who are familiar with the various Capability Maturity Models may be a bit surprised: this model doesn't come from the same institution and doesn't follow the same pattern. It's more of a breakdown framework, with a checklist of points to address, with some assignment to limited maturity levels. Read more →

IT Security Essential Body of Knowledge (EBK)

From the US-CERT and DHS, a framework outlining IT security topics and levels (manage, design, implement, evaluate) to various IT security roles. As of the 2008 document it is fairly limited, but provides a good starting point. Read more →

Twitter feed

For those preferring to get notifications of additions in a different way, I'll be posting links to new entries on Twitter. (Of course, I'll be posting other stuff there as well.) I'll try to remember to post links to both http://www.infosecbc.org/links and http://blog.isc2.org/isc2_blog/slade/index.html Read more →

Diagramming a Secure Connection

I was listening to a recent Security Now podcast that reviewed some important cryptography concepts, when Mr. Gibson made an interesting point: "let's assume that we have control of each end, but we have no control at all of the link between, i.e., the Internet. So that means that our communication is subject to having bits dropped, bits added, bits changed, and even bits replayed, things, packets replayed." This made me think about how we describe these type of connections, visually. The picture commonly drawn on a white board to describe a secure channel over the Internet (and I am... Read more →

Information Technology Infrastructure Library (ITIL)

It's not always easy finding the real ITIL among the crowd of people (and Websites) wanting to jump on the bandwagon. (Nor is it made any easier by the fact that they keep changing the site.) Anyway, here 'tis currently. Read more →