ISC2 Blog

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, June 26, 2009 Infrastructure Report for 22 June 2009 Are you ready to adopt a Microsoft antivirus service – It is free? 37. June 18, CNET News – (International) Microsoft’s free antimalware beta on the way. Microsoft will launch a public beta of its anti-malware service, Microsoft Security Essentials, on June 23 as it phases out its Live OneCare suite in favor... Read more →

Passwords are dead - long live passwords

Over on CISSPforum, a zombie topic about passwords has risen from the dead yet again. This time, someone suggested making it a "condition of employment" that "If you cannot remember a username and password, find employment elsewhere." Well yeah but no but. A username and A password, even a reasonably strong one, would be just fine for most people. Unfortunately, we need loads. As information security pros, isn't it part of our rôles and responsibilities to make information security as low-impact as possible on the organization (including its 'most valuable assets', the people) without unduly compromising the level of security?... Read more →

A Hidden Danger in Cloud Computing

Back in the days when I was happily spending time on the operations floor in computing centers, we always observed that the greatest security threats to our systems were well-intended operators who make simple mistakes. No hacker or criminal ever brought down a network like the bored network guy on the late shift who decided to upload a new version of the Cisco IOS on all the routers of a global ISP without testing first. A bug in the IOS release caused every router go down, one-by-one. I remember being called into work to fix the problem (had to send... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, June 19, 2009 Infrastructure Report for 15 June 2009 Watch out for Keykeriki. It captures wireless keyboard strokes! 38. June 11, VNUNet.com – (International) Symantec warns of wireless keyboard security threat. Security firm Symantec has uncovered a new form of attack aimed at users of wireless keyboards. The warning follows the release of Keykeriki, an open-source “sniffer” project that allows users to... Read more →

The folly of annual "awareness training"

Hord Tipton is quoted in a rather curt piece on GovInfoSecurity referring to the "Need to provide federal employees awareness training more often than once a year because of the ever-changing challenges IT security presents". Right-on Hord! I realise I'm quoting a small extract from a short piece about a press interview, but still there's much more to it than Hord's statement implies. I hope you'll forgive me a short but passionate rant ... 1. It's not just federal employees who need more than once-a-year training. The same applies to everyone, including employees (staff, managers, IT professionals, temps, contractors, consultants,... Read more →

Reflections on the Comprehensive National Cybersecurity Initiative

As an (ISC)2 member and a practitioner of Computer Network Defense, I was a bit surprised that no one has done an (ISC)2 blog on the Comprehensive National Cybersecurity Initiative (CNCI) which was released back on 6/1/2009. So I thought that I dip my toe into the pool and see what happens. Like many others, while I am cautiously optimistic about President Obama's new cybersecurity policy and the appointment of a new "cybersecurity coordinator," though much depends on the details. From what I read of the report, there was a lot of discussion of the history of cybersecurity and the... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, June 12, 2009 Infrastructure Report for 8 June 2009 Perhaps You Should Consider Blocking Some Search Terms! 25. May 28, SC Magazine – (International) McAfee documents riskiest search terms. A McAfee study into 2,600 of the most popular keyword searches on the web has concluded that hunts for “screensavers” present the most risk. The report released the week of May 25 shows... Read more →

Bandwidth Caps Means Bad Security

Bandwidth caps: they're coming, and the ISP's really want them. Why? They can charge you a flat rate for, say, 5GB a month, such as is already done by Sprint and AT&T for their wireless broadband offerings. With 5G a month you can do a lot of email, some web browsing, perhaps a Hulu video or two. But what happens when you go over that 5GB in a month? You get charged by the megabyte, say 5 cents/MB. So customers using bandwidth caps need to be parsimonious with their Internet usage. Gone are the days of being able to download... Read more →

Open Source Computer Forensics Manual

The Open Source Computer Forensics Manual doesn't have a lot in it, and it only covers the basic approach, but it is reasonable at that. Maybe someone can get the project restarted. Read more →

US Cybercrime site

US Department of Justice Computer Crime and Intellectual Property site with news stories, related (US) laws, and some documents related to digital evidence, investigation, and prosecution. Read more →

Expectations for Computer Security Incident Response

RFC 2350 is a 1998 version of what incident response teams should and shouldn't be and do. Also, CERT.ORG has advice and step-by step instructions on creating a computer security incident response team. Read more →

Don't Sue Me, Sue the Auditor

The recent Wired article In Legal First, Data-Breach Suit Targets Auditor discusses how a credit card company is suing the company that performed their security audit. The problem is that the credit card company was told that it was CISP (Cardholder Information Security Program) compliant, when it really wasn't. Per visa.com, "CISP is intended to protect Visa cardholder data–wherever it resides–ensuring that members, merchants, and service providers maintain the highest information security standard" (CISP has since been replaced by the PCI (Payment Card Industry) standard.) The lawsuit was triggered by the theft of 263,000 card numbers from the credit card... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, June 5, 2009 Daily Open Source Infrastructure Report for 1June 2009 Perhaps You Should Consider Blocking Some Search Terms! 25. May 28, SC Magazine – (International) McAfee documents riskiest search terms. A McAfee study into 2,600 of the most popular keyword searches on the web has concluded that hunts for “screensavers” present the most risk. The report released the week of May... Read more →

Managing Information Security in an Economic Downturn

:01 – Introduction :35 – Vlog topic: Managing business and your career in downturn economy 1:45 – Elevated crime threats 2:22 – Company survival through the tough times 3:10 – Importance of a company’s risk profile 3:37 – Update your security plan 4:20 – Final recommendations 4:50 – Next vlog topic Read more →