(ISC)² Blog

Bundling Security with the OS

Mac OS 10.6 (Snow Leopard) is being released tomorrow, and with it a much-improved version of File Quarantine, security software bundled with OS X. CNET posted an early review of the OS and states "File Quarantine checks for known malware signatures and displays an alert dialog if it finds a known offender and will be automatically updated via Mac OS X's software update as new malware signatures are found in the wild." This levels the playing field somewhat between it and the latest versions of Windows because, the article continues, "Leopard has some ASLR but everything is not randomized and... Read more →

Should the CISSP CBK be improved to place greater emphasis on “human factors” in information security? Definitely Yes!

Should the CISSP CBK be expanded to cover "human factors" in security? [1] Add “Human Factors” No.[2] Clearly, human factors are a major component to information security and Gary Hinson presents effective arguments that they should be established as an additional domain. On the other hand, Rob Slade makes an effective argument that the human factors are a significant component of each of the current ten domains primarily based on his experience teaching the CBK® to CISSP® aspirants for (ISC)²®. In full disclosure, I also teach the CBK® to CISSP® aspirants, but not for (ISC)²®, but at a local college.... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, August 21, 2009 Infrastructure Report for 17 August 2009 A bug fix takes two years to release! Should this be where you place your trust? 48. August 14, The Register – (International) MS Zero-day security bug was two years in the making. A flaw in Office Web Components which Microsoft fixed on August 11 was first reported to the software giant over... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, August 14, 2009 Infrastructure Report for 10 August 2009 Now Twitter. What is next? 34. August 6, Associated Press – (National) Hackers attack Twitter, Facebook also slows down. Hackers on August 6 shut down the fast-growing messaging service Twitter for hours, while Facebook experienced intermittent access problems. Twitter said it suffered a denial-of-service attack, in which hackers command scores of computers toward... Read more →

Add "human factors"? No.

OK, Gary has asked if the CISSP CBK should be expanded to cover "human factors" in security? And I answer "No." With that kind of beginning, you could be forgiven for thinking that I disagree with Gary about the importance of human factors in security. Nothing could be further from the truth. I agree with everything he has said about the fundamental significance of human factors in information security, as well as the difficulty of dealing with them, and will defend to the death his right to say it. What I disagree with is the question. The CBK already addresses... Read more →

Should the CISSP CBK be expanded to cover "human factors" in security?

Of all the areas in information security, human factors are the hardest to understand and even harder to influence or control, yet are often the deciding factors that make or break security in practice. "Human factors" here includes answering questions such as what motivates hackers to hack, employees to follow or ignore policies and procedures, designers and developers to build-security-in, and managers to invest in security and compliance? Does it matter that some people respond to threats and others to incentives, and that none of us is consistent in this? And how can we best influence them all? As information... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, August 7, 2009 Infrastructure Report for 3 August 2009 So you like, use or manage Apple Mac computers. Then, you should be aware of the following! 38. July 31, SmartCompany.com – (International) Apple computers vulnerable to new cyber attacks, expert warns. Apple Mac computers are not foolproof and can be manipulated by hackers despite their virus-free reputation, a security expert has warned... Read more →

Part 1: Identify and Reduce Attack Surface in Applications

This is continuation of my previous post on Defending Information Assets by Reducing the Attack Sutface Identify and Reduce Attack Surface in Applications An application’s “Attack Surface” is the areas where an application is vulnerable and can be exploited. As per Wikipedia definition, "Attack surface in a software environment is the scope of functionality that is available to unauthenticated users. In other words, how much can a piece of software do in its default configuration by unauthorized users". An attack surface comprise of application entry points, program code, other vulnerable applications installed on the same server etc. A malicious user... Read more →