(ISC)² Blog

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

The DHS Daily Open Source Infrastructure Report (DHS) covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Should you not be aware of even one of the items discussed below it would be wise to familiarize yourself with it. The headline above each entry will take you directly to the DHS report which presented the item for ten business days from the date of inclusion. The Source link will take you to the original source cited by DHS. A relatively quiet... Read more →

Ant Security

An interesting computer security project has been underway at Wake Forest University. They have been developing threat detection software that mimics the behavior of ants. About a decade ago I read the book Turtles, Termites, and Traffic Jams: Explorations in Massively Parallel Microworlds (Complex Adaptive Systems) which, among other things, went into detail about the pherenome trail left by ants. The ants would go out on discovery missions, looking for food, leaving in their wake a scent trail. If a place of interest was discovered, the scout would return back on the same trail, making it stronger, and other ants... Read more →

Some Background Notes on the Consensus Audit Guidelines (CAG)

Here's some background on the CAG (Consensus Audit Guidelines). The Red Teams have consistently proved that poor configuration and patching practices have made it easy for them to defeat network defenses. This determination lead to the Air Force approaching Microsoft and insisting that new desktop software application come with a standard secure configuration. This was the genesis of what is now known as the Federal Desktop Core Configuration (FDCC.) FDCC uses Red Team knowledge about attacker techniques to protect systems and network vulnerabilities used by attackers to break into systems. This in turn, has led to the Twenty Critical Security... Read more →

DoD IA Policy Chart

For your information, the Defense-wide Information Assurance Program (DIAP) has just released the IA Policy Chart via the IATAC web site at http://iac.dtic.mil/iatac/ia_policychart.html. The chart, plus background notes can be found at that site. In addition, the IA Policy Chart will be included as a centerfold in the January 2010 edition of the IATAC’s IAnewsletter. The goal of the IA Policy Chart is to capture the tremendous breadth of applicable policies, some of which many IA practitioners may not even be aware, in a helpful organizational scheme. The use of color, hatching, fonts and hyperlinks are all designed to provide... Read more →

Cloud Computing - My concerns

After a long absence due to long and stressful project "46 hours working straight was common" I'm back Sure, I missed to blog here!!! I'm reading a lot about Cloud Computing and how fantastic it is, but I have to wonder... What about the security aspects???? Well, no rush...Let's start from the basics What's Cloud Computing? Cloud computing is a paradigm of computing in which dynamically scalable and often virtualized resources are provided as a service over the Internet. Users need not have knowledge of, expertise in, or control over the technology infrastructure in the "cloud" that supports them. The... Read more →