(ISC)² Blog

SecLists Archive

The SecLists.Org Security Mailing List Archive collects and archives a number of security related mailing lists, although it concentrates on those dealing with networking and exploits. It also provides a portal to the lists themselves, so it's a valuable resource for those looking for lists. (Check out Funsec and RISKS.) Read more →

They call it Cyber Monday (but Tuesday’s just as bad)*

In the US, the holiday season is approaching fast, with Thanksgiving a week away on 26th November. I guess most of us outside the US are aware of Thanksgiving if we work with Americans, since almost the entire country closes down on the 4th Thursday in November. (Apologies to the Canadians in the audience, who had their own Thanksgiving celebration back in October.) However, fewer people outside the US will be aware of Black Friday (the day after Thanksgiving) and Cyber Monday (the following Monday – that’s the 30th November this year) unless they’re in global retail. Black Friday isn’t... Read more →

DataLossDB

The Open Security Foundation's (OSF) DataLossDB project is an interesting resource for information about data and confidentiality breaches. At a glance, it gives you news, latest breaches, a timeline of breach numbers, a "top ten" list, and other references you can use in security awareness materials, or for risk analysis. Read more →

Data sanitization

This article is originally from the IEEE Security and Privacy magazine, circa 2003. As such, some of the programs noted are out of date or obsolete. However, a number are still available and in use, and the basic concepts outlined are still valuable. Read more →

Pig hackers

Amusing video from the BBC. A report on pigs managing to figure out how to get more food from an automated control system. If even pigs can (accidentally) figure out how to defeat access controls, what do you have to do to prevent determined attackers? (Actually, pigs are pretty clever critters ...) Read more →

Botnets? Not a problem...

An article in PC Pro by Asavin Wattanajantra quotes Dr Steve Marsh, who is deputy director at the Office of Cyber Security in the Cabinet Office, as saying (in respect of EU policy on protecting Europe from cyber attack, whatever you may understand by that term) that: "the main focus of botnets would be to target and extort money from private companies, rather than bring down public sector networks [and] .... in a sense [it is] not in their interest to bring down infrastructure which is earning them money." This isn't a million miles away from something I was saying... Read more →

US cyber policy review

This paper, directed from the US White House, may be the structure for US information, networking, and infrastructure policy over the next seven years. While vague, it does give some indication of directions. Read more →

Social armour

A blog posting from Eset outlining some basic tips for reducing the risks associated with social networking/social media/Web 2.0 activities. Read more →

Psych and sec

Ross Anderson has put together a great page of links about psychological factors in security. Quite a few resources and papers on deception and social engineering, usability, risk calculations, economics, and more. Read more →

California Shakeout

Resources, instructions and tips from the government of California on earthquake preparedness. http://www.youtube.com/watch?v=o7eGZEY5wEM Read more →

Security awareness video

If your organization relies on "proximity cards" or "swipe cards", or even good ol' fashioned staff passes, to restrict access to secure areas, I heartily recommend a BBC security awareness video featuring, um, pigs. Whoever said security awareness sessions have to be boring? :-) Gary Read more →

US online fraud

A collection of links to sites with information on online fraud. Reporting links for those in the US. Read more →

Avoiding a Project Ambush

There was a story I read recently on the Times Online: French troops were killed after Italy hushed up ‘bribes’ to Taleban. What could this tragic event possibly have to do with IT security? Let me explain. First, there were allegations that the Italian government had been paying bribes to the Taliban in exchange for save haven. But Italy vehemently denied it. Then, last year, ten French troops were killed in what they had previously assessed to be a peaceful area of Afghanistan. Before France went into this deadly area, they (of course) did a risk assessment. What factored considerably... Read more →

Free licence

Interesting piece by an author who explains why he is not upset by, and even wants people, "pirating" his book, which is published under the GNU Free Documentation License. Read more →

DHS cybertips

The US DHS cyber awareness, tips, and events page. Also note Obama's 2009 pep talk at http://www.whitehouse.gov/blog/Protecting-yourself-online/ Read more →

OnguardOnline.Gov

Latest online security awareness from the US feds. Limited and basic awareness tips (but a decent start), some cute games (for the easily amused), and a very few phishing videos. Read more →

What Is The "Best" Password Policy?

I recently overheard a colleague mention that, in his opinion, the best form of password security for their enterprise is to not enforce monthly or quarterly password changes for their employees. His reasoning? Enforcing tough passwords and forcing your employees to change them periodically often forces the employees to write down their passwords (even sometimes posting them on a sticky note attached to their monitors or desks). This, in his opinion, is more of a security risk than not enforcing periodic password changes. At first, I thought that this is one of the craziest ideas that I had ever heard.... Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

A very interesting week with significant implications for everyone. The spear-phishing attack is certainly a wake-up call, a hack in the U.K. could happen anywhere and mid-size companies appear to be the current target. However, perhaps of greatest concern could be the impact of the H1N1 virus upon the Internet and for those doing business in the U.S. a possibility for additional controls relative to the Internet. The DHS Daily Open Source Infrastructure Report (DHS) covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to... Read more →