(ISC)² Blog

What will be the next generation of security tools?

I was reading a interesting discussion on Linked-In days ago about security technologies tendencies and I became happy to read about some very interesting solutions/technologies that I never heard about it and some others I'm more familiar but with a new approach. I will spend some time in the near future to study more some of them and blog the results here but my objective now is to promote a health discussion. On the opinion of the ISC2 folks, what will be the next generation of security solutions? And by "next generation" I mean a technology that will evolve or... Read more →

Ethics (Kabay)

Fairly standard articles and slide decks on ethics. Read more →

Shariah and Cybercrime

From the International Journal of Cyber Criminology, "Shariah Law and Cyber-Sectarian Conflict: How can Islamic Criminal Law respond to cyber crime?" This paper looks at the concepts in Islamic Shariah law that relate to specifically computer or information system related crimes. The paper is possibly not a complete examination, but is not hopeful as regards the ability to criminalize cybercrime. Also available as PDF. Read more →

Resilience - the missing link?

While reading IT Grundschutz, the German information security baseline standards, and in particular the BSI standard 100-4 on Business Continuity Management, I've been thinking about a curious gap that I believe has opened up between the fields of information security and business continuity. The way I think of it, 'resilience' (and related concepts such as 'over engineering', redundancy, automated failover and so forth) is very definitely an integral and essential part of 'business continuity' (in other words, keeping vital business operations running as near normally as possible, despite whatever threats and vulnerabilities might materialize). Keeping unauthorized users out of the... Read more →

US DoD SDLC

The US Defense Dept has a system for everything, and most are fairly structured. Their Integrated Defense Acquisition, Technology and Logistics Life Cycle Management System Chart is no exception. However, if you pay attention, it does provide a detailed structure and process for secure development. (Warning: their cert is self signed, and your browser may object.) You can also get the chart PDF from https://acc.dau.mil/IFC/pdfs/Front_Ver_534_June_15_2009_34x22.pdf Read more →

Android Insecurity

Late last year, a nefarious banking app was discovered on the Android phone marketplace. This, I'm afraid, is just the beginning. Doing some Android phone development recently, I have gotten some hands-on experience with how an application is deployed to the Android Marketplace. One big difference between the Google and Apple mobile software stores is that Apple vets and approves each app before it is made available for public download. With Android, anyone who pays the $25 registration can upload an application to the marketplace. To upload an application, it first must be signed with your own digital signature. This... Read more →

Lack of Communication

Credit Card Brands Lack of Communication As most of you in the world of PCI already know MasterCard once again threw another grenade this past week with several PCI enforcement rule changes, this article is not about those changes (see MasterCards 2 Step) for that discussion. I want to discuss the card brands communication/dissemination of PCI rule changes, or lack thereof! I know this is an area we are all in agreement.For example when any of the card brands do make rule changes in how they enforce PCI, they do not seem to have a defined process on how they... Read more →

70 Years after Bletchley Park, People are Still the Key

Like many fields, the global recession has taken a toll on the information security profession. As I reflect on the challenges many of our members are facing, the contributions of those working at Bletchley Park decades ago puts the events of the last year into perspective and is a good reminder that even in the darkest times, people are at the root of effective security. In an article recently written by former (ISC)² Board of Directors and European Advisory Board member Dr. Peter Berlich, CISSP-ISSMP, CISA, CISM, we're reminded of the vital impact the people working at this historic site... Read more →

Lessons from counter-terrorism

While being firmly based in the world of physical security and anti-terrorism, Eagle Eyes, a US Air Force Office of Special Investigations program, has worthwhile lessons for us in information security. Through the Air Force program, civilians (as welll as military people, presumably) are encouraged to be alert towards, and report, suspicious activities such as: Surveillance -- someone recording or monitoring activities, including the use of cameras or binoculars. Elicitation -- anyone trying to gain information by mail, fax, telephone or in person about military operations or people. Tests of security -- attempts to measure reaction to security breaches or... Read more →