(ISC)² Blog

Demystifying the Risk Management Framework

As a follow-on to a previous posting titled "Federal Agencies Lack Proper Security-Related Risk Management Practices" (http://blog.isc2.org/isc2_blog/2010/02/federal-agencies-lack-proper-securityrelated-risk-management-practices.html), I am dedicating the next few posting referred to as "Demystify the Risk Management Framework" to clarify the RMF and the role Risk Management plays within the System Development Lifecycle (SDLC). In parallel, I have organized a series of presentations that will provide a more detailed examination of the Risk Management Framework (RMF) collectively drawn from multiple NIST publications with the intent of providing an end-to-end discussion of the RMF and how it can be used to manage organizational risk. Several publications are... Read more →

Why people are not concerned about security on Internet Social tools?

I'm scared!!! With one subject! Why people are not concerned about exposing their lives on the Internet? On a way that can put in danger not only themselves but their family and friends. I'm writing below some info I collected just looking ramdomly for profiles on some social network websites. Phones, credit card numbers, full address, if they have children, how many are they and their names, where they study, where they work, etc. You can just find everything about everyone. They're really not concerned with someone they don't know looking their profile searching for something (possible with bad intentions).... Read more →

The Anti-Phishing Working Group: Counter eCrime Operations Summit

The Anti-Phishing Working Group has asked its members to publicize the forthcoming Counter eCrime Operations Summit (CeCOS) in Brazil. I've already blogged this in quite a few other places, but given the impact of phishing and identity theft on the online community, it seems reasonable to assume that the Summit will be of interest to (ISC)2 members and readers of this blog, so I'm addressing it again here. Apologies to those who will have come across it elsewhere. This year the APWG is hosting it's fourth annual Counter eCrime Operations Summit (CeCOS IV) on May 11, 12 & 13 in... Read more →

Introduction to a PCI onsite assessment - Part One

Part One - Introduction to a PCI onsite assessment This is the first chapter in a series about preparing for and going through a PCI assessment;… 1. Part One - Introduction to PCI onsite assessment & QSA selection process 2. Part Two - Preparation for an onsite assessment and what to do first! 3. Part Three - Defining your scope so you know what you’re assessing 4. Part Four - Authoring a PCI Onsite Assessment RFP 5. Part Five – Selecting a QSA to conduct an onsite PCI assessment 6. Part Six – Preparing your Company and I.T. department for... Read more →

Intro to infosec

A Masters level course from the UK OpenLearning/LearningSpace centre, introducing the concepts of information security management. Little or no technical content. Parts appear based on BS 7799-2/ISO 27001. Read more →

Keeping net safe

This module from the UK's OpenLearning/LearningSpace centre is a fairly basic online safety piece. It concentrates on malware, and has numerous minor errors in terminology and definitions, but is reasonable for the general public. Read more →

Hitler cloud sec

You may or may not be aware of the mass of "Hitler rant" videos on YouTube. These take a clip (from the movie "Downfall") and subtitle it with a rant from Hitler about everything from college football to the iPhone to Facebook accounts to ... well, anything at all. This one is about cloud computing and security, and makes a few cute points about security in general. Read more →