ISC2 Blog

Next Generation Firewalls: What's coming?

I joined some seminars, conferences, read some articles and studies about ongoing developments of new firewall technologies and I would like to mention my thoughts about it. Some of those technologies are already on the market but they're starting to be accepted by. Features: The next generation firewalls will: Have superior performance (up to 100Gbps); Be deployed on more complex network traffic (MPLS, VPLS); Recognize applications (P2P, Video, Productivity, Web, IM, Skype, Games, etc, even "encrypted/obfuscated ones") for control purposes; Be part of complete security Ecosystems (FW, IPS, Anti-Spam, Anti-Malware, Parental Control, VPN, DPI, Lawful Interception) on a single Blade... Read more →

NIST cloud def

This IBM blog entry provides a basic summary of the NIST work on defining cloud computing, as well as some related jargon. It provides a fundamental starting point and basis for assessing "cloud" systems and providers. Read more →

Assessing Operational Risk

As a continuation of the series focusing on “Demystifying the Risk Management Framework” (http://blog.isc2.org/isc2_blog/2010/03/demystifying-the-risk-management-framework.html), this posting will cover Risk Assessments, and how they play a role in the RMF (both as a tool for managing risk within individual information system and organization-wide). In the absence of a mature Risk Assessment methodology, Federal Agencies are struggling with balancing the implementation of the baseline controls outlined within NIST SP 800-53 Security Controls. As a routine function of the traditional Certification and Accreditation (C&A) activity, there is a heavy reliance on the Assessor as part of the Security Testing (e.g., ST&E) to perform... Read more →

Top 500 worst passwords

A list of the top 500 most frequently used (and therefore eminently guessable) passwords. If you see yours, change it. Read more →