(ISC)² Blog

Stuxnet, Suxnet

I've been in this business too long to be easily riled by hoaxes and semi-hoaxes, electronic Pearl harbours, rumours and gossip. But after enforced immersion into various aspects of the Win32/Stuxnet issue (from remediation-related discussion with SCADA sites to code analysis, to data mining from distribution data), I've become more than usually frustrated with articles and discussion threads adding two and two to make infinity. Here, briefly, is what we know. Stuxnet used an unusually rich selection of 0-day attacks, exploiting the LNK and print spooler vulnerabilities recently patched by Microsoft and a couple of Elevation of Privilege issues that... Read more →

SIEM ROI - How to prove it?

I received some emails lately asking me some advice on how to prove a SIEM Tool ROI to higher management (justify acquisition, prove that the solution helps, etc). If you focus only in the technical aspects, I admit thatlife becomes more difficult (world crisis, lack of technical knowledge from higher management, etc) and gets hard to prove the ROI. When I work with SIEM projects one of my major rules is to understand my customer business and not only the network/system security aspects. What they do? How they do? What facts can impact their revenue? What systems/devices are running their... Read more →

When Open means Closed

In conjunction with my friend Rob Slade, I'm currently researching and writing about a broad range of information security frameworks. There is no shortage of them! Right now, I'm interested in ISECOM/Pete Herzog's OSSTMM (Open Source Security Testing Methodology Manual) and the ISM3 Consortium/Vicente Aceituno Canal's ISM3 (Information Security Management Maturity Model) frameworks but have lucked out on both of them this morning. I respect both Pete and Vicente for the stirling work they have done but the fact is that neither framework is freely available at the moment, despite the 'open' banner. OSSTMM version 3 is only available to... Read more →