(ISC)² Blog

Unofficial FedRAMP Community Collaboration

The FedRAMP comment submission period has recently been extended to January 17, 2011 which was extended twice - originally from December 2, 2010 until December 17, 2010. Additionally, as noted on the FedRAMP.gov site, the FedRAMP PMO expects the first pahse of FedRAMP to be operational by the end of the CY11 1Q (April 2011). This seems to suggest that the Federal Government is moving rapidly towards ratifying the first draft of the FedRAMP process (and requirements) for implementation. "Comments on the documents can be submitted using the FedRAMP online comment form. The comment period has been extended through the... Read more →

CPE Management

Better Stay On Top of Those CPE's Ok for a person that is as organized as I am to not stay on top of his CPE's the way I did is strange. Couple that with the fact that I got audited not once, but twice over the last 3 months by both ISACA and ISC2 (I soon after went out and bought a lottery ticket), and I realized I was not as prepared as I should have been. Now it has been hard the last 3 years to get out to training events, meetings, etc., work and travel have prohibited... Read more →

FedRAMP Series: Continuous Monitoring

185 Furthermore, FedRAMP 186 will prescribe specific reporting criteria that service providers can utilize to maximize their 187 FISMA reporting responsibilities while minimizing the resource strain that is often experienced. Suggests that individual services providers are responsible for ensuring the FedRAMP PMO meets FISMA reporting requirements. What is the criterion and where is it published? 198 However, there will be instances, beyond the control of FedRAMP in 199 which deliverables may be required on an ad hoc basis. How will Cloud Service Providers (CSP) address ad-hoc reporting on deliverables noted in Table 2: FedRAMP Continuous Monitoring Deliverables? If CSP offerings... Read more →

Project Quant

Project Quant is supposed to be a database security framework. At this stage it seems to be a decent outline of security in general, although there doesn't appear to be much in place that is particular to database security as a specialty. Read more →

ThinkUKnow?

A good online awareness video produced by the ThinkUKnow campaign done by CEOP in the UK. Read more →

Malware analysis

A collection of resources (mostly online) that will help those interested get started working towards an understanding of how to pick apart malware, see what it does, and how to protect against it. Read more →

FedRAMP Series: Cloud Computing Security Requirement Baseline

In an effort to understand the FedRAMP process for Assessment and Authorization (A&A), it is important to look at the basic security controls that will drive the process of designing, implementing and documenting security controls into the Cloud Service Providers solution prior to going through the FedRAMP A&A process (or attesting compliance with the FedRAMP security requirements). Proposed Security Assessment & Authorization for U.S. Government Cloud Computing Chapter 1: Cloud Computing Security Requirement Baseline Lines 83-85 83 These controls have been agreed to by a 84 Joint Approval Board made up of users from GSA, DHS & DOD for use... Read more →

FedRAMP Series: Introduction

Since the recent release of the Federal Risk and Authorization Management Program or FedRAMP (as it is being abbreviated), I though it would be appropriate to establish a blog series dedicated to exploring the "Proposed Security Assessment and Authorization for U.S. Government Cloud Computing" draft. For those not familiar with FedRAMP, is is being designated as a standard approach to Assessing and Authorizing (A&A) cloud computing services and products. Essentially an "approve once, and use often" approach. FedRAMP URL: www.fedramp.gov Look for a follow up to this series with the title labeled - FedRAMP Series. Read more →

Do you know Shodan?

Wellcome to Shodan. If you're thinking "What on Earth is it?", please read the lines below. If you're already familiar with, move to the next Section. So here’s the basic: SHODAN (Sentient Hyper-Optimized Data Access Network) is a search engine, but instead of indexing web page content, it indexes banners information. It indexes data on HTTP, SSH, FTP, TELNET and SNMP services for almost the whole Internet. You can find it at http://www.shodanhq.com. You can do basic searching for free. An account and credit are required for some features. What can I do with it? A lot of things. For... Read more →