(ISC)² Blog

We are living on strange "Cyberwar times"

In the after-crisis of the Stuxnet worm, Governments around the world are mobilizing to be better prepared against CyberThreats and CyberWar. It's becoming clear, more and more that groups pf individuals with a lot of knowledge, time and motivation can do harm against economies, healthcare, utilities and other systems, being responsible (who knows?) for the collapse of a country. We already had, in the past, cases of well succeeded CyberAttacks that collapsed a country information structure and paralyzed it for a while. We can remember of: 2007 CyberAttakcs on Estonia 2007 CyberAttacks against Syria Radar Infrastructure 2008 CyberAttacks on Georgia... Read more →

Inadequate Understanding of FISMA Implementation Should Not Impact the Proposed FedRAMP Framework

In a recent article published on NextGov, there was a reference to the comments submitted by the Software & Information Industry Association (SIIA) in response to the public comment release of the Proposed Draft of the FedRAMP requirements. In reviewing the posted comments, it became apparent that the SIIA and possibly other organizations may not have the necessary experience with implementing FISMA that would likely be necessary to adequately understand at minimum, the FIPS and NIST Special Publication that guide the FedRAMP process. Therefore, using the publicly submitted comments by the SIIA below, I will further examine each comment that... Read more →

How I Communicate PCI Awareness

Question on LinkedIn PCI message board; What challenges members are currently facing in achieving or sustaining levels of Employee Awareness required for PCI DSS and the solutions they are employing. Awareness has to be mandatory and it has to be short, in plain English and you have to try to add value to it, that way the audience feels like actually listening to it. Hook up with marketing for help in that area. Since PCI requires this (no Gray area here) I split my awareness into 2 separate buckets. What I did was manage corporate users (most of which all... Read more →

Pragmatic ethics

Is it ethically acceptable for workers to pinch the odd pencil or Post-It note from work, or is this just the thin end of the wedge that leads to fraud, theft, corruption, Enron and Global Economic Meltdown? It's a tricky issue when you factor in the difficulties of writing and enforcing corporate policies on ethics, the effects these have on the workforce, and the prospect of tacitly or even formally endorsing unethical and perhaps illegal behaviours through weak policies and lax attitudes towards compliance. It's also a cultural issue, which makes it fuzzy and complex both to characterise and even... Read more →

Raising the (Testing) Standard

After well over 20 years involved in some aspect or another of the security industry, several of them supplying services to the anti-malware industry, I can say with some confidence that AV product testing has given me more white hairs than any other security topic. Only a true obsessive, a hallucinating optimist or hopeless masochist would admit to being a Director of AMTSO, the Anti-Malware Testing Standards Organization, so I won't mention that... But I will mention that the next AMTSO members meeting is at San Mateo, California, on the 10th and 11th February, conveniently and non-coincidentally arranged just before... Read more →

Digital redaction standard

A new ISO27k standard covering digital redaction is in preparation. I'm inviting comments on a 'top 10' list of information security risks associated with redacting digital files. Read more →

ISF, (ISC)2 and ISACA Release Information Security Principles

The Information Security Forum (ISF), together with (ISC)² and ISACA, released last month a set of 12 principles designed to help security practitioners respond more effectively to the changing needs of organizations in today’s complex, interconnected world. (ISC)² worked with closely with both organizations to create the principles for two reasons: 1) to promote good practice guidelines to information security professionals worldwide who may be unaffiliated with any professional organization, and 2) to offer clear, practical advice to all professionals on how information security can best support business objectives agreed upon by key players in the security profession. I think... Read more →

Facebook security

The actual security guide pointed to resides at ZDNet, but this site lists the four parts together (and the ZDNet navigation is not exactly clear). Navigation through the checklist is not completely obvious either. You can go through by clicking on arrow icons (<>) at the upper right hand corner of the images (which may be hard to find because the images can be fairly busy), or by clicking on individual pictures below the image and text. (Clicking the arrow icons down there only moves the pictures back and forth, without moving you through the checklist.) However, once you master... Read more →