(ISC)² Blog

Making Cyber Threats Big Data Manageable

By Adrian Winckles Director of Cyber Security, Networking and Big Data Research Group, Anglia Ruskin University Whilst figures differ depending on which report you read, Gartner estimates the average time between a breach and detection to be about 285 days. By this time, an attacker has long gone. With all the security products in an enterprise network today, why is this still so long? One reason maybe because threat detection is a big data problem. Particularly for network traffic based solutions. A handful of probes, or mirror ports, across a high-speed enterprise network and you could be capturing Terabytes of... Read more →

Limited Time Opportunity: Free Forensics Lab

For a limited time, (ISC)² is excited to offer the opportunity for members to pilot an interactive, online, self-paced free CPE credit opportunity that incorporates a practical hands-on lab learning experience. This Cyber Forensics Incident Recovery lab is designed to provide you with a deeper understanding of how to extract evidence from a suspect’s hard drive. We are eager to offer this course, which includes demonstrations, hands-on lab practical application and concludes with an assessment to ensure understanding of the learning objectives. You’ll learn key concepts, watch demos, work through the hands-on lab and test your knowledge. Following completion of... Read more →

(ISC)² Secure Summit UK Insights: Digital Forensics: Past, Present and Future

Following the success of the one-day Secure Events and Security Congress in EMEA, (ISC)²’s new look two-day Secure Summits bring multi-subject sessions from hands on practical workshops to keynotes and panel discussions, featuring local and international industry experts to maximise the learning experience and CPE opportunities. Serving the entire (ISC)² EMEA professional community with five regional events, the Summits offer a wealth of educational value, networking opportunities, and a community forum for likeminded professionals, all of which are FREE to (ISC)² members & (ISC)² Chapter members. Read on for insights from one of our popular Secure Summit UK sessions: (ISC)²... Read more →

(ISC)² Secure Summit UK Insights: IoT legislation IS coming. Can manufacturers get their act together?

Following the success of the one-day Secure Events and Security Congress in EMEA, (ISC)²’s new look two-day Secure Summits bring multi-subject sessions from hands on practical workshops to keynotes and panel discussions, featuring local and international industry experts to maximise the learning experience and CPE opportunities. Serving the entire (ISC)² EMEA professional community with five regional events, the Summits offer a wealth of educational value, networking opportunities, and a community forum for likeminded professionals, all of which are FREE to (ISC)² members & (ISC)² Chapter members. Read on for insights from one of our popular Secure Summit UK sessions: Day... Read more →

Calling All Cybersecurity Experts!

This year’s (ISC)² Security Congress – with the theme “Leaders of Tomorrow” – will take place September 25-27 in Austin, Texas at the JW Marriott. For the first time, Security Congress will be a stand-alone event, without former partner ASIS International. “We value the partnership we had with ASIS International for the past six years, but it was time for Security Congress to stand on its own to address the programming needs expressed by our members,” says (ISC)² CEO David Shearer. The cybersecurity conference will host more than 90 educational sessions, as well as a town hall meeting, career center... Read more →

Digital redaction standard

A new ISO27k standard covering digital redaction is in preparation. I'm inviting comments on a 'top 10' list of information security risks associated with redacting digital files. Read more →

Malware analysis

A collection of resources (mostly online) that will help those interested get started working towards an understanding of how to pick apart malware, see what it does, and how to protect against it. Read more →

Cyber Security Central

This blog entry focuses on introducing a new community focused resource designed to provide an avenue for the collaboration and sharing of information relating to Cyber Security. The Cyber Security Central website (www.cybersecuritycentral.com) seeks to extend the knowledge and best practices within the cyber security community. The overall goal of the site is to provide a platform to support the implementation of the National Cyber Security Strategy. Since the inception of the project a few months ago, I have tried to establish a site that seeks to demonstrate a broad view of the cyber security community from both the national... Read more →

Image forensics

An interesting analysis of a graphic recently used by Victoria's Secret in their advertising. This gives chapter and verse of the techniques used, and results obtained, demonstrating the ability to determine if an image has been altered, and even which parts of an image have been modified, and how. I find this particularly interesting because of the apparently widely held belief that steganography is "undetectable" without comparision to the original image. Most of the "Photoshop disasters" are glaringly obvious to the naked eye. As this demonstrates, analysis and detection of modification is easily accomplished, even when the differences are not... Read more →

Data sanitization

This article is originally from the IEEE Security and Privacy magazine, circa 2003. As such, some of the programs noted are out of date or obsolete. However, a number are still available and in use, and the basic concepts outlined are still valuable. Read more →

Should the CISSP CBK be improved to place greater emphasis on “human factors” in information security? Definitely Yes!

Should the CISSP CBK be expanded to cover "human factors" in security? [1] Add “Human Factors” No.[2] Clearly, human factors are a major component to information security and Gary Hinson presents effective arguments that they should be established as an additional domain. On the other hand, Rob Slade makes an effective argument that the human factors are a significant component of each of the current ten domains primarily based on his experience teaching the CBK® to CISSP® aspirants for (ISC)²®. In full disclosure, I also teach the CBK® to CISSP® aspirants, but not for (ISC)²®, but at a local college.... Read more →

TCP covert channel

Advertised as RSTEG (Retransmission STEGanography), the technique described in this paper actually uses the standard TCP operations to allow you to set up a kind of covert channel. Interesting idea, although likely neither terribly dangerous nor important. Read more →

Social network de-anonymizing

This paper, although rather abstract and academic, is a good survey of the research into social network data gathering, as well as a particular de-anonymizing attack. It points out the dangers of data aggregation that inherently exist in social networking. Read more →

Fast flux and related technologies

This paper provides an overview explanation of fast flux and double flux activities related to hiding malicious Websites, or avoiding takedown (particularly related to botnets). It also suggests certain actions which could mitigate such activity. The essay uses a lot of jargon and is not always clear, but does provide a decent basic explanation. Read more →

Open Source Computer Forensics Manual

The Open Source Computer Forensics Manual doesn't have a lot in it, and it only covers the basic approach, but it is reasonable at that. Maybe someone can get the project restarted. Read more →

US Cybercrime site

US Department of Justice Computer Crime and Intellectual Property site with news stories, related (US) laws, and some documents related to digital evidence, investigation, and prosecution. Read more →

Expectations for Computer Security Incident Response

RFC 2350 is a 1998 version of what incident response teams should and shouldn't be and do. Also, CERT.ORG has advice and step-by step instructions on creating a computer security incident response team. Read more →

GhostNet

The tracking (and scope) of GhostNet, a significant example of the use of malware and botnets for espionage. Some items of this were given in a story in the New York Times. There is also related work in a report out of Cambridge (full report in PDF)(which, like everything else Ross Anderson has written, is worth reading regardless of your level of interest). Read more →

Computer Re-use Optimisation Project

In the course of operations, recycling of old computers is an issue. The confidentiality dangers of object reuse are reasonably well known. However, when the time comes to get rid of a bunch of old (and rather toxic, if just dumped) computer equipment, where can you send them to best effect? The Computer Re-use Optimisation Project (CROP) lists a number of organizations and institutions, in a number of different areas of the world, that take, refurbish, and give computers to worthy causes. Read more →

Secure data erasure

For all the trouble we have to take to protect, backup, and maintain our data, when we want to get rid of it, it turns out to be remarkably difficult. Do we delete Overwriting delete? Overwrite 40 times? Overwrite 40 times including all the slack space? Degauss? Get out the thermite? This site presents a faster and easier option. There is software, and also a paper (possibly self-serving ...) explaining the option, and why it is very often good enough. Read more →