(ISC)² Blog

Computer Re-use Optimisation Project

In the course of operations, recycling of old computers is an issue. The confidentiality dangers of object reuse are reasonably well known. However, when the time comes to get rid of a bunch of old (and rather toxic, if just dumped) computer equipment, where can you send them to best effect? The Computer Re-use Optimisation Project (CROP) lists a number of organizations and institutions, in a number of different areas of the world, that take, refurbish, and give computers to worthy causes. Read more →

Secure data erasure

For all the trouble we have to take to protect, backup, and maintain our data, when we want to get rid of it, it turns out to be remarkably difficult. Do we delete Overwriting delete? Overwrite 40 times? Overwrite 40 times including all the slack space? Degauss? Get out the thermite? This site presents a faster and easier option. There is software, and also a paper (possibly self-serving ...) explaining the option, and why it is very often good enough. Read more →

A Mistaken Conviction Based on Digital Forensics – Part 2 – The Trial, Day 1

Department of Homeland Security Daily Open Source Infrastructure Report

During the pretrial examination we learned that there appeared to be sufficient basis to have excluded the forensic evidence yet that did not happen. Let us see what happened during the trial which allowed the forensic evidence for the prosecution to be presented to the court and considered by the jury during its deliberations which resulted in Julie Amero’s conviction on all counts. Before we do however, let us take a brief look at the community’s perspective of the crime and how that might have influenced their deliberation to some degree.... Read more →

A Mistaken Conviction Based on Digital Forensics – Part 1.5 – On Good Morning America

The dilemma of Julie Amero will be told on Good Morning America, ABC, on Tuesday, January 27th, 2009 between 8-9am EST I am told. Julie and the lead forensic analyst Alex Eckelberry were interviewed as well, I believe, as others. Some interesting events occurred during the taping and the Julie Amero team agreed that they would not be discussed until after the showing. Watch it with me and let us see what is being told by the mass media. I am working on Part 2 - The Trial and plan to have it ready to post that same day. Read more →

A Mistaken Conviction Based on Digital Forensics – Part 1 – Pretrial

Most of us watch criminal cases in movies and on television where forensic evidence ices a conviction and exonerates the innocent. How is it possible that someone can be convicted based on forensic evidence when they were not guilty? Let’s examine a modern day case where this occurred: · The event took place on October 19th, 2004 · The accused was tried and convicted on January 3-5, 2007 · The sentencing was scheduled for eight weeks later, March 2nd, 2007, then delayed until o March 29th, 2007 which was postponed on March 28th, 2007 until o April 26th, 2007 and... Read more →

Mitre/SANS Top 25 Programming Errors

The OWASP Top Ten has some more competition. Based on the SANS Top 20 attack vectors and MITRE's Common Weakness Enumeration (CWE), this document presents detailed descriptions of the top 25 programming errors along with guidance for mitigation. The errors are also cross referenced against related CWE items, as well as the Common Attack Pattern Enumeration and Classification (CAPEC) structure. Read more →

Rootkit detection and protection products and sites

The term "rootkit" is a difficult one to define, or at least fix a definition on. Originally it referred to a script, set of scripts, or package of modified system programs (thus "kit") used for gaining or keeping unauthorized root permissions (or equivalent supervisory powers) on a compromised system. Recently, media usage has expanded this definition to include any software that can hide software or processes on a system, but this usage is vague and likely to lead to confusion. Antirootkit.com doesn't have an awful lot of information on the site, but it does have a list of rootkit detection... Read more →

The Changing World of Digital Forensics

Digital forensic skills are challenging to acquire and frequently are less than useful unless you are working in emerging technologies or have a solid foundation of the very basics. More and more the focus upon digital forensic examination is within the legal community yet the challenges outside of the legal aspects remain the same – solve a problem and fix it. That is correct. When a skilled IT professional works on, solves and corrects an IT issue, whether it is a network challenge, a program problem or even a physical configuration concern or failure, they are in fact conducting a... Read more →