(ISC)² Blog

Applying Newton's third law to information security

Simply banning stuff (such as using social media at work) through management edict or policy can be counterproductive for security if employees react by circumventing the ban. I argue that effective security awareness using motivation and persuasion is a far more effective technique. Read more →

The APT Attack Surface

According to the FAS Project on Government Secrecy, using data tabulated in the report, 4,266,091 people held security clearances in the US for access to classified information. Read more →

Pragmatic ethics

Is it ethically acceptable for workers to pinch the odd pencil or Post-It note from work, or is this just the thin end of the wedge that leads to fraud, theft, corruption, Enron and Global Economic Meltdown? It's a tricky issue when you factor in the difficulties of writing and enforcing corporate policies on ethics, the effects these have on the workforce, and the prospect of tacitly or even formally endorsing unethical and perhaps illegal behaviours through weak policies and lax attitudes towards compliance. It's also a cultural issue, which makes it fuzzy and complex both to characterise and even... Read more →

New SSL Inspection Solutions: Are they helping us or not?

I saw some presentations and papers about a new technology that is able to decrypts SSL traffic and sends it to existing security and network appliances on high speed networks. This technology enables existing IPS solutions to identify risks normally hidden by SSL such as regulatory compliance violations, viruses, malware, data loss, intrusion attempts, etc. This is a very good approach to detect/block those attacks (there are reports showing a increase on attacks using SSL traffic) but I see some risks related. If someone uses this technology to decrypt the traffic and get the info? What are the mitigation actions... Read more →

Know thyself

Psychological profile of what makes a good defender in the infosec world. Read more →

The Risks of Bad Communication

I have been thinking about whether there are are any risks unique to remote facilities when it comes to a company's IT security design. This could be locations in different cities, near-shoring, off-shoring, etc. From the article Bad Communication Can Create Risk, the author lists four risks mitigated by effective communication: Increased employee resignations Decreased employee productivity Overt employee subversion Inability to achieve company goals From an IT security perspective, I will add: Back doors Data leakage Malicious behavior (unintentional or otherwise) The knowledge of being observed is itself a deterrent to bad behavior. There is the Observer (or Hawthorne)... Read more →

Pig hackers

Amusing video from the BBC. A report on pigs managing to figure out how to get more food from an automated control system. If even pigs can (accidentally) figure out how to defeat access controls, what do you have to do to prevent determined attackers? (Actually, pigs are pretty clever critters ...) Read more →

DoD IA Policy Chart

For your information, the Defense-wide Information Assurance Program (DIAP) has just released the IA Policy Chart via the IATAC web site at http://iac.dtic.mil/iatac/ia_policychart.html. The chart, plus background notes can be found at that site. In addition, the IA Policy Chart will be included as a centerfold in the January 2010 edition of the IATAC’s IAnewsletter. The goal of the IA Policy Chart is to capture the tremendous breadth of applicable policies, some of which many IA practitioners may not even be aware, in a helpful organizational scheme. The use of color, hatching, fonts and hyperlinks are all designed to provide... Read more →

Add "human factors"? No.

OK, Gary has asked if the CISSP CBK should be expanded to cover "human factors" in security? And I answer "No." With that kind of beginning, you could be forgiven for thinking that I disagree with Gary about the importance of human factors in security. Nothing could be further from the truth. I agree with everything he has said about the fundamental significance of human factors in information security, as well as the difficulty of dealing with them, and will defend to the death his right to say it. What I disagree with is the question. The CBK already addresses... Read more →

Moral code experiments

A very interesting presentation and intriguing research into moral behaviour. The culminating point is that we need to test and experiment with morality, since we seem to have many incorrect notions about it. Read more →

Are policies mandatory and guidelines optional?

Although this is often expressed, I fundamentally disagree that policies are mandatory whereas guidelines are optional. This to me is a rather naïve assessment, and is distinctly unhelpful, misleading even. Let me explain. For a start, do you truly understand the distinction between "mandatory" and "optional"? Are they really (as some claim) as different as binary and analogue? I beg to differ. In my world, they are both analogue concepts. They are both a matter of degree. Occasionally by "mandatory" the information security manager or CISO probably does mean an absolute hard-and-fast rule with no exemptions (authorized non-compliance) or exceptions... Read more →

Passwords are dead - long live passwords

Over on CISSPforum, a zombie topic about passwords has risen from the dead yet again. This time, someone suggested making it a "condition of employment" that "If you cannot remember a username and password, find employment elsewhere." Well yeah but no but. A username and A password, even a reasonably strong one, would be just fine for most people. Unfortunately, we need loads. As information security pros, isn't it part of our rôles and responsibilities to make information security as low-impact as possible on the organization (including its 'most valuable assets', the people) without unduly compromising the level of security?... Read more →

A Hidden Danger in Cloud Computing

Back in the days when I was happily spending time on the operations floor in computing centers, we always observed that the greatest security threats to our systems were well-intended operators who make simple mistakes. No hacker or criminal ever brought down a network like the bored network guy on the late shift who decided to upload a new version of the Cisco IOS on all the routers of a global ISP without testing first. A bug in the IOS release caused every router go down, one-by-one. I remember being called into work to fix the problem (had to send... Read more →

The folly of annual "awareness training"

Hord Tipton is quoted in a rather curt piece on GovInfoSecurity referring to the "Need to provide federal employees awareness training more often than once a year because of the ever-changing challenges IT security presents". Right-on Hord! I realise I'm quoting a small extract from a short piece about a press interview, but still there's much more to it than Hord's statement implies. I hope you'll forgive me a short but passionate rant ... 1. It's not just federal employees who need more than once-a-year training. The same applies to everyone, including employees (staff, managers, IT professionals, temps, contractors, consultants,... Read more →

US Cybercrime site

US Department of Justice Computer Crime and Intellectual Property site with news stories, related (US) laws, and some documents related to digital evidence, investigation, and prosecution. Read more →

The Missing Vials

Last month, it was reported that "three small vials of Venezuelan equine encephalitis virus were determined to have been unaccounted for last year." While it has been concluded that this was not the result of misconduct, it does raise questions about the risk of mishandling sensitive materials. An act of theft was not detected; the absence of things inferred theft. So this demonstrates an administrative type of risk, where alarms are sounded and must be responded to due to proper inventory controls not being used, or used improperly. An article in Wired magazine sums it up nicely: "Biological material can... Read more →

You Oughta Know Better!

In a report today from MSNBC titled, Report: Obama helicopter security breached, the blueprints and other information relating to Marine One, the Presidential helicopter, were found linked to an Iranian IP address. The report states that a defense contractor downloaded a peer-to-peer (P2P) application the "SAME SYSTEM" that contained the information regarding Marine One. We all make mistakes, but this one is a big one. We all oughta know that you treat systems with sensitive information as systems with sensitive information. This means that you do not install P2P applications from the Internet on a classified system or you do... Read more →

Revising Enterprise Telework and Remote Access

NIST (National Institute of Standards and Technology) recently updated their guidance for Enterprise Telework and Remote Access Security, DRAFT NIST SP800-46 Rev.1. As many are aware, security professionals are constantly considering the security ramifications of employees accessing the corporate network from home and other insecure locations. This includes the use of home systems to connect to the network, corporate laptops from remote locations and the potential of infected mass storage device. This special publication is and update from the previous special publication - SP800-46, Security for Telecommuting and Broadband Communications intended to help organizations understand and mitigate the risks of... Read more →

Google's Self-Inflicted Denial-of-Service Attack

Over the years most of us who have "been around the block" in IT operations have always said, based on experience, that one of the biggest looming threats to IT operations is always a well intended employee who makes an honest mistake. I can recall discussing this topic almost daily with my honorable USAF colleagues, including Col. (R) Glenn Watt, Col. (R) David Gruber, and Maj. Gen. (R) Bill Donahue, all experts in IT operations and IT operational risk. Even before those memorable days consulting for the USAF, I can recall one of my first UNIX projects with General Electric... Read more →

Using SIEM tools for Fraud Detection

Some time ago I was assigned for a project in a Telecom in South America to design, build and deploy a SOC Infrastructure. The customer objective was to monitor the network against attacks (vulnerable devices, brute force attacks, etc) and correlate events in order to identify hidden treats (DDOS, scanning, worms) and to identify business and operational frauds. I meet the audit team and then I got able to understand where their main frauds happen, some examples were: ADSL and Dial users sharing username/password; ADSL Subscribers connecting with higher speeds than they had hired; Operators accessing the system outside of... Read more →