ISC2 Blog

Epsilon Overkill and the Security Ecology

I'm not actually going to write about the Epsilon fiasco as such here. I can think of at least two journalists who will be grateful for that, but I'm not going to let them off quite that easily, even though I can empathise with their ennui. Larry Seltzer notes that he has received far too many pitches using Epsilon as a hook. I can sympathise with that: I'm bored out of my skull with it, and I don't do much more than skim Epsilon-related articles to see if they're worth flagging on a resources blog, with or without commentary. John... Read more →

Japan: Commentary and Resources

It probably hasn’t escaped your notice that there’s a lot of malware/SEO/scamming whenever a major disaster occurs. A few days ago I started to put together a list of commentary (some of it my own) and resources relating to the Japanese earthquake and tsunami, in anticipation of that sort of activity. Originally, I was using several of my usual blog venues, but decided eventually to focus on one site. As ESET has no monopoly on useful information, I wanted to use a vendor-agnostic site. Actually, I could have used this one, but for better or worse, I decided to use... Read more →

Raising the (Testing) Standard

After well over 20 years involved in some aspect or another of the security industry, several of them supplying services to the anti-malware industry, I can say with some confidence that AV product testing has given me more white hairs than any other security topic. Only a true obsessive, a hallucinating optimist or hopeless masochist would admit to being a Director of AMTSO, the Anti-Malware Testing Standards Organization, so I won't mention that... But I will mention that the next AMTSO members meeting is at San Mateo, California, on the 10th and 11th February, conveniently and non-coincidentally arranged just before... Read more →

Malware analysis

A collection of resources (mostly online) that will help those interested get started working towards an understanding of how to pick apart malware, see what it does, and how to protect against it. Read more →

Do you know Shodan?

Wellcome to Shodan. If you're thinking "What on Earth is it?", please read the lines below. If you're already familiar with, move to the next Section. So here’s the basic: SHODAN (Sentient Hyper-Optimized Data Access Network) is a search engine, but instead of indexing web page content, it indexes banners information. It indexes data on HTTP, SSH, FTP, TELNET and SNMP services for almost the whole Internet. You can find it at http://www.shodanhq.com. You can do basic searching for free. An account and credit are required for some features. What can I do with it? A lot of things. For... Read more →

Stuxnet, Suxnet

I've been in this business too long to be easily riled by hoaxes and semi-hoaxes, electronic Pearl harbours, rumours and gossip. But after enforced immersion into various aspects of the Win32/Stuxnet issue (from remediation-related discussion with SCADA sites to code analysis, to data mining from distribution data), I've become more than usually frustrated with articles and discussion threads adding two and two to make infinity. Here, briefly, is what we know. Stuxnet used an unusually rich selection of 0-day attacks, exploiting the LNK and print spooler vulnerabilities recently patched by Microsoft and a couple of Elevation of Privilege issues that... Read more →

Keeping net safe

This module from the UK's OpenLearning/LearningSpace centre is a fairly basic online safety piece. It concentrates on malware, and has numerous minor errors in terminology and definitions, but is reasonable for the general public. Read more →

Cyber Security Central

This blog entry focuses on introducing a new community focused resource designed to provide an avenue for the collaboration and sharing of information relating to Cyber Security. The Cyber Security Central website (www.cybersecuritycentral.com) seeks to extend the knowledge and best practices within the cyber security community. The overall goal of the site is to provide a platform to support the implementation of the National Cyber Security Strategy. Since the inception of the project a few months ago, I have tried to establish a site that seeks to demonstrate a broad view of the cyber security community from both the national... Read more →

They call it Cyber Monday (but Tuesday’s just as bad)*

In the US, the holiday season is approaching fast, with Thanksgiving a week away on 26th November. I guess most of us outside the US are aware of Thanksgiving if we work with Americans, since almost the entire country closes down on the 4th Thursday in November. (Apologies to the Canadians in the audience, who had their own Thanksgiving celebration back in October.) However, fewer people outside the US will be aware of Black Friday (the day after Thanksgiving) and Cyber Monday (the following Monday – that’s the 30th November this year) unless they’re in global retail. Black Friday isn’t... Read more →

Botnets? Not a problem...

An article in PC Pro by Asavin Wattanajantra quotes Dr Steve Marsh, who is deputy director at the Office of Cyber Security in the Cabinet Office, as saying (in respect of EU policy on protecting Europe from cyber attack, whatever you may understand by that term) that: "the main focus of botnets would be to target and extort money from private companies, rather than bring down public sector networks [and] .... in a sense [it is] not in their interest to bring down infrastructure which is earning them money." This isn't a million miles away from something I was saying... Read more →

DHS cybertips

The US DHS cyber awareness, tips, and events page. Also note Obama's 2009 pep talk at http://www.whitehouse.gov/blog/Protecting-yourself-online/ Read more →

OnguardOnline.Gov

Latest online security awareness from the US feds. Limited and basic awareness tips (but a decent start), some cute games (for the easily amused), and a very few phishing videos. Read more →

Microsoft Security Essentials

Microsoft, having done a really bad job of it in the past, has decided to get back into the AV game. I've looked at their new, free product. It's provisionally all right, and probably good for most users. Read more →

DoD IA Policy Chart

For your information, the Defense-wide Information Assurance Program (DIAP) has just released the IA Policy Chart via the IATAC web site at http://iac.dtic.mil/iatac/ia_policychart.html. The chart, plus background notes can be found at that site. In addition, the IA Policy Chart will be included as a centerfold in the January 2010 edition of the IATAC’s IAnewsletter. The goal of the IA Policy Chart is to capture the tremendous breadth of applicable policies, some of which many IA practitioners may not even be aware, in a helpful organizational scheme. The use of color, hatching, fonts and hyperlinks are all designed to provide... Read more →

Bundling Security with the OS

Mac OS 10.6 (Snow Leopard) is being released tomorrow, and with it a much-improved version of File Quarantine, security software bundled with OS X. CNET posted an early review of the OS and states "File Quarantine checks for known malware signatures and displays an alert dialog if it finds a known offender and will be automatically updated via Mac OS X's software update as new malware signatures are found in the wild." This levels the playing field somewhat between it and the latest versions of Windows because, the article continues, "Leopard has some ASLR but everything is not randomized and... Read more →

Add "human factors"? No.

OK, Gary has asked if the CISSP CBK should be expanded to cover "human factors" in security? And I answer "No." With that kind of beginning, you could be forgiven for thinking that I disagree with Gary about the importance of human factors in security. Nothing could be further from the truth. I agree with everything he has said about the fundamental significance of human factors in information security, as well as the difficulty of dealing with them, and will defend to the death his right to say it. What I disagree with is the question. The CBK already addresses... Read more →

System Management Module Attack

This paper describes an attack on the Intel SMM (System Management Module). This is a very low level attack, and therefore would be able to circumvent almost all common software defences, and some that rely on hardware, as well. Read more →

Weekly Summary of the "DHS Daily Open Source Infrastructure Report"

This week’s set of DHS reports makes it clear to me that information security professionals worldwide should be reading the report every day or the synopsis published at http://dhs-daily-report.blogspot.com/. Should you have your doubts, read the following weekly summary and determine whether you are up-to-date on each of the items discussed. The DHS Daily Open Source Infrastructure Report covers the publicly reported material for the preceding day(s) not previously covered. This weekly summary provides a selection of those items of greatest significance to the InfoSec professional. Week Ending: Friday, July 17, 2009 Infrastructure Report for 13 July 2009 Do you... Read more →

Viruses Revealed online

After Macmillan refused to update the book, David and I got the copyright back, and planned to update it and release in online. Somebody beat us to it. This appears to be a blackhat site, so be careful, but the information appears to be there. Read more →

Fast flux and related technologies

This paper provides an overview explanation of fast flux and double flux activities related to hiding malicious Websites, or avoiding takedown (particularly related to botnets). It also suggests certain actions which could mitigate such activity. The essay uses a lot of jargon and is not always clear, but does provide a decent basic explanation. Read more →