(ISC)² Blog

BSIMM2

A considerable change from the first Build Security In Maturity Model. Version 2 has more structure, but I'm not sure that the two-dimensional model adds much. It still isn't a "maturity" model as such. Still, anything that gets more app dev security advice out there ... Read more →

US DoD SDLC

The US Defense Dept has a system for everything, and most are fairly structured. Their Integrated Defense Acquisition, Technology and Logistics Life Cycle Management System Chart is no exception. However, if you pay attention, it does provide a detailed structure and process for secure development. (Warning: their cert is self signed, and your browser may object.) You can also get the chart PDF from https://acc.dau.mil/IFC/pdfs/Front_Ver_534_June_15_2009_34x22.pdf Read more →

Android Insecurity

Late last year, a nefarious banking app was discovered on the Android phone marketplace. This, I'm afraid, is just the beginning. Doing some Android phone development recently, I have gotten some hands-on experience with how an application is deployed to the Android Marketplace. One big difference between the Google and Apple mobile software stores is that Apple vets and approves each app before it is made available for public download. With Android, anyone who pays the $25 registration can upload an application to the marketplace. To upload an application, it first must be signed with your own digital signature. This... Read more →

Avoiding a Project Ambush

There was a story I read recently on the Times Online: French troops were killed after Italy hushed up ‘bribes’ to Taleban. What could this tragic event possibly have to do with IT security? Let me explain. First, there were allegations that the Italian government had been paying bribes to the Taliban in exchange for save haven. But Italy vehemently denied it. Then, last year, ten French troops were killed in what they had previously assessed to be a peaceful area of Afghanistan. Before France went into this deadly area, they (of course) did a risk assessment. What factored considerably... Read more →

DoD IA Policy Chart

For your information, the Defense-wide Information Assurance Program (DIAP) has just released the IA Policy Chart via the IATAC web site at http://iac.dtic.mil/iatac/ia_policychart.html. The chart, plus background notes can be found at that site. In addition, the IA Policy Chart will be included as a centerfold in the January 2010 edition of the IATAC’s IAnewsletter. The goal of the IA Policy Chart is to capture the tremendous breadth of applicable policies, some of which many IA practitioners may not even be aware, in a helpful organizational scheme. The use of color, hatching, fonts and hyperlinks are all designed to provide... Read more →

Bundling Security with the OS

Mac OS 10.6 (Snow Leopard) is being released tomorrow, and with it a much-improved version of File Quarantine, security software bundled with OS X. CNET posted an early review of the OS and states "File Quarantine checks for known malware signatures and displays an alert dialog if it finds a known offender and will be automatically updated via Mac OS X's software update as new malware signatures are found in the wild." This levels the playing field somewhat between it and the latest versions of Windows because, the article continues, "Leopard has some ASLR but everything is not randomized and... Read more →

Should the CISSP CBK be improved to place greater emphasis on “human factors” in information security? Definitely Yes!

Should the CISSP CBK be expanded to cover "human factors" in security? [1] Add “Human Factors” No.[2] Clearly, human factors are a major component to information security and Gary Hinson presents effective arguments that they should be established as an additional domain. On the other hand, Rob Slade makes an effective argument that the human factors are a significant component of each of the current ten domains primarily based on his experience teaching the CBK® to CISSP® aspirants for (ISC)²®. In full disclosure, I also teach the CBK® to CISSP® aspirants, but not for (ISC)²®, but at a local college.... Read more →

Building Security In Maturity Model (BSIMM)

The Building Security In Maturity Model (BSIMM) is a good framework to follow for secure software development. Those who are familiar with the various Capability Maturity Models may be a bit surprised: this model doesn't come from the same institution and doesn't follow the same pattern. It's more of a breakdown framework, with a checklist of points to address, with some assignment to limited maturity levels. Read more →

Diagramming a Secure Connection

I was listening to a recent Security Now podcast that reviewed some important cryptography concepts, when Mr. Gibson made an interesting point: "let's assume that we have control of each end, but we have no control at all of the link between, i.e., the Internet. So that means that our communication is subject to having bits dropped, bits added, bits changed, and even bits replayed, things, packets replayed." This made me think about how we describe these type of connections, visually. The picture commonly drawn on a white board to describe a secure channel over the Internet (and I am... Read more →

Understanding the Web browser threat

An interesting piece of research and discussion, examining browser vulnerabilities, and the risk to the computing envrionment as a whole, in light of a large number of factors. Read more →

Spellcheckers creating disaster

We have all kinds of systems to help us out. Sometimes they help us *way* out. Sometimes they create the most amazing problems. This article addresses that kind of situation. (I recall a, well, "politically correct checker," I suppose, which, some years ago, amended a newspaper article in order to inform people that a certain local municipal government was, fiscally speaking, "back in the African-American" ...) Read more →

Injecting the Common into Security

According to several news articles Friday, February 20th, and documented on hackersblog.org by the hacker named Unu, the Security and A/V "giant" Symantec had a bit of a website face lift as a result of a SQL-injection vulnerability within the website. The website was defaced as can be seen in the following image: The stories and associated blog references can be found at the following links: http://www.itp.net http://news.softpedia.com http://www.hackersblog.org Granted, based on the articles and information so far, the "ethical hacker" Unu used this method of notification to "help" alert Symantec to the problem. Outside of the ethical issues surrounding... Read more →

Mitre/SANS Top 25 Programming Errors

The OWASP Top Ten has some more competition. Based on the SANS Top 20 attack vectors and MITRE's Common Weakness Enumeration (CWE), this document presents detailed descriptions of the top 25 programming errors along with guidance for mitigation. The errors are also cross referenced against related CWE items, as well as the Common Attack Pattern Enumeration and Classification (CAPEC) structure. Read more →

Software Security Top 10 Surprises

Gary McGraw, Brian Chess, and Sammy Migues interviewed nine executives running top software security programs, and wrote an article for InformIT. Some results showed that we are still not doing enough, even at our best. Some showed that some of the things we stress most heavily are actually wrong. The article is summarized in a bullet list. Read more →

SAFECode practices for secure software development

This PDF lists some basic software development practices. Read more →

Microsoft Learning Paths for Security

A kind of topical index to some Microsoft security materials. Read more →

Proxy Caches and Web Application Security

Following up on my earlier post, Proxy Caches are a Challenging Threat to Internet Security, here is my October 21, 2008 presentation at OWASP AppSec Asia 2008, Taiwan. View SlideShare presentation or Upload your own. (tags: security cache) PS: I highly recommend SlideShare for sharing presentations. Read more →

Cross Organizational Collaboration - Securing the World with Cooperation

We just completed an awesome conference in Taipei, so I posted some Comments on Proxy Caches and Web Application Security (OWASP Taipei) on my blog. Like many of you, we are members of multiple security-related organizations including non-profit, government, military, educational and commercial organizations. I happen to be both an (ISC)² member as well as chapter leader for (the new chapter) OWASP Thailand. Many (ISC)² members serve on myriad IT-security boards as directors and advisors. In addition, various organizations support and sponsor each other; for example, (ISC)² is an OWASP sponsor. As professionals, it is our responsibility and ethic to... Read more →

Securing Software Through Professionalism

The challenge of software vulnerabilities has been discussed by many in the information security industry for several years now. Not only have there been several major breaches due to unsecured software, the costs continue to rise for those of us who have to maintain systems and constantly patch the vulnerabilities that are found. As we know, the problem is not isolated to any particular piece of software – it’s across the board, whether it’s operating systems, word processing, new media or any other application that can make enterprises open to attack. After hearing from our members and those who write... Read more →

Visualization for Command and Control of Cyberspace Operations

AF083-022 TITLE: Visualization for Command and Control of Cyberspace Operations TECHNOLOGY AREAS: Air Platform, Information Systems, Space Platforms, Human Systems The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), which controls the export and import of defense-related material and services. Offerors must disclose any proposed use of foreign nationals, their country of origin, and what tasks each would accomplish in the statement of work in accordance with section 3.5.b.(7) of the solicitation. OBJECTIVE: Develop visualization techniques for planning and execution of Cyberspace operations. DESCRIPTION: Fulfilling the Air Force mission “… to fly and fight... Read more →