|
Building a bridge from the CISO to the CEO 05/13/08 Chief information security officers (CISO), security consultants and other security personnel constantly face the difficulty
of reaching across a cultural divide to communicate our concerns to business leaders such as CEOs and their C-level and board
colleagues. Here are some resources that can help us do that.
Identity Finder helps prevent identity theft 05/08/08 I recently received a well-crafted press release from Identity Finder. CEO Todd Feinman prepared these tips, which you may
find useful for your own internal security newsletters.
Central Ohio InfoSec Summit coming up soon 05/06/08 The Central Ohio ISSA, the Central Ohio ISACA, and the Central Ohio InfraGard chapters have joined together to promote the
first annual Central Ohio InfoSec Summit in Columbus on May 13.
Zapping 'zappers' 05/01/08 In cases of suspected embezzlement via software, I think we have to seize the working system, not only make bitwise copies
of the data but also create a clone of the entire system using hardware that's as close to the original as possible, and then
exercise the clone under tight observation using known inputs as if we were conducting a thoroughgoing software quality assurance
inspection.
Zap! You're under arrest 04/29/08 Richard T. Ainsworth, a lecturer at the Boston University School of Law, has written a fascinating report on the use of 'zappers'
- programs which divert funds for systematic embezzlement of tax obligations. The paper is 'Zappers: Tax Fraud, Technology
and Terrorist Funding.'
Scan ScanSafe's annual report for heuristic experience 04/24/08 Recently, ScanSafe released its 25-page 'Annual Global Threat Report: Trends for January 2007-December 2007.' The report was
written by Senior Security Researcher Mary Landesman. Here are some of the highlights of the report.
Comprehensive security needed to prevent printer hacking 04/22/08 Inadequate authentication and insufficient print activity records can compromise security. In general, there is little or
no control over the IT infrastructure responsible for printing.
Your printer: An open door for hackers? 04/17/08 It turns out that the old problem of misdirected faxes has a new twist: networked printers are posing the potential for misdirected
printouts - including printer hacking.
Managing CSIRT burnout and turnover: a case study, Part 3 04/15/08 We finish MSIA graduate Timothy Dzierzek's case study analysis of burnout and turnover in help desk and computer security
incident response teams (CSIRT). This last part of three discusses how his case-study organization ("Smith & Smith" is a pseudonym)
addressed the problems of turnover and finishes with recommendations for readers.
Managing CSIRT burnout and turnover: a case study, Part 2 04/10/08 We continue with MSIA graduate Timothy Dzierzek's case study analysis of burnout and turnover in help-desk and incident-response
teams. This second part of three discusses the problems of turnover at "Smith & Smith" (a pseudonym).
Managing CSIRT burnout and turnover: a case study, Part 1 04/08/08 Once we've hired a good employee and invested in training and integrating that person into our operations, it's a terrible
waste to lose their enthusiasm and even their services through burnout and turnover.
April Fool's lessons 04/03/08 The day before April Fool's Day (AFD) this year, one of my colleagues and I conspired to play a trick on our friend and colleague
Peter Stephenson, associate program director of the MSIA program at Norwich University - and I have his kind permission to
tell you about it.
MessageLabs Intelligence Reports make good reading 04/01/08 Recently I explored a useful resource in the Intelligence Reports from MessageLabs. The Intelligence Reports are brief analyses
of spam and virus prevalence with news articles summarizing significant new developments in the periods they cover.
The state of spam: An interview with Jamie de Guerre, Part 2 03/27/08 What does the future hold for fighting spam? My two-part interview with Jamie de Guerre, CTO of Cloudmark, concludes today.
The state of spam: An interview with Jamie de Guerre, Part 1 03/25/08 Spam is a major operational problem for all professionals because of its waste of bandwidth; it is a significant nuisance
even for non-professionals, contributing to computer-based crime and increasing doubts about e-commerce. I recently interviewed
Cloudmark CTO Jamie de Guerre via e-mail and am pleased to convey our discussion in a two-part report.
Security roles made brilliantly clear 03/20/08 Today I'm pleased to report on yet another fine contribution from Charles Cresson Wood: his
'Information Security Roles & Responsibilities Made Easy'. Now in its second edition, this compendium provides a complement
to his earlier work by providing what it claims - an extensive compilation of well-defined roles and responsibilities.
Process over presumption: The Vermont encryption key decision 03/18/08 On Dec. 17, 2006, Canadian citizen and legal U.S. resident Sebastian Boucher crossed the U.S. border into Vermont at Derby
Line. A U.S. Immigration and Customs Enforcement agent inspected the 30-year-old man's computer and reportedly found pornography
and - significantly for this case - child pornography on the Z: drive. The laptop was seized as evidence and Sebastian Boucher
was charged with transporting child pornography across interstate borders. Two days later, when agents tried to access the
Z: drive, they found that it was encrypted using PGP.
Chapters in 'Information Roles & Responsibilities Made Easy' 03/17/08
Charles Cresson Wood's list of common mistakes you should avoid 03/17/08
Protecting your SSN and your reading habits 03/13/08 It strikes me that any government-held central database of identifying information and other data about citizens always raises
the risk of abuse as political winds change. The issue is not whether someone has something to hide; the issue is whether
officials in different political circumstances will be able to abuse their access to information to persecute those with whose
political views they disagree.
Why identity-theft rates are so high 03/11/08 An issue that lies at the root of the rise in identity theft involving credit-card fraud is the system of fraud-recovery in
the U.S. banking system. If banks bore a greater percentage of the costs of fraud, they would invest in better security.
Defending against identity theft: Identity Guard 03/06/08 Reader Michael Ste. Marie writes: Identity Guard has four levels of protection available through monthly or yearly installments.
Each level offers increased services.
Defending against identity theft: LifeLock 03/04/08 A reader writes: After reading Dr. Kabay's recent articles on identity theft I was inspired to do a little research about
anti-identity theft companies. I am happy to report there are affordable options to ensure your personal information is safe
and to reduce the financial consequences even if someone does steal your information and your identity.
Windows Server 2008: The shape of the world to come 02/28/08 Microsoft launches Windows Server 2008 (formerly known as Longhorn) this week. Unlike many previous versions of its predecessors,
the move to this new Microsoft server is likely to trigger a radical shift in the business and social spheres far beyond the
usual set of mundane issues related to IT system administration. Windows Server 2008 will likely exterminate 32-bit computing
as we currently know it.
Service management metrics significant for CSIRTs 02/26/08 Why do some organizations manage to run their IT services efficiently and effectively? Today I want to discuss some recent
research into that question that bears on computer security incident response team (CSIRT) management.
More articles
»
|