(No Ratings Yet)
Loading ...Dan Swanson’s Security Resources: #2
I introduced my security resource education initiative last week (click here if you missed it). Each week, I’ll present six leading resources which will be useful to all information security professionals as well as many IT professionals.
As everyone knows there is no end to the professional development efforts for any professional and this column is dedicated to providing resources that will be useful for all IT security professionals and IT professionals to study and learn.
They are provided to support the improvement of your organization’s security practices and security posture, and always remember, there is no better way to learn than by doing.
The resources provided this week include guidance regarding:
• the insider threat issue,
• leading methods for developing secure Web code,
• what security is truly facing (a war), and
• a Web site dedicated to the ISO27000 security standard series.
Enjoy.
Dan Swanson
Dswanson_2005@yahoo.com
1. CERT® Insider Threat Research
The CERT insider threat research focuses on both technical and behavioral aspects of actual compromises. They produce models, reports, training, and tools to raise awareness of the risks of insider threat and to help identify the factors influencing an insider’s decision to act, the indicators and precursors of malicious acts, and the countermeasures that will improve the survivability and resiliency of the organization.
2. The Open Web Application Security Project (OWASP)
OWASP is dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. Their open source projects and local chapters produce free, unbiased, open-source documentation, tools, and standards. The OWASP community also facilitates papers, conferences, local chapters, presentations, and mailing lists. If you’re new to application security, try their “getting started guide”.
3. The Information Warfare Site (IWS)
IWS is an online resource that aims to stimulate debate about a range of subjects from information security to information operations and e-commerce. It is the aim of the site to develop a special emphasis on offensive and defensive information operations. IWS first went online in December 1999. Since its launch it has undergone a complete redesign and many key texts have been added. In adherence to its founding principles IWS has developed several mailing lists to enable a more interactive debate.
4. The Defense-in-Depth Foundational Curriculum handbook discusses information assurance issues and how to address these at both organizational and technical levels. The handbook is written for students ranging from system administrators to CIOs who have some technical understanding of information systems.
5. Gary Hinson’s Web site has a variety of excellent resources. He maintains a comprehensive page of links for ISO 27000 resources and IT governance.
6. GAO Executive Guide: Information Security Management: Learning From Leading Organizations.
A high priority of the CIO Council is to ensure the implementation of security practices within the Federal government that gain public confidence and protect government services, privacy, and sensitive and national security information. This Executive Guide, “Information Security Management, Learning From Leading Organizations,” clearly illustrates how leading organizations are successfully addressing the challenges of fulfilling that goal. These organizations establish a central management focal point, promote awareness, link policies to business risks, and develop practical risk assessment procedures that link security to business needs. This latter point–the need to link security to business requirements–is particularly important, and is illustrated in a statement of a security manager quoted in the guide: “Because every control has some cost associated with it, every control needs a business reason to be put in place.”
Add to: del.icio.us | Digg IT | Furl | Google | magnolia | StumbleIT | Wink | Yahoo! Technorati
(No Ratings Yet) Loading ...Dan Swanson joins our blogging team
I’m pleased to let you know that security expert Dan Swanson has joined our blogging team. Dan is a 25-year internal audit and information security veteran and currently a senior Information Security consultant at Seccuris Inc. He’s done consulting projects for more than 30 different organizations; spent almost 10 years in government auditing at the federal, provincial, and municipal levels; and in the private sector, worked mainly in the financial services, transportation, and health sectors. He’s written more than 125 articles on information security, internal auditing, security and other management topics, and is a regular columnist for ComplianceWeek between freelance writing and consulting assignments.
Dan’s MO is to put you in touch with the online security resources you need. You’ll find at least half a dozen useful links each week. He’ll be posting each Wednesday in our Security Insider blog. In fact, he would have posted this Wednesday, but his editor (that would be me) dropped the ball, so the post was cleared on Friday. (Let the flogging commence.)
Check back each week for more security resources.
Add to: del.icio.us | Digg IT | Furl | Google | magnolia | StumbleIT | Wink | Yahoo! Technorati
(No Ratings Yet) Loading ...Dan Swanson’s Security Resources: #1
Recently someone forwarded me a comprehensive survey of Canadian IT professionals that indicated there was a lack of information security guidance available for IT and security professionals to follow. I strongly disagree with the point of view that more guidance is needed to operate a secure environment and implement secure systems and solutions, although certainly more papers on various challenging subjects would always be beneficial.
Each week over the coming months, I plan to highlight leading security resources and initiatives that will support your efforts to improve security practices within your organization. Each column, I will highlight a half dozen leading security focused resources covering various aspects of information security management.
Finally, people learn in different ways. Some like to read, some like to hear, some like to see, some like to discuss, etc. Whichever method works for you is fine. My approach is to highlight leading resources to people and let them determine what is the best way to digest the knowledge and, more importantly, apply it in the their professional efforts. I have found considering how to apply the general guidance to the specific organizational situation is one of the best ways to obtain a deep understanding of the key concepts, methods, and recommendations being presented by the various resources. In other words — implementing change is always the best teacher.
Share this posting with your colleagues. Good luck and have a great week.
1. The ISF Standard of Good Practice for Information Security
The ISF standard is designed to help any organization, irrespective of market sector, size or structure, keep the business risks associated with its information systems within acceptable limits. It is a major tool in improving the quality and efficiency of security controls applied by an organization.
2. CERT® Coordination Center (CERT/CC)
The CERT Coordination Center (CERT/CC), arguably the most widely known group within the CERT Program, addresses risks at the software and system level. Although it was established as an incident response team, the CERT/CC has evolved beyond that, focusing instead on identifying and addressing existing and potential threats, notifying system administrators and other technical personnel of these threats, and coordinating with vendors and incident response teams world wide to address the threats.
3. Information Security Handbook: A Guide for Managers
NIST has published a new information security handbook which should be “required reading” for pretty well most everyone involved with IT and/or IT Security although some people can certainly skim many of the sections in this 176 page document.
4. Secure Coding: Principles & Practices
Welcome to the on-line home of Secure Coding: Principles and Practices (O’Reilly, 2003). They provide information about the book and its authors; updated versions of links and tables that appear in the book; and also original supplemental material like op/ed pieces and vulnerability analyses. It’s all offered in the spirit of helping us build strong and light “virtual bridges” in the years to come.
5. The Information Systems Security Association (ISSA)
ISSA is a not-for-profit, international organization of information security professionals and practitioners. It provides educational forums, publications and peer interaction opportunities that enhance the knowledge, skill and professional growth of its members. With active participation from individuals and chapters all over the world, the ISSA is the largest international, not-for-profit association specifically for security professionals.
6. Process Agnostic Navigational View
The process agnostic approach incorporates security into each basic phase of software development. The best practices and methods described are applicable to any and all development approaches as long as they result in the creation of software artifacts.
https://buildsecurityin.us-cert.gov/daisy/bsi/438.html
Add to: del.icio.us | Digg IT | Furl | Google | magnolia | StumbleIT | Wink | Yahoo! Technorati
(3 votes, average: 10 out of 10) Loading ...CanSecWest PWN to OWN 2008
So this is a rather interesting story, which beautifully lends itself to sensational press and great article titles like “MacBook Air hacked in two minutes” and “Vista falls, Linux holds strong”. This frankly, is exactly why TippingPoint and CanSecWest sponsor and host the contest. The very noble “we took another zero-day vulnerability off the streets” sounds like as good a reason as any to have some hacker fun. Hey, I’ll buy it.
Here’s the problem, few people bother to understand any detail of what happened. They just read the “Ubuntu wins” and figure it’s safe to assume that’s the most secure operating system choice, or that OSX fell first, so it must be the least secure.
Let’s look at what actually happened. Read the rest of this entry »
