 |
Who's Online |
 |
|
There are currently, 86 guest(s) and 14 member(s) that are online.
You are Anonymous user. You can register for free by clicking here
|
|
|
 |
| |
Clement and Nathalie are proud to Welcome you to the CCCure.Org web site!
The companies listed below are long term sponsors or supporters. Their support allow us to keep the site up and running for FREE.
On this site you will find resources to help you prepare and study for the CISSP, SSCP, CAP, ISSEP, CISM, CISA, ISSPCS, SANS GIAC GCFW certification.
Clement & Nathalie Click Here to contact us |
|
If you see this message, it means you are an anonymous visitor
This web site is offering free security education resources to help you expand your knowledge and skills or simply to reach some of your certification goals.
As an anonymous user on the web site there is little you will have access to. Registration will give you extra benefits and also allow you to access content such as our huge download section, our study guides, our quiz engine, our exam crams, our web links, and our forums to name only a few.
IMPORTANT: Usage Agreement (Please read)
By registering on this web site you give permission and authorize CCCure.Org to send you advertising messages from our sponsors. The messages sent are for products or services that are security oriented. We will NOT send messages about male enhancement or other types of get rich/bigger scams or similar services. The messages from our sponsors are sent only a few times a month and your email address is NEVER given or resold to anyone else. We will pass the message on behalf of our sponsors but they never get access to your email address.
The web site is self supported through donations and advertising from our sponsors. Donations alone are simply ineffective and do not even pay for hosting and bandwidth fees. We must rely on our sponsors to survive. This is why we have such a policy in place. The final benefit to you the members and visitors of the web site is: FREE ACCESS
Forcing registration also ensures that we minimize the amount of junk that unscrupulous users attempt to post within messages, comments, web links, download areas, forums, or any other place where they can post their unsolicited and unwanted messages. The greatest benefit of all is the fact that it helps us in maintaining quality content.
Once you are registered and logged in, you will no longer see this message and new menus and options will be available to you as a registered member.
If you do not agree with the policy above, please do not register.
Best regards
Clement and Nathalie
Site Maintainers
|
|
 SSL-Explorer
Posted by boss on Saturday, May 10 @ 11:54:33 EDT (49 reads)
jdupuis writes "As a follow up on the last article about SSLVPN software and appliances, I was lucky enough to stumble upon a gold mine of a find called SSL-Explorer. This virtual appliance which can be installed on Windows or Linux and has everything that small/medium sized businesses would be looking for in a SSLVPN solution at an affordable price.
SSL-Explorer offer’s many authentication methods such as Active Directory, LDAP, Radius and multi-factor authentication which would accommodate the most secure of environments. This feature rich software provides many configuration options which include web forwards which allow for Intranet access from anywhere in the world. The Network places extension which provides the administrator the option to allow access to internal FTP and Windows CIFS/SAMBA systems. The application extension includes the Microsoft RDP client, Putty, VNC and WINSCP for easy access to internal resources without giving up the keys to the kingdom. Although if additional access is required a Network extension is provided that will actually give IP access to your internal network and allow tele-workers to function outside the office at a very reasonable cost.
In addition to the application features a granular access control panel is provided to the administrators of the system. The lockdown options of SSL-Explorer include individual logins, group membership, policies associated with individual groups, granular access rights to the system and IP restrictions to prevent unauthorized connections.
If all the above is not enough to sell you on trying SSL-Explorer the company offers a freeware package which provide many of the above mentioned features except for a few which require a license key to activate. I have been using this software for about a year and would highly recommend it to anyone looking for a remote access gateway.
See: http://sourceforge.net/projects/sslexplorer/
"
(comments? | Score: 0)
|
|
SECNAP Chief Technology Officer to Speak at Hacker Halted Conference
Posted by boss on Wednesday, May 07 @ 20:18:26 EDT (69 reads)
Anonymous writes "SECNAP Chief Technology Officer to Speak at Hacker Halted Conference
Michael Scheidell Will Deliver Opening Keynote Address
Boca Raton, Fla. - May 6, 2008 - Michael Scheidell, chief technology officer for SECNAP® Network Security Corporation, has been selected to deliver the opening keynote address at the Hacker Halted Conference on Sunday, June 1, 2008 at the Marriott Resort at Grande Dunes in Myrtle Beach, S.C.
Hosted by EC-Council, Hacker Halted will debut in the United States May 28 to June 4 in conjunction with the Techno Security Conference. Hacker Halted will feature some of the top speakers in the world, and is in its tenth year raising international awareness toward increased education and ethics in Information Technology security.
Michael Scheidell is a recognized expert in network and data security with a rich history of innovation. Since 2001 he has aggressively pursued the development of advanced security technology with impressive results, including a patent-pending intrusion detection and prevention system and a revolutionary spam solution.
Scheidell's presentation proposes that three additional, undocumented layers of the Open Systems Interconnection (OSI) model exert a powerful influence on information security decisions, and is intended to help delegates manage these influences to become more effective in their organizations and more successful in their careers.
Delegates will include chief security officers (CSO), chief information security officers (CISO), and other C-level executives as well as information technology management, security architects and engineers, auditors and practitioners of information technology across a variety of industries.
The Hacker Halted Conference also affords attendees the opportunity to complete training for certification by EC-Council as a Certified Ethical Hacker, Computer Hacking Forensic Investigator, and Licensed Penetration Tester. For additional information visit www.hackerhalted.com and www.eccouncil.org.
About SECNAP
Founded in 2001 in Boca Raton, Fla., SECNAP Network Security is a leading provider of network security solutions for organizations ranging from small businesses to global enterprises. The company's innovative products include SpammerTrap® and Hosted SpammerTrap®, which block malicious spam, viruses, and phishing emails; HackerTrap(TM), a patent-pending managed network security system that protects company assets; and expert Testing and Auditing services including Information Technology and regulatory compliance audits. SpammerTrap was named a Hot Product at the 2008 XChange Solution Provider Conference. SECNAP is a Technosium Hot Company of 2008. For more information, visit www.secnap.com.
http://www.secnap.com
http://www.hackerhalted.com
# # #
Contact:
Gail Blount
561-999-5000
gblount@secnap.com
"
(comments? | Score: 0)
|
|
News on the ISO/IEC 27000 Series of standards
Posted by boss on Sunday, May 04 @ 15:41:46 EDT (105 reads)
cdupuis writes "Following the JTC1/SC27 meeting in Kyoto last month, I've published a load of updates on the ISO/IEC 27000-series standards ("ISO27k") at http://www.iso27001security.com/For anyone who would like to keep up to date on ISO27k, highlights of the meeting (from my personal perspective i.e. *not* an official status report!) are shown on a 2-page mindmap.
Kind regards,
Gary
Gary Hinson
Passionate about security awareness
www.NoticeBored.com Creative awareness materials
http://www.iso27001security.com/ ISO/IEC 27000 standards
"
(comments? | Score: 0)
|
|
SecurAnchor Newsletter by Eric Cole
Posted by boss on Friday, May 02 @ 10:20:23 EDT (308 reads)
cdupuis writes "
|
|
| April 2008 |
Vol 4, Issue 3
|
|
 |
Security in the News
Your source for up to date security headlines
|
|
|
| |
Joe Stewart, director of malware research at SecureWorks, Inc., presented the results of his research into the size of botnets at the RSA conference, and asserted that botnets control over one million compromised computers and are able to generate more that 100 billion spam messages every day.
According to Mr. Stewart, the botnet controlling the most machines is Srizbi. This botnet is also known as Cbeplay and Exchanger, and has the capability of using its 315,000 controlled machines to generate 60 billion spam emails per day.
The Kraken worm's botnet is actually the Bobax botnet, and the Storm worm has been marginalized by its addition to Microsoft's Malicious Software Removal Tool hit list, knocking it down to number five on the list.
Bobax appears to be the number two botnet, controlling 185,000 machines. It can send 9 billion spam emails per day. Damballa has been making news claiming that Bobax is Kraken, or Kracken, and Damballa claims it controls 400,000 computers. However, Mr. Stewart said that Bobax goes by the name Kraken, as well as Bobic, Oderoor, Cotmonger and Hacktool.Spammer.
Mr. Stewart has developed a technique to generate an SMTP fingerprint for the various botnets, leading to more accurate identification and counts of botnet-controlled machines. SecureWorks also sampled the amount of spam that was observed as generated by various botnet-controlled machines and used probabilistic methods to extrapolate and determine how many spam emails the various botnets could generate.
Part of Mr. Stewart's aim was to help the little guy. As he explained, "I think it matters a lot to end users what a botnet's called. They go to look for information, perhaps after they've been infected, and all they have is that it's 'Agent XYZ.'" However, if there are various incompatible naming conventions, then it might be a worm with a new alias. "Then they'd find hardly any information on what it is or what data it may be after. I hope this trickles down to end users."
|
|
Anti-Tibetan Supporter Trojan Infects Pro-Tibetan Sites
|
|
Users who browse pro-Tibet sites can be infected with the Fribet Trojan. The best guess is that the Trojan is using a VML flaw (MS07-004) which Microsoft released a patch for last year. Unpatched systems visiting these sites can be subjected to an attack that creates a backdoor on the victimized systems.
The Trojan loads a 'SQL Native Client' ODBC library and executes SQL statements sent by command and control servers. This allows the attackers to gather data or modify databases the victims' machines are connected to with the appropriate logins and permissions. The monitoring feature of the Trojan allows the interception of passwords so the attackers will be able to log in to the databases.
Shinsuke Honjo and Geok Meng Ong, researchers for McAfee, wrote that, "This Trojan apparently can be used as an alternate to SQL injection attacks, but in a more direct way. Even the administrators of secure Web sites, protected against common SQL injection attacks, should ensure database backends are equally secure to defend against such a penetration vector."
|
|
 |
|
|
|
CAPTCHA Broken by Botnets
|
The Windows Live CAPTCHA system used for Hotmail and the equivalent system at Gmail have been compromised by botnets which can crack the system. CAPTCHA was designed to stop spammers from opening Hotmail and Gmail accounts. These systems display distorted characters and are supposed to force a human to read, recognize and type the characters, thus preventing the automated creation of email accounts.
CAPTCHA is an acronym for Completely Automated Public Turing test to tell Computers and Humans Apart.
Spammers like Gmail accounts because they are free and not likely to be blacklisted. Now that the spammers own these types of free accounts, more spam is coming from those free providers' email accounts. Anti-spam services then attempt to slow down the flow of spam from those compromised accounts.
MessageLabs' Paul Wood said, "We're seeing more spam coming from Gmail and Yahoo. Where a service is widely abused its reputation goes down and it's held back in the queue. This happens automatically. These traffic management controls are not designed to block messages, they are intended only to slow down their transit. For messages that are subsequently blocked there should be a reason given in the non-delivery report."
February, 2008's spam report indicated that 4.6 percent of spam is sent from Web-based mail services. The Gmail-originated span doubled from January to February to 2.6 percent. Yahoo was the worst of the Web-based mail services, accounting for 88.7 percent of Web-based spam.
Meanwhile, in India, the spam rajas who do not have the good CAPTCHA-cracking bots employ sweatshop labor for $4 per day to establish Web-based email accounts
|
|
|
|
|
The GAO report stated that, "GAO found numerous defense-related items for sale to the highest bidder on eBay and Craigslist. A review of policies and procedures for these Web sites determined that there are few safeguards to prevent the sale of sensitive and stolen defense-related items using the sites."
The GAO investigators clicked around from January 2007 through March 2008, and came up with two F-14 components (from two vendors), night-vision goggles with the friendly force identifying 'component,' body armor and an Army combat uniform.
Continuing, the GAO report made the point that bad guys getting hold of this stuff could reverse engineer it to come up with countermeasures.
This GAO report, which the GAO characterized as not comprehensive in any way, did not address whether export controls would keep bad guys from getting the stuff, nor did it look at the failed property management practices which have made stuff available in the past.
Instead, we have the CEO of Craigslist called before Congress to explain what Craigslist is. Jim Buckmaster explained that the GAO report was mistaken when it called Craigslist "a global marketplace with international reach" and that instead Craigslist was a collection of separate local marketplaces. He also explained that users are discouraged from engaging in sales which require shipping.
|
Nine Years for $1.4M Fraud
|
To continue the theme of fraud and misrepresentation, the following comparison is offered. A Columbian man has been sentenced to nine years for computer fraud. This fraud (if unchecked) could have potentially affected more than 600 people and involved the staggering (attempted and actual) sum of 1.4 million dollars.
To refresh our memories, the contractor who sabotaged the Sixth Fleet navigation computers, which affected more than one submarine and put at risk the crews of every sub in the Sixth Fleet, received one year. To even look at the dollar value associated with the submarines is the wrong thing to do, but instead one must think about the potential loss of life associated with the possibility of a sub colliding with another sub or an undersea hazard.
When Simbaqueba Bonilla was seized by federal agents, the laptop he was carrying had the names and passwords of more than 600 people, as well as other personal and financial information about those people.
|
|
Single Photon Gate Realized
|
|
|
Quantum computing at the single photon level is closer to reality with the physicists at Bristol University in the United Kingdom creating an optical "controlled-NOT" gate on a silicon chip which can act on an individual photon. According to a press release from the university, this is "the building block of a quantum computer."
A quantum bit is called a "qubit" and the new gate, which processes the photon, or qubit, can now be realized on a single chip, whereas previously the gate occupied several square meters of space on an optical bench.
Mark Anderson, an influential voice in the technology community, wrote in his Strategic News Service newsletter that, "For those who believe that quantum computing is the next big breakthrough in the computing world, and who see the logic gate as a critical component, this is a critical step forward."
Professor Jeremy O'Brien, the lead researcher on the project, said that the chip "is a crucial step towards a future optical quantum computer, as well as other quantum technologies based on photons." One of Professor O'Brien's, Alberto Politi, also explained that it was the problem of scaling that this chip solved. Previously, the photons had to propagate through the air and required large optical elements. The new chip starts to solve these problems.
The chip has also enabled the researchers to observe quantum entanglement, an interaction of two particles in such a way that the state of an individual interacting particle cannot be defined, but the collective state of the interacting particles can be.
What is most important about this development, and which seems to have been left out of the discussion in the press, is the phenomenon associated with theoretical quantum computing, which is that the foundations of modern cryptography will be rendered obsolete. Symmetric key cryptography is a probabilistic exercise, and a quantum computer can try all of the possible keys to any encrypted message simultaneously. Presumably, then, the discrete log problem and the problem of factoring large numbers will also be solved, and therefore public key cryptography will also be useless for keeping any secrets.
|
|
Search Engine Optimization
|
|
Some individuals have employed questionable tactics to get the Web sites with which they are associated listed higher in the rankings for various search terms. Individuals who conduct these activities maintain that they are not breaking the law, and are only violating terms of service agreements. Search engine optimization has been going on since the advent of the meta tag, and as the search engines have come up with new ideas about relevance and what makes a Web site appear higher in the rankings for various search terms and phrases, optimizers have experimented, intuited, and even quit search engine companies to go into private practice, all in the name of getting those who pay, higher rankings. Those of us who believed in the Web as a level playing field and some concept of fairness have felt victimized by these tactics.
Now, apparently, so too the search engine providers themselves. The search engine optimizers (SEOs) had been finding the holes in the ranking algorithms and exploiting them. Google, around 18 months ago, started to penalize sites it thought were gaming the system, and then starting blacklisting the offending sites. According to critics of the tactic, some said that Google would delist sites without any warning.
Jeremey Schoemaker, the marketer known as Shoemoney, said that, "When people are ranking for a phrase and supporting their family, and then the next day they're off the map, that's really vicious. You can literally ruin someone's life."
One of the more cautious members of the SEO community, Eric Ward, who had been derided in the community for his by the book play, warned that black hat optimization was a dead end.
One of the ways that a site was deemed to be relevant was by how many other sites linked to it. In those days, SEOs built link farms - sites which were nothing but links to the sites which were hoped to get boosted in the ratings, and to each other, so that their rankings would help the end site in the rankings. The spiders crawled the links and added things up; the SEOs knew what to do.
When the search engines got wise to this technique and others like it, the SEO community started to polarize - with some working within the guidelines and others going to more extreme and shady tactics. And then sites which were infected with malware, sometimes through no fault of their own, were also penalized by the search engines.
RSnake is an individual with some experience with Web advertising, SEO work, and runs ha.ckers.org. He said that Google is making assumptions which are erroneous in their administration of search result rankings. RSnake said, "Google can shut you down at any time. But there are all kinds of weird things that could happen to you, upstream problems, a proxy goes bad, someone takes over your site, and there's no way for you to explain that it might not be your fault. They're making false assumptions about how the Internet works, which is that the owner of the IP address is always in control of what happens through that IP address."
Variations on the theme are rampant. Innocent sites are hacked to put links in the same color as the background on the site. Other tactics are cookie stuffing and attacks on high traffic blogs. MySpace and other social networking sites are used for the same linking purposes. And the value of search is lessened.
|
| Our mission is to keep your business focused by helping you navigate the sea of security threats you face on a daily basis. Secure Anchor provides creative solutions that keep you ahead of the attacks and provide peace of mind that your critical assests are securely anchored. In addition we are busy developing software solutions to meet the threats of tomorrow.
End your newsletter with a kick -- consider a postscript to reinforce one of the key product or service benefits.
Sincerely,
Eric Cole
Secure Anchor
|
|
|
|
|
| Pointsec Protector provides a policy driven mechanism that secures an organization's sensitive information by controlling data that enters and exits a PC or server via removable media and I/O devices on any port (USB, Firewire, IDE, Bluetooth etc). |
|
Are you???
|
 |
|
|
An Enterprise businesses or government agency
|
|
|
|
In Banking/financial services, federal/local government, healthcare, business services, technology and/or manufacturing |
|
|
|
In control of devices connecting to machines in your network
|
|
|
|
At Risk if Critical Data is lost
|
|
|
Do you Need to...
|
|
|
|
Reduce financial risk of lost or stolen data on personal devices connected to PCs or servers |
|
|
|
Comply with regulatory mandates |
|
|
|
Integrate into existing infrastructure |
|
|
|
Reduce operating costs
Let us send you a FREE USB device which contains a discovery tool to detect what is your exposure to Data Loss. If you would like one just send us an e-mail at newsletter@secureanchor.com and we will send it right out.
|
|
|
|
|
|
|
Secure Anchor | 11951 Freedom Drive | 13th Floor | Reston | VA | 20176
|
 "
(comments? | Score: 0)
|
|
NoticeBored Newsletter, May 2008 - Trust, integrity and fraud
Posted by boss on Friday, May 02 @ 10:00:06 EDT (107 reads)
cdupuis writes "
 |
 |
Information security awareness newsletter |
|
|
 |
|
| May 2008 - Trust, integrity and fraud |
|
Dear Clement,
Identity thefts, 419 scams, deliberate sabotage and fraud by trusted insiders (such as at Société Générale Bank) and numerous other information security incidents provide no shortage of topical material for our 60th module.
Technological controls alone are seldom adequate to reduce the risks, placing emphasis on human controls through training and education, policies and procedures, and various forms of management supervision (including, by the way, the IT audits we covered last month).
This being the 60th monthly module means NoticeBored is five years old this month! We’re celebrating our fifth birthday with a special offer – please visit the NoticeBored website or contact me for details. If you phone, please don't be surprised to hear party music in the background!
Kind regards,
Gary Hinson
CEO, IsecT Ltd. |
|
|
|
|
 |
Copyright © 2008 IsecT Ltd. Information in the newsletter is provided free, for information only and 'as is'. Whilst believed correct, it is in no way comprehensive. It is provided for interest only and is not intended to be relied upon as formal advice. No liability is accepted for any errors or for any losses that may be incurred if any such information is relied upon. You may freely distribute the PDF version of the newsletter intact (including the copyright notice and attribition) but please let us know if you intend to post it on the web.
Find out more about NoticeBored here. |
|
|
|
|
|
"
(comments? | Score: 0)
|
|
Aussies follow Canadian lead on breach notification
Posted by boss on Tuesday, April 29 @ 13:03:05 EDT (173 reads)
cdupuis writes "Both New Zealand and Australia have modeled their guidelines for telling customers about IT security incidents on a jointly-created British Columbia and Ontario privacy document. Is Ottawa paying attention?
By: Rafael Ruffolo
ComputerWorld Canada (22 Apr 2008)
Canadian Data breach notification guidelines – jointly created by the Information and Privacy Commissioners for British Columbia and Ontario – have made their way to the land down under.
Last week, Australian Privacy Commissioner Karen Curtis released the Voluntary Information Security Breach Notification Guide, which aims to assist organizations in effectively responding to information security breaches. The draft guide credits voluntary guidelines by both the Privacy Commissioners of Canada and New Zealand.
“We had worked with the New Zealand privacy commissioner and showed her our breach notification assessment tool,” Ann Cavoukian, Information and Privacy Commissioner of Ontario, said. “She took it and developed one in New Zealand similar to ours. It’s great to see Australia follow suit.” The jointly created Canadian breach notification guide was created in December 2006 and outlines steps on when and how to notify affected individuals.
“When you’re notifying somebody of a breach relating to their data, you’ve got to be perfectly clear and concise,” Cavoukian said. “In regards to the preferred method of notification, we think direct contact either by phone, letter or in person are the most effective methods.”
As for what to include in the notification, the assessment tool advises organizations provide a general description of what happened without a lot of legal jargon, outline the steps taken thus far (and will be taken in the future) to control or reduce the harm, and the steps the individual can take to further protect themselves.
“You’ve got to be practical and do things as quickly as possible,” Cavoukian said. “You need to contain the damages, get the notices out, fix the problem and prevent it from reoccurring. You’ve also have to be practical about it and notify people in a way that’s not full of legal legalese and provides clear notice as to what you’re doing.”
Currently, Australia’s privacy legislation does not specifically require an agency or organization to notify individuals, or even the privacy commissioner, of a data breach. However, an amendment to the Australian Privacy Act to require mandatory data breach notification is under way.
The same story is playing out in Canada. Last year, the federal government recommended that data protection laws – specifically the Personal Information Protection and Electronic Documents Act (PIPEDA) – be amended to include requirements for companies to notify individuals when their personal information was subject to a security breach.
Cavoukian hopes the breach notification assessment tool, along with the influence it is having on the other side of globe, will inspire the federal government to implement an effective and common sense approach on breach notification.
“They’re certainly aware of our guidelines, so I’m sure it’s food for fodder for them,” she said. “We’ve had very good feedback on our guidelines and I’m sure it’ll be one of the things that they take into consideration.”
But some organizations such as the University of Ottawa’s Canadian Internet Policy and Public Interest Clinic (CIPPIC) want the government to go even further. Responding to an Industry Canada request for public consultation on data security laws earlier this year, CIPPIC recommended that mandatory reporting of data breaches to a publicly-accessible electronic registry is the most effective way to persuade corporations to shore up their potential security risks.
“We’ve been pushing for notification requirements for years, because it’s obvious to me and my colleagues that, by and large, corporations are not doing as much as they should be to secure the personal information in their possession,” Pippa Lawson, executive director at CIPPIC, told ComputerWorld Canada earlier this year. “Our conclusion from years of research is that the market does not provide efficient incentives for effective security precautions, because in most cases, companies can hide the breaches and they are never publicly known about.”
Lawson said that while the government’s interest in drafting better data breach notification laws is positive, Ottawa needs to take it a step further and require mandatory public reporting as well.
“There’s two ways that you can create incentives for companies to take strong security measures: one is to make them pay financially through penalties and fines, and two is to give them bad publicity that can be even more costly,” Lawson said. “If there is a real risk of negative publicity for these companies, the CEOs will make sure that they put more resources into security.”
David Senf, director of security and software research at Toronto-based IDC Canada Ltd., said Canada would benefit greatly from similar privacy legislation passed in California, which mandates organizations to reveal to customers that personal data has been compromised.
“Organizations in this country don't fear the repercussions of PIPEDA,” Senf said earlier this year. “Stronger legislation will go a long way in convincing organizations to tighten up security for better privacy protection.”
Cavoukian, however, disagreed on taking such a punitive approach. As a regulator, she said, her concern is to ensure when something happens that it’s addressed immediately and as quickly as possible to benefit the affected individuals.
“You can almost take as a given that over time, virtually every company is going to make an oversight or a mistake and have some kind of data breach,” Cavoukian said. “My experience in working with organizations is that as soon as they know there’s a breach, they’re really motivated to cure the harm and prevent it. If you create a database of who did what and how many times they did it, I just don’t know how effective it would be.”
Copyright © 2007
ITworldcanada.com
Click HERE to see original article on IT World Canada web site "
(comments? | Score: 0)
|
|
The COBIT newsletter from ISACA
Posted by boss on Tuesday, April 29 @ 12:06:30 EDT (156 reads)
cdupuis writes "Dear Mr. Clement Dupuis,
Welcome to the April 2008 issue of COBIT Focus, a newsletter designed specifically for users of Control Objectives for Information and related Technology (COBIT). This newsletter provides updates on COBIT developments and is meant to provide a vehicle for sharing COBIT experiences.
You have received this e-mail message because you have participated or expressed interest in ISACA/ITGI products and services. The e-mail address was provided by you through the ISACA/ITGI web sites or other direct means. We did not purchase your e-mail address, nor do we provide your e-mail address to any third party.
We invite you, a member of the growing user community, to submit articles for publication in future issues. For more information on this opportunity, please e-mail the editors at publication@isaca.org. Additionally, please let us know what you think of the issue. Your responses will help us evaluate the value of the newsletter to COBIT users and identify any necessary changes. Please help support this initiative by submitting comments and articles to publication@isaca.org.
Volume 2 2008 of COBIT Focus is now posted online and may be accessed at www.isaca.org/cobitnewsletter.
The following articles are found in the April issue:
- COBIT and IT Governance: Focusing on IT Governance, Value Delivery and IT Investment Evaluation, by John W. Beveridge
- CGEIT Credential Meets Business Demands for IT Governance, by John Lainhart
- Adoption of COBIT by Multiplan, by Romulo Gouvêa and Tiago Quadra
- COBIT: An IT Governance Tool for the CIO and CEO, by Romulo Lomparte
- ISACA COBIT Education
www.isaca.org/cobitnewsletter
======================================================================
ISACA Member Benefit of the Month
The Information Systems Control Journal is an authoritative, peer-reviewed publication that has reported on topics such as Internet security, IT governance, computer crime, information integrity, computer confidentiality issues and IT risk management. ISACA members receive a subscription to the print version of the Journal which is published six times a year. Members also have exclusive access for one year to the online version, JOnline, which features additional articles not featured in the print version. Visit www.isaca.org/currentissue to view the latest Journal today! "
(comments? | Score: 0)
|
|
Geekonomics a MUST read book by David Rice
Posted by boss on Tuesday, April 29 @ 11:29:02 EDT (173 reads)
cdupuis writes "What is Geekonomics about?
Geekonomics is about the astonishing lack of consumer protection in the software market and how this impacts economic and national security. Software buyers are literally crash test dummies for an industry that is remarkably insulated against liability, accountability, and responsibility for any harm, damages or loss that should occur because of manufacturing defects or weaknesses that allow cyber attackers to break into and hijack our computer systems. As a matter of good public policy, this is unacceptable and must change.
Geekonomics is also about us and why we behave the way we do when it comes to protecting ourselves in cyber space. As such, Geekonomics is about incentives. Specifically, Geekonomics is about incentives that affect three groups of people: consumers, software manufacturers, and hackers. Each group has incentives for making, buying, and breaking into computer systems that are rife with defects, errors, and weaknesses. This book explains these incentives and how new and different incentives are necessary to address the problem of “bad” software.
Finally, Geekonomics is a book for everyone, not just for geeks or technophiles, because frankly, in modern civilization, how and when software touches us is less our choice every day.
Why is there a bridge on the cover of Geekonomics?
A bridge is infrastructure you can see. Software is infrastructure you cannot see. But the quality of software construction affects you as surely as the quality and attention to detail given to bridge construction. Perhaps more so. Software is the stuff of modern infrastructure and this infrastructure is pervasive and global.
Geekonomics strives to help you compare software with things like bridges and cement (among many others) that you are familiar with in the physical world. By relating what you are familiar with, with what you perhaps are not so familiar with, my hope is that the full scope and impact of software on your daily life will become more apparent.
Why is Geekonomics a necessary and novel approach to the dangers confronting national infrastructure?
The discussion about software security and how it impacts national infrastructure has largely been dominated over the decades by very smart, but very technically-oriented individuals. As such, their response to the “software problem” has been almost unanimously technical. It has also alienated the very people that software impacts: us. The problem of bad software has been a discussion lead by experts for experts. This was necessary, but far from complete. Software is so pervasive in modern civilization that the discussion should not be limited only to experts.
As Geekonomics argues, insecure software is as much an economic issue as it is a technology issue. This is a critical matter of public policy. Without proper incentives, technology alone will not address the problem of “bad” software. In short, incentives matter. To change the story of “bad” software, the incentives must change.
What do you want people to take away from reading Geekonomics?
We are all in this together. We are all, as economists like to say, trying to “maximize our utility.” That is, we, each in our own way, are trying to make our lives as absolutely pleasant as possible. But society is a morass of competing, mis-aligned, and contradictory incentives. This means individual actions, though beneficial to ourselves, may detrimentally affect others.
Though my tone is often times urgent and forceful in Geekonomics, I am not blaming software manufacturers in their entirety for the sorry state of cyber space. Software manufacturers are not consciously trying to harm you, hoodwink you, or otherwise cheat you; however, as Geekonomics argues, software manufacturers do not currently have sufficient incentives to look out for your well-being in a meaningful manner either.
A similar scenario existed in 1950s and 1960s America relating to auto manufacturers. Auto manufacturers were not trying to kill people when building cars that were more aesthetically pleasing than safe. But the result was tragic nonetheless. Market incentives simply promoted cars that were festooned with chrome and tailfins, but deadly in their operation.
Without meaningful incentives that held auto manufacturers to account, the modern car would not nearly be as safe as it is today. Geekonomics makes a similar argument regarding software. Wonderful graphical interfaces and “feature-rich” software are the modern equivalent of chrome and tailfins. Compelling indeed, but far from safe or secure, unless meaningful incentives exist to make it so.
Consumers are not without culpability however. Consumers are participants in the software market just as much as software manufacturers. Consumers too have an impact in what they demand, or do not demand, from software manufacturers.
Arguing which is more culpable for the sorry state of cyber space, consumers or software manufacturers, simply benefits the third group: hackers. The incentives of the software market must change for both consumers and manufacturers. The cyber attackers exploiting our computer systems are hungry, relentless, and cunning. Software needs to be suitable to the task and position we have given it within our national infrastructures. The incentives for attackers are simply too compelling to do otherwise.
The Real Cost of Insecure Software
• In 1996, software defects in a Boeing 757 caused a crash that killed 70 people…
• In 2003, a software vulnerability helped cause the largest U.S. power outage in decades…
• In 2004, known software weaknesses let a hacker invade T-Mobile, capturing everything from passwords to Paris Hilton’s photos…
• In 2005, 23,900 Toyota Priuses were recalled for software errors that could cause the cars to shut down at highway speeds…
• In 2006 dubbed “The Year of Cybercrime,” 7,000 software vulnerabilities were discovered that hackers could use to access private information…
• In 2007, operatives in two nations brazenly exploited software vulnerabilities to cripple the infrastructure and steal trade secrets from other sovereign nations…
Software has become crucial to the very survival of civilization. But badly written, insecure software is hurting people–and costing businesses and individuals billions of dollars every year.
This must change. In Geekonomics, David Rice shows how we can change it.
- Hardcover: 384 pages
- Publisher: Addison-Wesley Professional; 1 edition (December 9, 2007)
- Language: English
- ISBN-10: 0321477898
- ISBN-13: 978-0321477897
Geekonomics: The Real Cost of Insecure Software "
(comments? | Score: 0)
|
|
Online Libel & Google Reputation
Posted by boss on Friday, April 25 @ 23:10:51 EDT (201 reads)
cdupuis writes "A very low technology end to business and career. Reputation is what others say about you. Character is what you really are as evidenced by your actions when no one is observing. IMPORTANT DISCLAIMER: Readers are advised that this essay be considered as common sense advice, not legal advice. For that you need to go to a lawyer. IT security is a multibillion dollar industry which has necessitated new and constantly revised laws in almost every state on earth. These laws address the criminal aspects of aggressive and deliberate business or personal privacy invasion and information disruption or destruction via various technology mediums; commonly referred to as “hacking”, or more accurately “cracking”. So what is the “low” technology threat that goes largely unnoticed by the community, ignored by criminal prosecutors and yet the cause of billions of dollars in irreparable damage to business goodwill, personal reputation, and very significantly to the emotional well being of the human victims? The threat is called “LIBEL”; a form of the ancient legal theory of “SLANDER” with origins in Roman jurisprudence. This issue is close to my heart because I have had a very frustrating and bitter experience therein. I have purposed to collaborate with experts from various fields including psychology, technology, legal and public relations to produce resources to assist victims in their efforts to remedy the wrongs and for potential victims to mitigate the risks. These resources will be made available for free as they become available through the Mile2 website. Victims of online libel are invited to contact me if they would like access to templates, resources and specific advice. "Defamation" is the term used internationally to generally describe an injury to reputation. “Slander” and “Libel” are false or malicious claims that may harm someone's reputation. Slander and libel both require publication with the fundamental distinction between the two lying solely in the form in which the defamatory material is published. If published in some fleeting form, such as spoken words or sounds, sign language, gestures and the like, then this would be slander. If it is published in more durable form, such as in written words, film, data disc (CD or DVD), blogging, web sites and the like, then it is considered libel. The key to these definitions is that the statements must be false. If someone published the truth about a person, it IS NOT slander or libel. Slander and libel are not protected forms of free speech under the US First amendment. In law, defamation is the communication of a statement that makes a false or deceptive claim, expressively stated or implied to be factual, that may harm the reputation of an individual, business, product, group, government or nation. Most jurisdictions allow legal actions, civil and/or criminal, to deter various kinds of defamation and retaliate against groundless criticism. Related to defamation is public disclosure of private facts where one person reveals information which is not of public concern and the release of which would offend a reasonable person. Unlike libel or slander, truth is not a defense for invasion of privacy. See the full essay here: Michael Roberts of Mile2 IT Security Discusses Libel & Google Reputation "
(comments? | Score: 5)
|
|
Total number of CISSP's and SSCP's wordwide
Posted by boss on Friday, April 25 @ 19:55:02 EDT (222 reads)
Anonymous writes "In a recent discussion on the CISSP Forum,
Someone listed the total number of CISSP's worldwide as of 4/22/2008.
There are total 57602 members overall.
(56791 CISSPs and 810 SSCPs)
As it was indicated this number seems to increase by a few hundreds every month.
This is a long way from the few thousands we had about 10 years ago.
Best regards to all
Clement
"
(comments? | Score: 0)
|
|
Great mailing lists maintained by Dan Swanson
Posted by boss on Friday, April 25 @ 17:56:56 EDT (175 reads)
Anonymous writes "NOTE FROM CLEMENT:
===============
Dan is someone who has been a long time supporter of the cccure.org website. I strongly encourage you to join his mailing list. It is always packed with treasures and great resources. Dan spends a lot of time researching resources and evaluating them. It is really worth subscribing to his mailing list.
Here is a note from Dan:
Good afternoon,
I now have over 1500 people that receive my free daily resource emails and the emails
now go out to more than 100 different cities!
Please pass this "invite" on to anyone you believe will want to try it out.
I also have a lot of students on my listserv, i.e. I encourage you to invite any students you know as well (to try it out).
Thanks.
HAGD.
Sincerely.
Dan
_______________________________________________________________
Dan Swanson publishes news and events in the governance, audit, IT audit andsecurity space. After almost 10 years of daily resource emails he has moved hislists to Yahoo and new subscribers now need to subscribe via Yahoo.
__________________________________________________________________
- see intructions below (on the "how" to join his mailing lists).
Dan Swanson, CMA, CIA, CISA, CISSP, CAP
A) Dan's CCC emails provide online resources in support of your Governance,Risk Management, and Internal Audit efforts. Content related to IT Audit andIT Security is provided on occasion. Resources related to leadership, quality,strategy, and management is frequently also included.
_______________________________________________________________
B) Dan's SEC emails provide online resources in support of your IT Audit andIT Security efforts. Content related to Governance, Risk Management, and Internal Audit is provided on occasion. Resources related to leadership,quality, strategy, and project management is frequently included.
______________________________________________________________________
To join Dan's 2 email lists you just need to send two blank emails to the addresses below. Finally, please consider forwarding thisinvitational email to anyone you believe will want to try it out. ______________________________________________________________________ To subscribe just send a blank email to these two addresses below: 1) Dans_CCCemails-subscribe@yahoogroups.com
(comments? | Score: 0)
|
|
Information Technology Investment Management from the GOA
Posted by boss on Friday, April 25 @ 13:14:20 EDT (158 reads)
cdupuis writes "Information Technology Investment Management:
A Framework for Assessing and Improving Process Maturity
Enjoy
This guide tackles effective management of IT investments; always an important topic.
Dan
Subscribe to Dan mailing list by sending an email with the subject of subcribe to:
|
|
|
