Overheard in the tech blogosphere » Security

Overheard talking about security-awareness training

Margaret Rouse — Mon, 21 May 2012 14:02:33 +0000

“Too many companies rely on the computer-based security training courses that each employee must complete once a year to meet compliance requirements.” — Bob Rudis

Today’s Whatis.com Word of the Day is security awareness training, a formal process for educating employees about corporate policies and procedures for working with information technology (IT).

With all the pressures a busy security manager has to deal with, documenting end user security awareness is often low on the list. That’s why computer-based training (CBT) is so popular.

Unfortunately, CBT can be boring. It’s SO boring, in fact, that in education it’s often referred to as “drill and kill.”

At last, it seems as if security end user awareness trainers are taking a look at how elementary school educators keep drills interesting — they turn them into games and personalize them.

For instance, if you were an elementary teacher and had to get your students through a daunting amount of word problems to prepare students for standardized testing, you might substitute the names the textbook uses in the word problems for that of your own students and insert students photos or drawing next to the problem.

Or you might turn a drill into a game of Pictionary or Jeopardy or Wheel of Fortune. The bottom line is that anything you can do to make learning fun is as important for adult learners as it is for young ones.

Overheard talking about context-aware network access control

Margaret Rouse — Wed, 16 May 2012 17:41:15 +0000

“There are techniques that can determine the context of access — the type of device, where it’s accessing from, who the user is, [whether it's] legitimate access to this data or application — and use those techniques to begin to build a policy around what is and what is not appropriate for these devices, which are usually not managed, period.” — Scott Crawford

Today’s WhatIs.com Word of the Day is context-aware network access control (CANAC), an approach to managing the security by granting access to network resources according to contextual-based security policies. The endpoint device is granted access, quarantined or blocked from the network depending on the device’s type, location, identity and the operating system or applications running on it.

Overheard talking about smart meter hacks and PKI

Margaret Rouse — Wed, 18 Apr 2012 20:21:07 +0000

“Advanced metering infrastructure (AMI) components — in particular, the smart meters that are responsible for measuring and managing the delivery of electricity use for more than 110 million households and companies in the United States — rely on secure communications channels in order to transmit usage data. Many AMI equipment manufacturers rely on PKI for identification, authentication and establishment of secure communications channels.” – Seth Bromberger

Today’s WhatIs.com Word of the Day is smart meter hack. If you live way out in the country, you may still have an old-fashioned spinning mechanical electrical meter, but you are fast becoming the exception. Ironically, the very features that motivate power companies to install smart meters also make them vulnerable to new kinds of attacks. According to an FBI bulletin, smart meter hacks may end up costing utility companies about $400 million per year.

Keep your eye out for a new kind of service provider who will independently verify the security of AMI components and the smart networks they use.

Overheard talking about iris recognition

Margaret Rouse — Mon, 05 Mar 2012 20:16:42 +0000

“Iris recognition was found to have an error rate of 1 in a million, according to a January study by the National Institute of Standards and Technology.” – Julia Angwin

Today’s WhatIs.com Word of the Day is iris recognition, the identification of an individual based on the unique patterns within the ring-shaped region surrounding the pupil of the eye.

Overheard talking about the Cybersecurity Enhancement Act

Margaret Rouse — Tue, 01 Jun 2010 12:40:30 +0000

Our reliance on the conveniences of remote access, and the ability of our networked control systems to reduce costs and manpower needs, have led to weaknesses that are being exploited daily by our opponents.

Melissa Hathaway, Government Must Keep Pace with Cybersecurity Threats

Today’s WhatIs.com Word of the Day is Cybersecurity Enhancement Act 2009. Melissa Hathaway does an excellent job summarizing all the cybersecurity legislation efforts currently in place.

Overheard talking about Common Criteria

Margaret Rouse — Thu, 13 May 2010 13:41:46 +0000

For many decades, security engineering was a specialized topic, primarily considered within military organizations or by those working with them. Standards like TCSEC and ITSEC from the 1980s and 1990s, and later the Common Criteria, described the software-engineering activities needed to develop and validate security-critical systems.

Dr. David Basin, Integrating security into the system development process

Today’s WhatIs.com Word of the Day is Common Criteria.

Overheard talking about cyberextortion

Margaret Rouse — Mon, 03 May 2010 14:36:20 +0000

CSIS surveyed more than 600 IT and security executives who work for many of the companies that run critical infrastructure facilities. The survey found that one-in-five critical infrastructure entities reported being the victim of extortion through cyberattack or threatened cyberattack within the past two years.

Robert Westervelt, Security expert predicts criminals to take cyber extortion tactics to the U.S.

Today’s WhatIs.com Word of the Day is cyberextortion.

Overheard talking about Einstein

Margaret Rouse — Wed, 14 Apr 2010 17:43:40 +0000

“What is different is that we’re going to have comprehensive coverage across federal networks, and that all the information about potential intrusions or malicious code will flow to a central point, the U.S. Computer Emergency Readiness Team at DHS.”

Robert Jamison, as quoted in Analysis: Einstein and U.S. cybersecurity

Today’s WhatIs.com Word of the Day is EINSTEIN.

Overheard talking about government and a new risk management framework

Margaret Rouse — Sun, 11 Apr 2010 13:11:11 +0000

The most obvious impacts will be seen in how this [document] brings the national security community closer to legislative compliance requirements, assists our inspector general audits, and aligns with the rest of the federal government to support reciprocity…the document provides an approach to manage risks for both traditional and complex systems, a procedure that was not formalized previously.

Roger L. Caslow,as quoted in New Document Provides Framework for Interagency Data Sharing

Roger L. Caslow is chief of the Risk and Information Assurance Program Division, Office of the Associate Director of National Intelligence and Chief Information Officer. He’s talking about NIST Special Publication 800-37, Revision 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach (NIST SP 800-37) and apparently he doesn’t like to have his picture taken.

Henry Kenyon describes the special publication as a six-step risk management framework (RMF); a common information security framework for the federal government and the contractors who support it. The official diagram is below:

Overheard talking about ransomware

Margaret Rouse — Mon, 29 Mar 2010 14:31:12 +0000

“Turning hijacked computers into cash is still hard work for most computer criminals. They’ve got to trick the infected PC into sending spam, then trick a recipient into buying a useless product — or they have to steal online banking passwords, log onto a victim’s account, bypass the bank’s money transfer fraud controls and so on. It’s much easier to just demand cash directly from infected users — a crime that’s the Internet’s equivalent of kidnapping.”

Bob Sullivan, Give me your money, or your computer gets it

Today’s WhatIs.com Word of the Day is ransomware.