February 2009 – Page 2 – CyberSecurity Institute

Clear Guide on How to Benefit from ISO27001 in a Windows® Environment Now Available

Posted on February 18, 2009December 30, 2021 by admini

Information security management standard (ISMS) ISO/IEC 27001 encourages organisations to bring technical decision making about information security controls into a business-driven risk-based framework. This challenges all parties involved in information security management to communicate effectively, especially between technical and non-technical staff about effective security control implementation.

The guide’s author, Brian Honan, is widely recognised as an industry expert on information security and, in particular, on the ISO27001 information security standard.

A member of the Information Systems Security Association, the Irish Information Security Forum, and the Information Systems Audit and Control Association, Brian established Ireland’s first ever national Computer Security Incident Response Team.

“Written in non-technical language and in a style that makes its content accessible to non-technical ISO27001 project managers, Brian’s invaluable study will give IT security practitioners the information and knowledge they need,” says Alan Calder, Chief Executive of the book’s publishers, IT Governance.

IT Governance is ‘non-geek’, approaching IT issues from a non-technology background and talking to management in its own language.

http://www.emediawire.com/releases/2009/2/emw2084414.htm

Number of reported cyber incidents jumps

Posted on February 17, 2009December 30, 2021 by admini

The Federal Information Security Management Act requires agencies to report cyber incidents, which are defined as acts that violate computer security or acceptable-use policies.

Mischel Kwon, US-CERT’s director, said that the numbers represent both an increase in malware and improvements in the capabilities of US-CERT and agencies to detect and report cyber incidents. “Both parts of the story are true: There is an increase in mal events, and there is an increase in capabilities in order to detect those mal events.” Kwon added that the numbers were a bit deceiving because the reports are based on manual reporting by agencies and that there are few security operations centers that monitor federal agency networks.

US-CERT, the operational arm of DHS’ National Cyber Security Division, works to analyze and reduce threat capabilities throughout government and industry, disseminate warning information and coordinate incident response activities. US-CERT also runs Einstein, a federal network-monitoring system. It is in the process of deploying a second version of the system with enhanced capabilities.

Kwon added that visibility across the federal network and incident reporting will improve as the second version of Einstein is deployed and agencies continue to reduce the number of connections they have to Internet under the Trusted Internet Connection project.

http://fcw.com/Articles/2009/02/17/CERT-cyber-incidents.aspx

Number of reported cyber incidents jumps

Posted on February 17, 2009December 30, 2021 by admini

The Federal Information Security Management Act requires agencies to report cyber incidents, which are defined as acts that violate computer security or acceptable-use policies.

Mischel Kwon, US-CERT’s director, said that the numbers represent both an increase in malware and improvements in the capabilities of US-CERT and agencies to detect and report cyber incidents. “Both parts of the story are true: There is an increase in mal events, and there is an increase in capabilities in order to detect those mal events.” Kwon added that the numbers were a bit deceiving because the reports are based on manual reporting by agencies and that there are few security operations centers that monitor federal agency networks.

US-CERT, the operational arm of DHS’ National Cyber Security Division, works to analyze and reduce threat capabilities throughout government and industry, disseminate warning information and coordinate incident response activities. US-CERT also runs Einstein, a federal network-monitoring system. It is in the process of deploying a second version of the system with enhanced capabilities.

Kwon added that visibility across the federal network and incident reporting will improve as the second version of Einstein is deployed and agencies continue to reduce the number of connections they have to Internet under the Trusted Internet Connection project.

http://fcw.com/Articles/2009/02/17/CERT-cyber-incidents.aspx

Tenable Releases Database Auditing Capability

Posted on February 5, 2009December 30, 2021 by admini

Over the last five years, Tenable has continued to add additional capability to this widely used and cost effective tool.

Nessus’ capabilities have been extended to conduct agent-less patch audits, system configuration analysis against industry best practices, auditing of applications such as web servers and anti-virus installations and being able to audit hard drives for personally identifiable information (such as credit card numbers and social security numbers), copy written content, and other financial or confidential information.

The ability to perform a full security audit of the underlying operating system as well as the SQL database configuration can ensure that applications have taken every measure to prevent data loss from SQL injection attacks, direct attacks on the database and inadvertent internal access to sensitive data.

“Most organizations practice some sort of defense in depth to keep from being the next high-profile data loss headline,” says Ron Gula, CEO of Tenable Network Security.

The new capability of Nessus includes support for auditing Oracle, MS SQL, MySQL and many others, as well as SQL audit polices based on the Center for Internet Security and the Defense Information Systems Agency “STIGs.”

http://www.marketwatch.com/news/story/tenable-releases-database-auditing-capability/story.aspx?guid=%7B62074F33%2D6313%2D481C%2DB19D%2DB86B8748D3F6%7D&dist=msr_2

Sunbelt Pioneers New Anti-Virus Technology

Posted on February 5, 2009December 30, 2021 by admini

In a separate interview with Techworld, Eckelberry said that as far as he was aware the only other anti-malware products to have tried file emulation in anger were Microsoft and BitDefender.

Vipre Enterprise also boasts of its anti-rootkit protection – the program runs a special module called ‘firstscan in advance of Windows loading – and advanced kernel monitoring.

http://www.pcworld.com/businesscenter/article/158996/sunbelt_pioneers_new_antivirus_technology.html

Playing cricket, 3 miles up

Posted on February 5, 2009December 30, 2021 by admini

It will take the players nine days of mountain-climbing to reach their playing field, an artificial pitch on the Gorak Shep plateau in Nepal.

In the process, they hope to raise more than $350,000 for the Himalayan Trust UK and other charities.

Said one cricketeer, Mark Butcher: “It’s pretty bonkers, but anything that’s out there raising money for good causes is terrific.”

Scaling the world’s tallest mountain is treacherous work, and altitude sickness poses a genuine problem for the players. A medical team will be accompanying them.

http://www.heraldtribune.com/article/20090205/ARTICLE/902050305/2193/SPORTS?Title=Playing_cricket__3_miles_up