During the second week of December I realized that our group had not used their 2012 training budget. Realizing that there was not enough time to get a formal security class under way before the end of the year, I suggested to my manager that our group use the funds to order security-related books. He gave us the green light and behold the list below. Goal is to finish them by December 31, 2013. We’ll see what happens.
Continue reading
Author: jra
Whole Disk Encryption Principles
All of the components associated with managing the Whole Disk Encryption (WDE) infrastructure should be classified as a High Value Asset (HVA). The backend assets contain the components involved for protecting the encryption and decryption keys that are used to encrypt hard drives. Treating the backend components of the Disk encryption environment as HVA, will ensure that the cryptographic keys are protected through a layered approach to securing the environment. This of course assumes you are architecting your security environment around various layers and are classifying certain assets as HVA’s and others at lower classifications.
A Security Perspective on the Conneticut Shootings
Given the horrible tragedy that took place yesterday in our nation, I have been given a lot of thought to how to mitigate these shooting incidents. Given the fact that my career has been centered around protecting company resources and putting plans, processes, and procedures in place to respond to security incidents, I thought I would provide a similiar approach for dealing with school shootings.
It’s important to note when I’m referencing “assets” I”m referring to the victims involved in the given incident. Please do not take this as an insensitive term to those victims, it’s just easier as a point of reference. I would also point out that I have two boys (12 & 8) that have just as easily been victimized as those from yesterday’s incident. When I use the term “threat vector” I’m speaking mainly of the perpetrators involved in the shootings.
Continue reading
UNIX Core Event Logging
There are a minimum set of events that should be logged on UNIX-like operating systems. Typically you would need to define requirements for your specific needs and add and modify them per requirements that you define.
Continue reading
Keys to Data Loss Prevention (DLP) Success
Being a Information Security geek for sometime I have had a significant exposure to DLP over the years and being exposed to two major vendor distributions along with processes and procedures I have found some high-level principles that should be followed.
1. Know Thy Risk – This often seems to be taken for granted, but depending upon your business model not everyones risk for data leakage will be the same. Healthcare will be more at risk for HIPAA than the Banking industry and Food Chains will be more at risk for PCI than body shops. In addition to known regulatory laws such as HIPAA and PCI you also need to assess the risk to your organization if one classification of data was leaked versus another. Once this risk assessment has been completed it will make it easier to drive priorities around your DLP initiative.
2. Data Classification – It is also important to define a Data Classification policy so that you can use this to define and drive your DLP policies. For example, you may have a Data Classification such as Highly Sensitive, Sensitive, Internal, and Public. Policy might dictate that all data identied as ‘Highly Sensitive’ must be encrypted, while data that falls under ‘Sensitive’ just needs to have strong access controls.
3. Document & Define Workflows – This is probably the most difficult aspects of DLP due primarily to dependecy upon other groups (Legal & HR) and the potential resource hours needed to manage the process. It basically comes down answering questions such as:
-
Who needs to be notified when an incident is created by the DLP solution? Do we need to define thresholds for the notifcations?
- Who will determine if the incident is a false-positive or a real incident?
- Should the data be acted upon automatically? Should we quarantine or block the data that was identified in the incident?
I’m planning on making a series of additional blog entries around various other aspects of DLP in the near future.
Backtrack 5 & Scapy Python Dependecies
Have not blogged on any security-related topics in a while so I thought it was time. Scapy is a Python-driven program for generating TCP/IP packets on the fly and programtically. If you fire up Scapy on a fresh Backtrack 5 system you will be welcomed with two dependency errors; one complaining about the GNUPlot Python library and the other for PyX. I think there was another one for a GUI library, but can’t seem to find it in my Bash history.
Like most things Ubuntu/Debian the fix is pretty trivial:
apt-get install python-scitools python-pyx
There you go, happy packet hacking!
Fall from Grace – OPC Pastor Converts to Roman Catholicism
Former OPC pastor Jason Stewart decided to leave the Orthodox Presbyterian Church (OPC) as a pastor for full communion into the Roman Catholic Church. His blog post outlines his reasons and I must say they would not be surprising for someone that was raised Roman Catholic, but I find them untenable for a former pastor of the Reformed Faith.
Autism Walk for My Son, Christopher
Just getting things ready for this year’s autism walk. My younger son Christopher who is 7 years old was diagnosed with autism a number of years ago. Donations of any amount are much appreciated.
Apostasy from The Gospel – John Owen
Apostasy from the Gospel-Abrig: by John Owen
My rating: 4 of 5 stars
Dr.Owen expounds all the dangers of apostasy from the Gospel as outlined in Scripture. He gives a particular emphasis on the Roman Catholic Church being the apex of apostasy within the Christian Religion along with good arguments.
Ubuntu – Distribution Agnostic Virtualbox Auto-Install Script
Just threw together a very simplistic shell script that will:
1. Add the Virtualbox repository to /etc/apt/sources.list and will automatically build it by pulling the “Codename” variable from ‘lsb_release’.
2. Download and install the GPG key associated with the Virtualbox repository.
3. Perform an ‘apt-get update’ and install Virtualbox with no prompts.
You can checkout the code from the Github below and the script is ‘build_vbox’.