Learning to share

Is this the start of something good or the start of the next big scandal?  Today the House of Representatives intelligence panel voted to approved a bill to share sensitive and classified with defense contractors and their service providers and vice versa.  In the Reuters article the bill would expand an existing program where the federal government would share data with a larger audience.

The good part of this makes me think of the goal of the FBI Infragard program.  Infragard's main purpose is to share information within a trusted community.  Infragard screens potential members before allowing them to join.  Members are required to agree to specific rules.  Once met, members know they can trust sharing information that might help another member of the same industry or simply a fellow man (when the information is not confidential).

Within in a civilized society, sharing is a good thing.  Sharing, even within a civilized society, also brings risks.  Can the federal government trust the NSA and the expanded list of Internet Service Providers (ISP)?  What measures are being taken to ensure this sensitive or classified information is properly protected, especially from those suspected of attacking companies and other countries?

The article discusses that the bill expressly prohibits the federal government from colluding with ISPs to gather information about private citizens amounting to government surveillance of private citizens.  The bill was amended to ensure that all data would be used on for cyber security or national security.

It will come to no surprise that we're all humans.  The military is famous for the Counter Terrorism briefings that were held, and maybe still are.  During those briefings we were warned about the means that the 'enemy' was willing to use to get the information we had.  I remember the foreign born woman falling all over some knucklehead jarhead to get him to give her sensitive information.  Maybe they still do this.  If they do, I'm sure at least one of the subjects has changed a little.

We are civilized and we're smarter than we were 20 some years ago.  We think we know who the enemy is and we think we know how to effectively manage and protect data.  People are the weakest link though.  I'm not really sure it's possible to protect the data once it leaves the source.  It would be nice to think that all Americans had our best interests at heart.  Too many people are interested in getting their five minutes of fame so I am expecting that, while I think that sharing the information is good, I'm waiting for the day when we learn that the data fell into the wrong hands and this turns into finger pointing and further rage about the government.

In conclusion...

As a brand new blogger I found the experience of discussing current events or material covered in class on this blog to be gratifying.  In addition, I really enjoyed reading the blogs of my classmates.  I was impressed with my classmates blogs, watching them develop each week with the addition of pictures, links and well developed posts.

I attempted to write about current events that interested me.  I asked my family to follow me, so I considered them as I selected my topics.  My father tried to follow my posts but became discouraged as he said he didn’t understand what I was writing about. 

My posts fell into several categories:  personal security, network security, PCI DSS, new technology, a scam, Steve Jobs, social networking, cyber threats and certification.  All of the topics I chose to blog about were interesting to me.  I hope that readers of my blog would be interested enough to read my thoughts and even read the article (linked in the blog) that caught my attention.  It was fun to find pictures for the post to entice the reader to read what I wrote.

I used a variety of sources to find my weekly topic.  Kim Kommando is my hero.  She sends out a brief email to a huge audience with something interesting.  She provides information effectively to a diverse audience with a knack for making the topic understandable to folks with various levels of technology experience.  Information technology is not the same as molecular biology.  The types of information we deal with on a daily basis and the knowledge we have can be very valuable to people of all walks of life.  The information we can share with others to enhance their understanding of technology is powerful stuff.  I look at a variety of websites on a daily basis to include Kim Kommando’s daily email.  Some of the ideas for posts came from her email messages.

I believe that blogging is a great way to share information we learn along the way.  Furthermore, you can’t blog about something you know nothing about.  Blogging was a great way to get a grasp on a concept. 

Do you want be a CISSP?

Achieving the CISSP certification is one way to show the world that you have the technical ability, knowledge and experience in the IT Security field.  If you think the certification is important, I encourage you to prepare well for it, then take the test and join me as a CISSP.  The exam covers the 10 domains called the Common Body of Knowledge (CBK) in 250 questions.  In order to pass the test you must achieve a score of 700 points or more.  There are several additional steps beyond passing the test that each candidate must complete to earn the CISSP certification.  I'll walk you through the basics... 

 

Minimum experience requirements:
You must have a minimum of five years of professional experience in the information security field or four years plus a college degree. You may subsititute an Advanced Degree in Information Security from a National Center of Excellence or the regional equivalent can substitute for one year towards the five-year requirement.
A candidate must also provide acceptable answers to 4 questions related to regarding criminal history and related background.

 

Before the exam:
1.  Study. 
    a.  Complete a self assesment quiz to see where your strengths and weaknesses are.
    b.  ISC(2) has several free webcasts valuable for your review.
    b.  Shon Harris books and DVDs are great references to ensure you have a full understanding.
    c.  Take free practice quizes before taking the test.  The test questions are long and complicated.  It is critical that you read all the words in the question as it is easy to speed read the question and answer it wrong.        
   d.  The candidate will be required to agree to follow the ISC(2) Code of Ethics to become CISSP certified.  Be sure to read and understand the requirements as this is not optional.
   e.  Read the ISC(2) Candidate Information Bulletin available for download from:  www.isc2.org/cib. 
2.  Join a study group if possible.  NebraskaCERT generally offers one prep class per year.  Check their website or go to a meeting if you're looking for a study partner or session.

 

Day of exam:

• Print a copy of the email "ticket" you receive from ISC(2) and bring it with you to the exam site.  A proctor will check you into the exam.  The informaiton on your ticket will be cross referenced by the proctor.
• Bring a valid form of identification that has your picture on it (Driver's License, Military Identification, etc.)
• Bring a snack.  Candidates are provided a space in the room away from the desk/table where the test is administered.  You may get up from the test to quietly eat the snack in the room.  
• Do not bring your cell phone, books, papers, or other items into the test area.  You will be provided pencils. 
• Be sure to be well rested and focused on the material on the day of exam.  Leave other stresses at home.

How do I know if I passed?
ISC(2) will email you the results of the exam usually within one week of completing the exam.  If you pass, you will get a letter that begins with "Congratulations ....".  You will not be provided your score.  If you did not pass, you will receive a letter that does not begin with "Congratulations".  Those who do not pass will receive their score.

 

There are a few more steps after you pass the exam before certification is approved:
If you pass, the letter will remind you that you are not permitted to use "CISSP" yet.  You will be instructed to submit your resume for review. 
You must be endorsed by another (ISC)² certified professional in good standing before the credential can be awarded.  The endorser will attest that the candidate's assertions regarding professional experience are true and to the best of the endorser's knowledge, and that the candidate is in good standing within the information security industry.

 

What are the on-going requirements to maintain the CISSP certification?
All CISSPs must maintain their certification by completing Continuing Professional Education (CPE) credits before the three year period and pay $85 per year. 
ISC(2) requires that each CISSP must complete a minimum of 20 CPEs each year - so a CISSP cannot complete 120 CPEs during year one and maintain his or her certification.  A CISSP may complete more than 20 CPEs per year, but not less.  If a CISSP does not complete 20 CPEs each year, he or she will need to retake the CISSP exam. 

 

What counts as CPE?
You can earn CPEs by:

• Attending educational/training conferences and seminars
• Attending conferences
• Attending Professional Association Chapter Meetings (such as Infragard and NebraskaCERT)
• Attending Vendor Presentations
• Completing college courses (*you must pass the class)
• Providing security training to others
• Publish a security article or book
• Serve on the board of a professional security organization
• Complete computer based training
• Read Information Security books or authorized magazines (may be required to complete a book report)
• Various IT related volunteer work

How do CISSPs submit CPE?
All CISSPs must register on the ISC(2) website using information provided from ISC(2) after the CISSP certification is earned.  CISSPs log into the website to submit CPEs and pay the annual maintenance fee.

 

Good luck.  May the force be with you!

How secure is your corporate network?

According to the SC Magazine article, Reducing network breaches, between 178 -218 million user accounts, email addresses, token seed files or "records" were stolen from organizations by cyber theives from the published top six network breaches.  That is pretty frightening! 

How could this happen??  The article suggests that social engineering attempts are especially problematic.  Years ago many people recieved the Nigerian email where a wealthy foreigner needs help moving money from his homeland and promises a reward for helping him.  Things have gotten more sophisticated since the early scams such as the Nigerian scam.  The article suggests that organizations need to provide continuous information to employees to warn them about providing information from unsolicited calls, email messages or visits asking for information.  Some email messages requesting information appear to be legitimate or may offer a prize for providing information which may entice some folks to willingly give away valuable company information.

Thumb drives, wireless networks, smart phones, and laptops make life simpler for employees, but also can weaken the network perimter and safety of corporate information.  The article suggests that smartcards using a credential management system be used to ensure a multilayered strong authentication protects access to corporate servers, VPN and cloud applications.  

The protection of customer information is critical to the continued success of a company.  PCI compliance will not guarantee 100% protection, but will provide a good place to start.

The bottom line is that employees are the first line of defense in social engineering attempts.  American children are taught to help others and be friendly.  The author encourages organizations to continuously remind employees to be skeptical of others asking for information.  I would encourage employees not to unsolicited surveys.  The best response to an unsolicited phone call requesting you to complete a survey is asking the caller to take you off his or her list.  The caller has no way of knowing who the caller is, where the information is going or who the information might be sold to.  Professional magazine subscriptions require a subscriber getting a free publication to provide certain information.  If you don't read the publications, do not subscribe.  If you read them, provide them the least amount of information possible.  Never provide a co-workers name, title or email address.  Most technical magazines are available at no cost on-line anyway.

We should all learn to be skeptical.  Being skeptical is healthy.  Most skeptical people wouldn't imagine why a rich Nigerian would need their help to move money and most skeptical folks wouldn't believe an email message from the US Postal Service asking for personal information so they could deliver a package to their facility.  How the would the US Postal service have your email address?  Answer:  they wouldn't.  It just takes a few minutes for us to think about the information.  Does it make sense?

It will pay off to be skeptical.


References:
http://www.snopes.com/fraud/advancefee/nigeria.asp

A Good Partnership?

Reuters announced that the National Security Agency (NSA) will partner with US banks to deter cyber attacks within the banking industry according to an article on Reuters.

The financial industry has been taunted and attacked by hackers from other countries, mainly China. The financial industries have security resources in place, but "tremendous vulnerabilities" remain.  Threats include individuals positioning themselves inside a business to negatively impact operations and malware. 

Given the impact of the value of information on financial institution networks, the loss or compromise of this information as well as the impact to investors it is imparative that our resources are protected.  History has shown that the hackers strike when a business is most vulnerable, such as during a crisis.

It was interesting to read the comments on the article.  Many people were not pleased that a federal agency was assisting the financial/banking industry, asking when their company could get help from the federal government to fix their problems, etc.  Not many positive comments.  We are a bunch of complainers, aren't we?  I think this is a great step.  Hillary Clinton's book, It Takes a Village describes the number of caring people that make up the lives of children, from parents, grandparents, teachers, friends, neighbors, law enforcement officials, government officials and others.  Looking at the resources of our country, these children need the support of friends, neighbors, law enforcement, goverment officials and others.  We're all in the same boat.  When one aspect fails, we all fail.

Mama always said you should watch what you say!

Marc Bechtol's facebook post cost him a two semester suspension and ban from the Catawba Valley Community College (CVCC) on Oct 4 according to a CBS report.

Bechtol had to sign up for a specific bank account to receive grant money.  He began receiving unwelcome spam from credit card companies shortly after the account was opened which he concluded were directly related.  He posted "Did anyone else get a bunch of credit card spam in their CVCC inbox today? So, did CVCC sell our names to banks, or did Higher One? I think we should register CVCC’s address with every porn site known to man. Anyone know any good viruses to send them?”on the CVCC facebook page.  Moments later he added a post “OK (sic), maybe that would be a slight overreaction,” under his first post.

It was too late.  His comments yielded a letter from campus informing him of his suspension and campus ban.  CVCC indicated that the post was disturbing and "indicates possible malicious action against the college". 

The Foundation for Individual Rights in Education (FIRE) came to Bechtol's aid by intervening on his behalf.  Rober Shibley, the senior VP of FIRE, found CVCC's reaction to the post to be extreme.  He asked the school to put Bechtol on notice and provide him the opportunity to be heard by the administration before suspending him.  Bechtol's suspension has been revoked and he is now able to go back to campus, however, he has not done so yet.

So, we all know you can't take back your posts but we can learn from them.  What could Bechtol have done to deal with his suspicion about the spam?   The best response, ignore the email and delete it immediately.  Another option asked to read the CVCC's and Higher One Bank's privacy policy.  As a customer you have the right to see what kind of information they're sharing and opt out.  It really makes sense to read all the words of a contract before signing anything.  My final advice is to create a secondary email account that you provide when you suspect you might get unwanted email.  A good time to use this is when you order from an online retailer.  Many retailers require your email address to complete an online order.  You will get shipment information related to your order but you'll also get regular (unwanted?) email from the retailer.  Provide your secondary email account when ordering so you're aware of the shipping information but the extraneous email is not clogging up your primary email account.

I'm sure Mr Bechtol learned from this painful and public experience.  Listen to Mom.

Apple releases new iOS for iPhone, iPod and iPad

Apple is scheduled to release the newest operating system, version 5, on Wednesday, October 12.  In conjunction with the OS update, an updated version of iTunes was released today, October 11.  The iTunes update, version 10.5 fixes 79 flaws in the Windows edition according to ComputerWorld.  The update is free.  If you plan to run the new OS, you must update iTunes so you can sync your iPhone, iPad, or iPod. 

iOS 5 has some nice improvements:

You don't need a PC or Mac to configure the device out of the box.  You can activate the device wirelessly.

The new OS has a notification center showing you your new email, texts, friend requests, stock market updates, weather and more.

Apple also released iMessage, a messageing service allowing users to send text messages from their i-device.  iMessage is an encrypted system.

Another improvement in the new OS is iCloud service (coming soon). iCloud stores your contacts, calendar entries, photos, music and television programs on Apple servers in the cloud which makes your content available on your i-devices "anywhere, any time".  iCloud supports up to 10 devices at no cost and provides up to 5 GB of storage.  Additional storage will cost you to upgrade.

iOS 5 has a Newsstand feature to allow users to subscribe and manage publications.  Users can read the latest version of current magazines and newspapers.

The new operating system brings improvements to the camera, picture editing, Safari browser, mail, calendar and the game center.

I got an iPad at work and am anxious to get clearance to install iOS 5 on my iPad.