Crunch risk numbers or fix the obvious?

My colleague Ben Rothke (@benrothke) recently wrote a good piece on basing information security decisions on good data. I like his approach - it'll make you think. It's true we do need good data so we can make better decisions. Sadly, we often don't have the data or, if we do, we're not qualified to interpret it.

Maybe it's just me but I don't believe my degrees in computer engineering and management of technology qualify for "enterprise statistician". That still doesn't make information security oversights okay. The dilemma reminds of something that Gilbert Arland once said: "Failure to hit the bullseye is never the fault of the target." We do need good data. It's just not that simple in the world of information security.

The problem is similar to the underlying principle of goal setting and leadership: how are you going to know where to go if you don't know where you're going, much less how to get there?

The reality is, we're never - at least for the foreseeable future - going to have all the right data to make good information security decisions. We have to do the best with what we've got. But that shouldn't keep us from focusing on what's obviously important. Case in point I can say based on experience that the majority of organizations I've seen (both small and large) haven't even addressed the basics of information security. Why burden ourselves with complex risk calculations when the bleeding and the cure are right before our eyes?

Don't get me wrong. Quantifiable risk calculations have their place in our industry. But unless and until we get the basic stuff under control, what's the point of making things even more complicated? I'm just saying.

Staying tuned for Part 2 of Ben's article...

Read More

The case for zero-day testing

Here's a good piece by David Maynor regarding penetration testing and whether or not zero day exploits should be used. I agree with David. With penetration testing, ethical hacking, vulnerability assessments - whatever you want to call them - anything should be fair game. That is if you want a real-world view of what's at risk. Limiting your tests could skew the results and you'll end up with a false sense of security when nothing big turns up.

Read More

NetScan Tools LE - a must-have for investigators

Have you ever had a need to run a program and get a relatively small amount of data just to do your job but end up getting caught in the complexity of the application and not getting what you need after all? That's happened to me a bunch.

Well, NorthWest Performance Software (makers of a long-time favorite of mine: NetScanTools Pro) has a new tool that helps resolves this problem called NetScanTools LE. Designed for law enforcement investigators (hence the "LE"), prosecutors, corporate security folks and the like, NetScanTools packages the ability to gather information on IP addresses, domain names, hostnames, and email addresses all in one concise program. It's for the non-technical types who just want the basics...get in and get out. Given its investigative approach, the tool is case driven and includes timestamps and even packet capturing to help investigators prove they did what they say they did while gathering their data. It's really inexpensive to boot.

Included functions are:

• ping sweeping
• port scanning
• IP to country mapping
  
• email validation
  
• Whois lookups
• RBL checks
• text-only Web page grabber (I really like this)
  

The following screenshot shows the clean interface of NetScanTools LE:






























While I'm on the subject of cool tools, if you've never checked out NetScanTools Pro, you really should. It's chock full of even more utilities (all in one place, albeit bordering on the complex) those of us in IT and security can benefit from. I have a need for such tools on practically a daily basis.

Furthermore, Kirk Thomas who heads up NorthWest Performance Software is very attentive and eager to get feedback on his products in order to make them better. And based on our conversations I like how he thinks.

Read More

"New" Web security content to check out

Here are several new links to some recent (and, due to my crazy year, not so recent) articles I've written for various TechTarget sites on the subjects of Web application and server security:

Web server weaknesses you don't want to overlook (the "rest of the story" of Web flaws)

SQL injection tools for automated testing (a must-have for your toolkit)

Beefing up SSL to ensure your applications are locked down (good for some of those often-reported PCI DSS compliance gotchas)

Common security flaws to check for on your Linux-based Web systems (overlooked Linux systems are a great facilitator of Web vulnerabilities)

Enjoy!

Read More

HIPAA & HITECH: new requirements + same approaches = new book

My colleague and co-author Becky Herold and I are working on the second edition of our HIPAA book and I'm realizing, wow, not much has changed in the way of managing information risks since we first wrote it in 2003. Yet, the protected health information breaches keep on occurring (look at the two latest ones from this week).

Stay tuned though...we've got lots of good updates and new info forthcoming on HIPAA and the HITECH Act that can help you forge your way through the compliance mess.

Read More

Work harder on yourself than you do on your job

Many people want to take the easy path that promises to lead them to their riches rather than work hard over the long term and earn it the good old-fashioned way. It's the lottery mentality. James Allen said it best:

"Men are anxious to improve their circumstances, but are unwilling to improve themselves; they therefore remain bound."

Want to get begin improving your circumstances in your life and in your IT/security career? Here are some pieces I've written and an audio program I recorded that can help you get started.

Read More

Good new book on security awareness

I have to admit, when my colleague Marcos Christodonte first approached me about reviewing his new security awareness book, Cyber Within, I thought here's yet another book on boring old security awareness. I was wrong. Cyber Within takes a very unique (suspense novel-like) approach to address the problem we have with employees and information security. And it works.

The book is a quick read - just 47 pages - but it's just enough to help drive home the message that employees are our worst enemy when it comes to security. The book also has some cut-out forms in the back for reporting incidents and employee quick tips you can use during your security training.

The argument could be made that everything in the book falls into place too easily but I still think it's a good read and a good resource. Kudos to Marcos. Heaven knows we need some original - and non-plagiarized - material in our field these days!

You can check it out Cyber Within on Amazon by clicking the book cover below:

Read More