This has been a debate among policy writers since personal e-mail started to become popular: Can your company monitor/sniff/access your personal e-mail? Up until this week, it was commonly accepted that you didn’t use company resources to access/read/write your personal e-mail if you didn’t want it to be monitored. However, that seems to have changed – in one specific case. In New Jersey, a woman used her company laptop to exchange information with her lawyer over a web-based e-mail over an issue at work that later went to court. The company used her e-mail communications (presumably) cached on the laptop as evidence against her in court. While this is (so far) the first case I’ve heard of like this, it[…]
Author: Laura Raderman
Clickjacking is a relatively new term in the web hacking area. Although, the original paper by Robert Hansen and Jeremiah Grossman was published in September of 2008, clickjacking has become fairly “normal” and common. It’s a visual trick that gets users to click on something they weren’t intending to click on – like that “buy now” link or the “follow me” link that the marketer wants you to click on. Granted, it has limited use in the purchasing area, since most online stores require you to give them your credit card number before you can buy anything. However, an attacker can use it to get more “impressions” and click-throughs and fraudulent ad money for example – or increase their popularity.[…]
FIPS stands for Federal Information Processing Standards, and is “run” by NIST. It is a set of standards that dictates how information is stored, processed, and managed in the federal government. It’s also leaked into the commercial sector through government contractors and the concept of “If it’s good enough for the government…” Almost all of the FIPS standards are relevant to security. Ever hear of FIPS 197? It’s AES. A list of all FIPS documents is available through NIST, and if you’ve worked in information security, you’ve likely heard of at least 3-4 of them. The one I hear most often is FIPS 140-2. This is the standard for cryptographic implementation. An entire industry has grown up among independent testing[…]
Nessus is a nice tool, but some people have complained and revolted against it because it went closed source in version 3.0. I’m sure there were good reasons for that, but if – for whatever reason – you don’t want to use Nessus, what can you use? Enter OpenVAS. I’ve mentioned OpenVAS before, but version 3.0.0 came out in December, so I figured I’d give more details on it. It’s a fork of Nessus 2.0, so if you used Nessus while it was still open source, it’ll be somewhat familiar to you. It still uses NASL for tests, so you can use some of those ancient vulnerability tests if you need to. It also has the same basic client/server architecture.[…]
ISACA has introduced a new certification for risk managers – CRISC. I’ve got their CISA certification, and I’m not sure that CRISC is useful (other than as a way to make them money). First off, risk management is not specific to the IT field, and most risk managers are not working in IT but in project management. Second, there are very few risk management methodologies in use, or even studied, so what exactly does this certification teach/require? There are scant details on the web site on what the test will cover, but they claim that these professionals will help enterprises design risk management controls for IS. Risk isn’t only about controls – that’s auditing – making sure the processes you[…]
(probably) Everyone knows that firewalls are a “good thing” to have, but how many people actually know how they work? Firewalls can have many features that I won’t go into here, but the basic way they work is that there’s a set of rules that someone sets up (or is given) and the firewall follows those rules. How it does this makes us remember our TCP/IP and UDP connection details. A connection consists of two port/IP pairs – one for the source and one for the destination. A firewall looks at that information (among others) to determine if that packet is “OK” or not. If the packet is OK – based on the rules it’s been given, the “connection” is[…]