A lot of computer security deals with risk – what are the risks of doing or not doing something? However, risk is not exclusive to computer security, and there are many papers and treatises on how to determine and how to manage risk – you’ll generally find papers on risk in management literature, most often project management. Project managers have to deal with risk all of the time – what if the weather is bad, what if a key employee quits on the project? There has to be a plan in place for these eventualities. The same is true in computer security.
Author: Laura Raderman
Electronic health records (EHRs) are touted as making healthcare more affordable and efficient. It also assists care providers – you doctor – in making fewer mistakes such as prescribing a drug that reacts with other drugs you are taking but he doesn’t know about. The 2009 economic stimulus package aims at encouraging physicians to adopt EHRs, eventually reducing the Medicare payments to those who do not adopt EHRs. What are Electronic Health Records, why are they useful, and more relevant here, what are the security implications of using them?
Last week were two of the premier events in the security world- BlackHat and Defcon. Every year, we patiently wait with baited breath as new exploits are announced (and usually patched). I’ve been once, but until Caesar’s Palace (and the Las Vegas airport) bans smoking everywhere, I won’t be returning – so I watch from the sidelines and enjoy the smoke-free air of home.
Nessus is a vulnerability scanner that has been around for a while and has a mottled history. It began as an open source scanner, and then Tenable Security took the source code and created a fork of nessus after version 2.0. The 2.0 source is still available, and OpenVAS has taken it and kept it open source.
Germans lost the Root CA key for their electronic health card system There are mechanisms for backing up HSMs – they should be used, and this just underscores why.
One of the more common problems that I see among clients, especially smaller ones, is appropriate destruction of data before retiring/selling/destroying computer systems. If you’ve got a relatively modern system (i.e., SCSI, ATA or SATA drives), you can use Darik’s Boot And Nuke (DBAN). If you have an older system (mainframe, etc…), DBAN won’t really be able to help you out – I suggest a chainsaw and a hammer (or pay someone else to do it). If you can use DBAN though, it’s easy to use and comes with several types of wipes depending on your situation. DBAN supports a Quick Erase, RCMP TSSIT OPS-II, DoD Short (3 passes), DoD 5220.22-M (7 passes), Gutmann Wipe, and PRNG Stream as the[…]