Tag Info

Hot answers tagged

72

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain "The actual bottom line is that a compromise of our data will cost the company approximately X dollars + X hours to recover. This is X% likely to happen given the malware that is ...


65

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


32

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the ...


27

I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice. Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...


24

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


23

"You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again." "Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...


22

Another good question, but perhaps you should phrase it "Does PCI harm security". To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes): Security-conscious organizations, that routinely perform business-risk based analysis, have a comprehensive SDL in place, ...


19

I see two sides on this: most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be! In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, ...


15

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...


13

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents. From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of ...


11

This is such an astonishing question that I find it difficult to answer. This distrust doesn't come from theory, but from experience. When we say "FTP is too dangerous to use" is because we've found it, in practice, too dangerous to use. You seem to think that a "packet logger" is either difficult to obtain or difficult to use. Neither is true. It takes ...


10

As a security professional, it is often best to 'outsource' this calculation to the business. For example, if you identify a vulnerability which you can demonstrate is easy for an unskilled attacker to exploit to destroy the customer database, and the operations team estimate bringing it back from backups will take 4 hours, including checks, ask the business ...


10

Yes its used, in a number of mail delivery/filtering sytems. The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services. See http://hashcash.org/mail/ You might also want to read the hashcash FAQ: http://hashcash.org/faq/ It is also used in various other protocols and applications including for combating blog ...


10

If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot: Security is a Trade-off. It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...


10

No. Submerging a hard disk drive into water or any other non-corrosive liquid will do nothing to its platters that would render data recorded on them irretrievable. It will most likely ruin hard drive's logic board (controller and other circuitry on its PCB), but that's not too hard to replace. Hard drive platters' magnetic recording surface is most ...


9

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


9

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


9

Short answer: Yes, computers can get a whole lot wrong before any human can realize that there's a problem so "trust" just doesn't work in computer systems. Default distrust is the only viable posture for high-performance system. To explain why, I'll contrast interactions between computers to interactions between humans. In human interactions, default ...


9

Try spies. The last James Bond opus appears to make millions of entries, so the crowd at large is, for now, receptive to spy stories. Explain that once unreliable/hostile people are in charge (that's the "compromised" setup), there is no way to recover proper security by asking them to do it; and yet, that's what running an AV on an infected machine is ...


8

The one truism of PCI-DSS compliance is this: You are PCI-DSS compliant if your QSA says you are PSI-DSS compliant. I'm of the opinion that the PCI council did a pretty stinking good job of giving us a very clear and to the point standard to follow, at least as far as standards go. That being said, this is one of those interesting cases where the ...


8

I think that to answer this question, you need to have a solid understanding of the value of the assets you are trying to protect. If we think of information security as providing confidentiality, integrity, and availability (CIA), we can also try to determine the cost to the organization if these assurances are undermined. C: Given the value of some ...


8

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


8

Such hardware may make life more difficult for people who rely on PBKDF2 for password hashing. Password hashing functions are intentionally slow -- slow for the honest server and for the attacker alike. We want it to be as slow as is tolerable for the server which uses it, so that it becomes (hopefully) intolerably slow for the attacker. The defendant's ...


8

The traditional answer to your question is - get a job at an auditing firm. It'll be a junior position, but that's how you learn the trade. You'll get access to the sort of workplans Rory mentioned, but even more importantly, you'll get experience applying them to actual audit situations. I've met good auditors, and I've met poor auditors, and good ...


8

As long as you open up the drive so your corrosive product can remove the magnetic coating from the platters then this should work. It will, however, be much slower than the other mechanisms you mention, and will be harder to test for completion. Shredding is the fastest and easiest to confirm complete - it takes a few minutes and leaves you with dust. ...


8

The cost is not from the vulnerability but from the risk. Namely: A vulnerability is that which can potentially be exploited to put at risk your information assets (e.g. a buffer overflow). A threat is a context element which will try to snoop on or damage your information assets (e.g. an existing group of attackers who would benefit from such actions in ...


8

This is really about closing the gap between Information Security and Business objectives. For most security departments today, the battle selling Information Security to the board is the major challenge. Usually, board members don't care about "good securityā€¯, they care about "good enough security". InfoSec is rarely clearly defined in most organizations ...



Only top voted, non community-wiki answers of a minimum length are eligible