Tag Info

Hot answers tagged

73

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain: The actual bottom line is that a compromise of our data will cost the company approximately X dollars + Y hours to recover. This is Z% likely to happen given the malware ...


67

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


38

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture. While there are various ways of qualifying the realm of ...


32

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the ...


29

I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice. Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...


25

Another good question, but perhaps you should phrase it "Does PCI harm security". To answer both questions, I would differentiate very roughly between two types of organizations (even though most fall in between these two extremes): Security-conscious organizations, that routinely perform business-risk based analysis, have a comprehensive SDL in place, ...


24

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


23

You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again. Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...


19

I see two sides on this: most government bodies I review/audit tend to believe that because they secure everything then they are the most secure and that is the way it should be! In actuality the organisations that go down the security nazi route usually end up more open than those who are pragmatic about it. For example, locking down your users too hard ...


17

While I generally disagree with the CSO, I can see a reason why he drew this line. The question can come down to the delineation of who needs to lead mitigation and remediation efforts. DDoS does, of course, impact availability but is typically handled by the Operations team. If a DDoS event happens, your CSO might feel that there is nothing that he can do ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, ...


15

Yes, I think it's possible to be too paranoid. Although, also, I just finished talking security with a bunch of performing artists - people with no money who really need to spend their time promoting their work and creating new work... not building the Fort Knox of security just so they can use Facebook. They need common sense, a basic understanding of ...


13

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents. From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of ...


11

Yes its used, in a number of mail delivery/filtering sytems. The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services. See http://hashcash.org/mail/ You might also want to read the hashcash FAQ: http://hashcash.org/faq/ It is also used in various other protocols and applications including for combating blog ...


11

This is such an astonishing question that I find it difficult to answer. This distrust doesn't come from theory, but from experience. When we say "FTP is too dangerous to use" is because we've found it, in practice, too dangerous to use. You seem to think that a "packet logger" is either difficult to obtain or difficult to use. Neither is true. It takes ...


10

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


10

As a security professional, it is often best to 'outsource' this calculation to the business. For example, if you identify a vulnerability which you can demonstrate is easy for an unskilled attacker to exploit to destroy the customer database, and the operations team estimate bringing it back from backups will take 4 hours, including checks, ask the business ...


10

Short answer: Yes, computers can get a whole lot wrong before any human can realize that there's a problem so "trust" just doesn't work in computer systems. Default distrust is the only viable posture for high-performance system. To explain why, I'll contrast interactions between computers to interactions between humans. In human interactions, default ...


10

If you read Schneier, you'll be familiar with one of the basic premises of "smart" security that he also pushes a lot: Security is a Trade-off. It simply does not make sense to go full metal paranoid on your systems, since security can NEVER be 100% anyway (we used to be told the only way to be 100% is to unplug the computer... now we know that's ...


10

No. Submerging a hard disk drive into water or any other non-corrosive liquid will do nothing to its platters that would render data recorded on them irretrievable. It will most likely ruin hard drive's logic board (controller and other circuitry on its PCB), but that's not too hard to replace. Hard drive platters' magnetic recording surface is most ...


9

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


9

I don't believe the solution is to not use your iPad, the benefits are clear. However I do think you need to approach it the right way. Working on the InfoSec field, I believe you have a responsibility to set a good example. Eat your own dog food. You need to comply with policy. Is there an exemption process in the policy? This would be the best way to ...


9

Try spies. The last James Bond opus appears to make millions of entries, so the crowd at large is, for now, receptive to spy stories. Explain that once unreliable/hostile people are in charge (that's the "compromised" setup), there is no way to recover proper security by asking them to do it; and yet, that's what running an AV on an infected machine is ...


9

That's easy - just finish the quote in your question, from Aliens. It's the only way to be sure. That's really all there is to it. Nothing more, nothing less. Let them know that if you run the AV software on it and the software says it has found and removed the virus, then maybe they're ok. Maybe. If the virus was really removed. If that was really the ...


8

The first thing you need to be aware of is that PCI DSS is NOT intended to protect your organization. It is intended to protect the payment networks and the payment ecosystem. This may sound odd to many, but just ask Visa and Mastercard. I agree with AviD's comments. "PCI Compliance" reduces some specific risks and probably makes those organizations ...


8

I think that to answer this question, you need to have a solid understanding of the value of the assets you are trying to protect. If we think of information security as providing confidentiality, integrity, and availability (CIA), we can also try to determine the cost to the organization if these assurances are undermined. C: Given the value of some ...


8

The one truism of PCI-DSS compliance is this: You are PCI-DSS compliant if your QSA says you are PSI-DSS compliant. I'm of the opinion that the PCI council did a pretty stinking good job of giving us a very clear and to the point standard to follow, at least as far as standards go. That being said, this is one of those interesting cases where the ...


8

Your hard drive will undoubtedly contain toxic substances which if heated or burned will be released into the air, not a good thing. If you did this in your oven you would never want to use your oven for food again! Much better to take the entire drive as is and simply chop it into many pieces. A sheet metal shear should be able to slice through it like ...


8

There's always going to be hackers that do these type of things because they can. The extent to which that pool overlaps with those with malicious intent is the magnitude of the concern, I think. Like anything else in medicine, there is a tradeoff between costs and benefits, so if the convenience to the patient and power to control dosing and other ...



Only top voted, non community-wiki answers of a minimum length are eligible