1,238 reputation
511
bio website levii.com
location
age
visits member for 3 years, 9 months
seen Jul 14 at 21:46

Oct
2
awarded  Nice Question
Aug
30
revised Monitoring file access on Windows
Fix typo
Aug
30
revised Monitoring file access on Windows
Fix typo
Aug
30
answered Monitoring file access on Windows
Aug
29
comment Password entropy in layman's terms
Obligatory xkcd.com/936
Aug
29
comment The Creation of Secure Software Development Environments
@Rory & DW. Thank you for the follow ups - and I agree with both of you in that isolation is one of a myriad of protections that needs to be in place. My shortcoming is in finding reference guidance and frameworks for this type of isolation. I'd assumed that I'd need to build much of the framework myself and the issue is finding whitepapers or industry research to support it.
Aug
29
comment The Creation of Secure Software Development Environments
Thanks for the input this.josh. I agree that this is a difficult goal, but there are technolgies that can assist as well. A remote developer could be on a laptop secured w/ checkpoint (or something like it to ensure no config changes) that tunnels into the dev system via VPN and actually develops on a remote desktop session (just 1 idea). Most companies certainly wouldn't pay for the additional overhead, but I have been on DoD projects where it was a contract requirement - so I know that the need (at least to some degree) exists for a common governance and design mechanism.
Aug
28
comment Accessing a site (which is) under a DDoS
Are there any external firewalls that do not have IP addresses registered to an-example-site connected to the network (that Alice might use to VPN to the internal side of the network for access to the site)?
Aug
28
comment The Creation of Secure Software Development Environments
@Woot4Moo. Thanks for your updated response. You're certainly outlined the failings of the current guides/frameworks in developing a governance structure for an ITMS/ISMS and provided some essential and practial security controls. Are there any other references that you'd suggest for this type of boundary separation?
Aug
28
awarded  Commentator
Aug
28
comment The Creation of Secure Software Development Environments
My question is less about secure software, and more about creating a secure environment for the production of that software (prevention of exfiltration of source and/or data, protection of production assets from in-development systems). Rather than create a specific environment, I'm looking for a reference framework (or set of frameworks) for guidance (much like NIST 800-53 lays out some fairly specific governance and security controls for the protection of government IT systems but is used fairly extensivley in the commercial world as a guide).
Aug
26
comment The Creation of Secure Software Development Environments
I was not aware of the OpenSAAM project, thank you for the link - it appears to be largely what I'm looking for from a governance model. I see that there is a "future" work to map the model with ISO 27002 (and likely others). I will certainly be on the mailing list and perhaps will be able to contribute in the future.
Aug
26
comment The Creation of Secure Software Development Environments
@Woot4Moo. While I understand your point about a bunch of STIGs just being "hardening checklists" there are also a number of them that actually act as the "guides" their names entail. This is the STIG I was referring to: iase.disa.mil/stigs/net_perimeter/enclave_dmzs/enclave.html Since this describes an architecture and a method (without telling you specifically how to do it) I would think that it falls under the umbrella of a framework or guide.
Aug
26
asked The Creation of Secure Software Development Environments
Mar
20
answered Can you pass C|EH without any hands-on experience in hacking tools
Mar
19
answered Keyboards immune to signal monitoring?
Mar
14
revised How to apply FIPS to Microsoft Access database with custom VBA
added 140 characters in body
Mar
14
comment How to apply FIPS to Microsoft Access database with custom VBA
You can ensure your app is compliant from within VBA. The MSFT offered SHA and 3DES modules are FIPS compliant. For testing, you'll want to ensure to enable the enforcement of FIPS compliance on your box (the registry key above) [to ensure you don't accidentally use any non FIPS component ... it will throw an exception if you do]. I added the link to the complete list of modules to my answer.
Mar
14
answered How to apply FIPS to Microsoft Access database with custom VBA
Mar
14
answered Is AJAX fundamentally insecure?