33

To quote AviD on this: Security at the expense of usability comes at the expense of security If you make it too hard to fulfill a security policy, people will either ignore it or look for loopholes and workarounds which fulfill it to the letter but not to the spirit. So you will reach the opposite of what you intended and weaken security. A security ...


7

Some advice from someone who has written many a policy: Rule #1. This is the most important rule. In fact its a requirement to start any other process. If you management team is not going to back the policies, it is not worth your time, the companies time, let alone users time to enact anything. I'm talking about your C-level, if they are not on board, ...


6

You basically have two choices here: 1) you consider capability and have a process for exceptions or 2) you refuse to work with anyone who cannot implement your policies. If you don't do 1) and can't do 2) it means your policies exist on paper only. If you don't have the power to make 2) happen, you are left with considering capabilities. I would say, ...


5

The Factor Analysis of Information Risk (FAIR), or any Value-at Risk (VaR) model, whether based on MC (Monte Carlo Method), Bayesian statistics, or other sound variable-crunching, model-bound, formulaic risk analysis -- any of these will culminate is a more-efficient risk calculation. If you are a member of ISC2 (e.g., CISSP), you can check out CyVaR by ...


4

There were discussions of placing attack trees 1, 2 in existing SGML derivatives 3 that describe system architecture or govern security modules, but nothing like unanimity appears to have been reached. The issues include The complexity in which attacks relate to individual architectural components and That the nodes described in Schreier's tree proposal ...


4

Ok so after diving into this a bit, this is the best I can come up with. I do not work for the US government so I cant say anything with any level of confidence. However; It seems that the color classification system is largely based on convenience. Since the whole point of having the classification marked on the pages of each document provides a simple ...


4

A good information security policy should very clearly state a number of things. At least the following: The reason why it was implemented its goals its scope its boundaries (the things it does not apply to) clear requirements towards the assets that are part of the scope controls that meet these requirements responsibilities There are (at least) two kinds ...


3

The format you mentioned is the ASN.1 type ECDSA-Sig-Value as specified in RFC5480: Elliptic Curve Cryptography Subject Public Key Information: ECDSA-Sig-Value ::= SEQUENCE { r INTEGER, s INTEGER }


3

ESP / tunnel mode is often used when you want to connect two different POPs' networks together: you're basically implementing a full network and routing layer on top of an encryption layer, and the networks have zero knowledge that they crossed a public network (like the internet). When you simply want to encrypt everything between two endpoints without a ...


3

CVSS tends to be the risk rating model used in nearly all vulnerability reports. One model mentioned in Microsoft's SDL is called DREAD This is primarily used during the threat modelling stage to measure potential risks in software design, however it can be adapted to vulnerabilities too. Here is another useful link on DREAD.


3

I'm aware of two: The OWASP Developer Guide (to go along with the OWASP Top 10). David A. Wheeler's Secure Programming HOWTO, which is a very long and very comprehensive guide.


3

According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA: "It is often necessary to use a CPE Name when identifying a specific release of a given platform. If attempting to create a CPE Name for this, and a specific co mponent is not applicable to the given platform, then the term '-' should be used. Note that ...


3

There is no standard algorithm for key verification*, but there are standard checksums. Assuming verification is done to detect simple mistakes when retrieving or submitting the key, any reliable checksum algorithm such as CRC32 will work. In fact, it can be made transparent to the key-holder by including the checksum in the key itself. This can be done ...


3

Alternatively, if I am incorrect about this: then in what way? You are comparing apples to oranges. The email Header is most closely equivalent to the physical mail Envelope - even better, the email Header represents routing information that is not accessible to the recipient in physical mail. So it's not correct to say that email client's access to "...


3

Blowfish is an algorithm. An algorithm isn't validated against anything. What is validated is an implementation of an algorithm. Blowfish isn't defined by any text that calls itself a standard, as far as I know. The original paper is the closest thing to an official specification. The author has also published test vectors. You should not use Blowfish ...


2

One thing that you might be able to do depending on what policies you go for is make your policies complement each other, where the implementation of one policy becomes easier and/or more secure if you also implement another policy. For example: you give the example policy of password requirements. If you alongside that policy also have a policy of ...


2

Certification depends on the nature of the software, how it will be used and where it will be used (country, industry, etc...). Without that specific information we can't help you. Third party reporting can be done by several institutions and companies. ISO27001 is an information security management system, CIS is a company providing services and creating ...


2

Any OWASP project is as relevant as the community behind it, for example the PHP project is now abandoned but ASVS seems pretty active still. Adhering to any OWASP best practice is always a good idea, it may not be the perfect fit for your organization and you are not obliged to follow everything they say, but it certainly helps to steer you in the right ...


2

Not to be too snarky, but did you try googling "cert secure coding history"? First hit: https://www.securecoding.cert.org/confluence/display/c/History I believe the first paragraph covers "when and why": The idea of a CERT secure coding standard arose at the Spring 2006 meeting of the C Standards Committee in Berlin, Germany. The C Standard is an ...


2

The answer depends on why you're even thinking of setting a 12-character limit. If it's because the system is known to be trivial to attack with 11-character passwords, and proven to be computationally infeasible to attack with 12-character passwords and the foreseeable compute resources of the planet, then you make it an absolute requirement. Anyone who ...


2

This is very broad and as such, it's a little hard to exactly cover everything that applies to each. However, I'll try to cover the ones that I know apply. Credit card information is generally governed by PCI DSS (Payment Card Industry Data Security Standard) as the credit card industry likes to regulate themselves and not be regulated by governmental ...


2

to start I suggest you to refer to the SANS top 20 critical controls that every year are released and updated. They are about policies, appliances and best practices that must be applied to reduce the risk of possible incoming threats. Here you can find an intro about them: https://www.sans.org/critical-security-controls But I strongly suggest to download ...


2

I'm not 100% sure what the EU laws and guidelines would be however; I suspect it's left to the member states to decide what to issue in regards to deletion of personal information. with that said I found a PDF from the UKs Information commissioner’s Office (ICO) and they state in this document that... ...the ICO will adopt a realistic approach in terms of ...


2

The standard format for storing encrypted data is the Cryptographic Message Syntax (CMS), a.k.a. PKCS#7. Encrypted data contains a ContentEncryptionALgorithmIdentifier, which has to contain the type of encryption used (for instance AES-128-CBC) and all parameters neccesary to decrypt it (for instance an IV). The ASN.1 types for the AES-CBC encryption are ...


2

You probably want to have a look at the ISO 27001 standards. https://www.itgovernance.co.uk/iso27001 Here are a couple of web pages specifically focusing on the physical aspects of offices for security: https://www.churchillsecurity.co.uk/2017/03/08/iso-27001-protect-secure-areas/ https://advisera.com/27001academy/blog/2015/03/23/physical-security-in-iso-...


2

There is no central repository from where to get this kind of source. What you should do, is to get the official publication of any standard you want to refer too. You can either find it by yourself, with a search engine, or by reading other article that cite this particular standard. A lot of protocols are RFC, published by the IETF. Good Wikipedia ...


1

While they may be difficult to avoid, shared accounts are generally a bad idea for information security and are not looked kindly on by ISO27001 or security auditors. Shared accounts make it difficult to create a proper audit trail, as actions cannot be directly linked with a real person. There are, however, ways to get around this, for example by ...


1

What is the minimal security standard that the product needs to meet? This largely depends on procurement requirements you are trying to meet. For US federal government the bare minimum to get on the list is FIPS 140-2 certification of your cryptographic module. For DoD there is JITC certification. For NSA and such you have NIAP and Common Criteria. ...


1

With the mknod command it is possible to create device files other than those that already exist in /dev. $ sudo mknod /tmp/sda b 8 0 $ fdisk -l /tmp/sda Disk sda: 80 GiB, 85899345920 bytes, 167772160 sectors ... When a filesystem is mounted nodev, you can still create such device-files, but they are no longer usable. An attack on /tmp files works like ...


1

Whether or not this is standard is going to depend on your specific industry. Not knowing anything about yours or the nature of your projects, I can say this is a standard practice for data under legal hold, where a company is anticipating litigation and don't want to be accused of destroying evidence. Or the company wants to be able to demonstrate prior ...


Only top voted, non community-wiki answers of a minimum length are eligible