Search

The past few weeks haven't been a complete disaster, but I have to dig deep to find the silver lining in recent events. It started when the Finland-based University of […]

RFC1918: This Internet Engineering Task Force request for comment specifies the following three ranges of IP addresses exclusively for internal network use: * 10.0.0.0 - 10.255.255.255 (10/8 prefix) * 172.16.0.0 […]

During the past year and a half, I've written about many of the ups and downs of being an information security manager. I've been open about most issues, but I've […]

An e-mail from the director of marketing put a spring in my step this week. He and I have locked horns over security issues in the past. Marketing always wants […]

Back door: This is an entry into a system left by a trusted insider so that he can gain access after official privileges have been removed. The greatest back door […]

Measuring the effectiveness of a security program is notoriously difficult. One can identify the bare minimum for system defense and specify best practices, but how can one tell the excellent […]

www.isaca.org/cert3.htm: Think you could do it better as an information systems auditor? Pass the Certified Information Systems Auditor exam and perhaps you'll be providing companies like mine with more thorough […]

I was happily dreaming about a well-secured network when the beeping of my cell phone woke me. It was the office. I'd been away from work for a few days […]

This week, I've had the chance to read the following two recent books: Incident Response, by Kenneth R. van Wyk and Richard Forno (O'Reilly & Associates, 2001) and Incident Response: […]

After a long weekend, I was hoping for a nice, quiet day spent cleaning up my e-mail and planning my budgets for next year. Instead, I faced the Nimda worm. […]

I've always been lucky when it comes to staffing. I employ people I'm very happy with, and despite high turnover within the industry, I've always managed to retain key people. […]

Normally, when you mention 'mobile,' information security people think of the Wireless Application Protocol (WAP) with its Wireless Transport Layer Security, or perhaps 802.11b wireless LANs using the Wired Equivalent […]

My organization is changing rapidly these days. We're selling our key technology in several global markets, and we're looking for ways to improve the way we work. One avenue is […]

This Week's Glossary: Data Encryption Standard (DES): This U.S. Department of Defense encryption method used to be the industry standard. It has since been superceded by the Advanced Encryption Standard […]

In many years of working in financial services, I've often been on the receiving end of various kinds of service providers (xSP). I've reviewed xSP companies to make sure they […]

The recent collapse of the dot-com market has brought significant benefits to those of us slaving away in Old Economy companies. Not only do we get to feel smug about […]

Recently, I attended one of the SANS Institute's Global Information Assurance Certification (GIAC) training courses, to become a GIAC Certified Intrusion Analyst (GCIA). The instructor, Stephen Northcutt, is a fascinating […]

Mention the word forensics, and I imagine rubber gloves and Dana Scully conducting autopsies in The X-Files. Thankfully, when applied to computers in general, forensics is less smelly and less […]

Computer forensics: The investigation of computer crime, including the collection, analysis and presentation in court of electronic evidence. Black-bag job: Slang for the surreptitious entry into an office to obtain […]

I have a competent security team that deals with a wide range of situations, but there's one task that sends a shiver down my team members' spines: a cold call […]

Our organization runs a large intrusion-detection system (IDS) with multiple firewalls, and this complicated technology is hard to get right. The vendors expend a great deal of development effort updating […]

Our financial services work requires the use of some pretty wizzy technology, and some of our methods and software could be useful to other companies. So until recently, our new […]

One of the nagging problems in information security is the difficulty of finding out how many security incidents occur. Unfortunately, this information is difficult to obtain. Companies fear the public […]

I'd like to believe that for every security problem I face, there's a technical product or suite of products that can solve it. However, some problems are too subtle and […]

The largest risk my company faces for downtime and lost revenue comes from virus infections. Viruses used to be a nagging little problem that affected only those who trafficked in […]

I spent my weekend working with the network team, the Unix systems administrators and some external consultants to try to add a second Internet service provider (ISP) to our infrastructure […]

It begins with a shiver, a vibration almost too faint to be sensed. My attention is pulled from the meeting I'm in by the security problem I know is occurring […]

Editor's note: Starting this week, the Security Manager's Journal adds a second voice. Our newest contributor - call him Vince Tuesday - joins Mathias Thurman as a regular contributor, appearing […]

* Secure Architectures With OpenBSD, by Brandon Palmer and Jose Nazario; Addison Wesley, 2004. OpenBSD is the poster child for secure production operating systems. The team that wrote it takes […]

I'M A PARASITE. I didn't pay for the bandwidth I'm using right now. I didn't ask for permission to use it--I don't even know whom to ask. But I'm on […]

'WE'VE BEEN ROBBED!' That a modem had been stolen right from under our noses seemed unlikely at first, but as the IT security team and I frantically searched for it, […]

IT'S NOT POLITE to poke fun at your vendors, but during a recent meeting with our Cisco reps, I couldn't resist. We had the reps in for a chat about […]

I'D LIKE TO THINK that I have a clearly defined role focused around protecting the information assets of my organization. In reality, I also have the delightful job of dealing […]

I LIKE TO THINK OF MYSELF as a dedicated worker, but I do have limits. I don't mind weekend work if we suffer a major incident, but last weekend I […]

IT'S A NETWORK that connects over 98% of the population. It extends to every country on the planet and occasionally even into outer space. No, it's not the Internet. It's […]

WHENEVER a new virus appears, I worry that it will be clever, elegant--and a headline on the nightly news. That combination means that everyone in management will want to know […]

HOW WELL would you do in a negotiation with a foreign vendor if the representative didn't speak English and your translator was secretly working for a competitor? How would you […]

I'VE HEARD many metaphors for information security, but one of the more interesting ones compares IT security to the field of dentistry. Dentists used to spend all of their time […]

WE'VE DECIDED that as a corporate subsidiary, it's time to leave home and strike out on our own from an IT security perspective. Historically, because the parent organization owns us, […]

Computer Security, 20 Things Every Employee Should Know, by Ben Rothke; McGrawHill, 2004 At 51 pages, this title is little more than a pamphlet compared with most IT security books. […]

IT'S UNPROFESSIONAL to break down and sob during a meeting, but I came pretty close a few times this week as I finally began to understand the details of the […]

THE MOST IMPORTANT document a security professional can write isn't a policy document; it's his resume. I've been checking resumes lately because we need to replace a member of my […]

I RECENTLY CHANGED positions and have been trying to understand the many projects already under way here. The most vital of these is a planned virtual private network (VPN) rollout. […]

AT 10 A.M., the boss called the entire IT security team into a meeting room, but without the line manager. He said that the line manager had been sacked. There […]

WE WERE PUSHING for a speedy move to the supposedly more secure Windows Server 2003--until we ran into the vulnerability in remote procedure call (RPC) services that use the Distributed […]

WE'VE been trying to control the problem of spam, and at long last, we can see light at the end of the tunnel. My security team and I already use […]

THIS WEEK, my team and I discovered a vulnerability in the Cisco Systems Inc. equipment we use in our global network. There are 253 possible IP-based protocols in IP Version […]

MY COMPANY has good security, but at times it's too good. Occasionally users complain that the level of security is too high. When that happens, we try to work with […]

I'VE ALWAYS BEEN PROUD OF my security team's antivirus defense and scathing in my criticism of other companies that have had virus problems, believing as I did that any organization […]

E-mail Rules, Nancy Flynn and Randolph Kahn: Amacom Books, 2003 This delightful book contains 36 rules of e-mail management -- simple nuggets of information that bring together a clear policy […]