Search

From PalmPilots to MobilePros, new personal digital assistants sport bigger screens and easier input. Wow, you may actually want to use one. For a decade, palmtop PCs have been derided […]

The past few weeks haven't been a complete disaster, but I have to dig deep to find the silver lining in recent events. It started when the Finland-based University of […]

RFC1918: This Internet Engineering Task Force request for comment specifies the following three ranges of IP addresses exclusively for internal network use: * 10.0.0.0 - 10.255.255.255 (10/8 prefix) * 172.16.0.0 […]

During the past year and a half, I've written about many of the ups and downs of being an information security manager. I've been open about most issues, but I've […]

An e-mail from the director of marketing put a spring in my step this week. He and I have locked horns over security issues in the past. Marketing always wants […]

Back door: This is an entry into a system left by a trusted insider so that he can gain access after official privileges have been removed. The greatest back door […]

I was happily dreaming about a well-secured network when the beeping of my cell phone woke me. It was the office. I'd been away from work for a few days […]

This week, I've had the chance to read the following two recent books: Incident Response, by Kenneth R. van Wyk and Richard Forno (O'Reilly & Associates, 2001) and Incident Response: […]

Normally, when you mention 'mobile,' information security people think of the Wireless Application Protocol (WAP) with its Wireless Transport Layer Security, or perhaps 802.11b wireless LANs using the Wired Equivalent […]

Wireless Transport Layer Security (WTLS): This protocol supports security on mobile devices running WAP. WTLS is based on Secure Sockets Layer but is modified to support User Datagram Protocol and […]

This Week's Glossary: Data Encryption Standard (DES): This U.S. Department of Defense encryption method used to be the industry standard. It has since been superceded by the Advanced Encryption Standard […]

In many years of working in financial services, I've often been on the receiving end of various kinds of service providers (xSP). I've reviewed xSP companies to make sure they […]

The recent collapse of the dot-com market has brought significant benefits to those of us slaving away in Old Economy companies. Not only do we get to feel smug about […]

Recently, I attended one of the SANS Institute's Global Information Assurance Certification (GIAC) training courses, to become a GIAC Certified Intrusion Analyst (GCIA). The instructor, Stephen Northcutt, is a fascinating […]

Mention the word forensics, and I imagine rubber gloves and Dana Scully conducting autopsies in The X-Files. Thankfully, when applied to computers in general, forensics is less smelly and less […]

Computer forensics: The investigation of computer crime, including the collection, analysis and presentation in court of electronic evidence. Black-bag job: Slang for the surreptitious entry into an office to obtain […]

One of the nagging problems in information security is the difficulty of finding out how many security incidents occur. Unfortunately, this information is difficult to obtain. Companies fear the public […]

I'd like to believe that for every security problem I face, there's a technical product or suite of products that can solve it. However, some problems are too subtle and […]

The largest risk my company faces for downtime and lost revenue comes from virus infections. Viruses used to be a nagging little problem that affected only those who trafficked in […]

I spent my weekend working with the network team, the Unix systems administrators and some external consultants to try to add a second Internet service provider (ISP) to our infrastructure […]

Editor's note: Starting this week, the Security Manager's Journal adds a second voice. Our newest contributor - call him Vince Tuesday - joins Mathias Thurman as a regular contributor, appearing […]

WANT TO TAKE electronic notes without shouldering the weight--and cost--of a notebook? Check out the slim, translucent $199 AlphaSmart 3000. About the size of a notebook PC keyboard, the AlphaSmart […]

With its OmniBook XE series, Hewlett-Packard joins the ranks of major notebook vendors offering sub-$2000 portables for business users. But while the fast performance of the $1849 OmniBook XE2 makes […]

Subnotebook From all the oohing and ahing people are doing over the Sony Vaio 505GX, you'd think it was a newborn child instead of a first-of-its-kind subnotebook. The 505GX's ultrathin […]

BLUE SKY PLUMBING, in suburban Denver, had been saving critical data to USB drives. Staffers were supposed to rotate the drives daily away from the office, but sometimes forgot. Data [...]

ONE OF THE WORLD'S LARGEST MEDIA CONGLOMERATE IS STEPPING UP ITS INVOLVEMENTT IN THE INTERACTIVE MARKET. TIME WARNER INTERACTIVE GROUP IS BUILDING ON THE FOUNDATION STARTED BY ITS PREDECESSOR, WARNER […]

* Secure Architectures With OpenBSD, by Brandon Palmer and Jose Nazario; Addison Wesley, 2004. OpenBSD is the poster child for secure production operating systems. The team that wrote it takes […]

I'M A PARASITE. I didn't pay for the bandwidth I'm using right now. I didn't ask for permission to use it--I don't even know whom to ask. But I'm on […]

'WE'VE BEEN ROBBED!' That a modem had been stolen right from under our noses seemed unlikely at first, but as the IT security team and I frantically searched for it, […]

I'D LIKE TO THINK that I have a clearly defined role focused around protecting the information assets of my organization. In reality, I also have the delightful job of dealing […]

I LIKE TO THINK OF MYSELF as a dedicated worker, but I do have limits. I don't mind weekend work if we suffer a major incident, but last weekend I […]

IT'S A NETWORK that connects over 98% of the population. It extends to every country on the planet and occasionally even into outer space. No, it's not the Internet. It's […]

WHENEVER a new virus appears, I worry that it will be clever, elegant--and a headline on the nightly news. That combination means that everyone in management will want to know […]

I'VE HEARD many metaphors for information security, but one of the more interesting ones compares IT security to the field of dentistry. Dentists used to spend all of their time […]

WE'VE DECIDED that as a corporate subsidiary, it's time to leave home and strike out on our own from an IT security perspective. Historically, because the parent organization owns us, […]

Computer Security, 20 Things Every Employee Should Know, by Ben Rothke; McGrawHill, 2004 At 51 pages, this title is little more than a pamphlet compared with most IT security books. […]

THE MOST IMPORTANT document a security professional can write isn't a policy document; it's his resume. I've been checking resumes lately because we need to replace a member of my […]

I RECENTLY CHANGED positions and have been trying to understand the many projects already under way here. The most vital of these is a planned virtual private network (VPN) rollout. […]

AT 10 A.M., the boss called the entire IT security team into a meeting room, but without the line manager. He said that the line manager had been sacked. There […]

WE WERE PUSHING for a speedy move to the supposedly more secure Windows Server 2003--until we ran into the vulnerability in remote procedure call (RPC) services that use the Distributed […]

WE'VE been trying to control the problem of spam, and at long last, we can see light at the end of the tunnel. My security team and I already use […]

THIS WEEK, my team and I discovered a vulnerability in the Cisco Systems Inc. equipment we use in our global network. There are 253 possible IP-based protocols in IP Version […]

MY COMPANY has good security, but at times it's too good. Occasionally users complain that the level of security is too high. When that happens, we try to work with […]

I'VE ALWAYS BEEN PROUD OF my security team's antivirus defense and scathing in my criticism of other companies that have had virus problems, believing as I did that any organization […]

E-mail Rules, Nancy Flynn and Randolph Kahn: Amacom Books, 2003 This delightful book contains 36 rules of e-mail management -- simple nuggets of information that bring together a clear policy […]

MAY COMPANY deals with large electronic financial transactions on a regular basis, and I worry that this makes us the perfect target for a focused attack on our networks. This […]

MY BOSS loves to tell of his presentation at a Cisco sales conference that ended with audience members standing on their chairs, clapping and hollering with glee. I have to […]

OUR SECURITY TEAM'S goal is to provide the company with freedom from fear. Management is afraid of pornography, afraid of the bandwidth and time wasted on it, and even more […]

A BRIEF ALTERCATION this week with a staff salesperson gave me a new perspective on how pornographic e-mail can affect our business. Like most companies with Internet access, we've had […]

Securing the Network from Malicious Code, by Douglas Schweitzer; John Wiley & Sons Inc., 2002 This book covers virus and worm basics well. If every organization followed the author's advice, […]