April 2008

Good Morning/Afternoon/Evening depending on where you are or when you read this. Another day full on interesting bits on the intarwebs.

http://www.liquidmatrix.org/blog/2008/04/23/its-a-hump-day-miracle/ - Dave Lewis talks about the difference between the reality of work as a CISO compared to the work of the average 9-5er. He is interested in your feedback.

Vladuz goes down. A case study for corporate activism - Richard Stiennon talks about cross jurisdictional cooperation between law enforcement agencies and companies.

My Information Security and Privacy Convergence Webcast Now Available - Realtime IT Compliance - Rebbecca Harold did a webcast for ISSA that is now available.

Security4all: The dangers of Web 2.0: information gathering tactics 101 - Benny Ketelslegers has a post up about the information we leave behind as we interact on the web. He points to a tool called maltego which can help you see what is out there.

Data Classification Is Dead - rmogull has put forth an interesting perspective on Data Classification.

Vulnerability notifications? - Keels Leune talks about customer notification when no verifiable breach has occurred and if it is warranted.

How to audit an Internet Facing Server with Nessus - The folks over at Tenable have some guidance on using Nessus to audit and Internet facing server.

Darknet points us to a nifty tool called Pash-the-Hash that allows us change our credentials in memory.

That's it for now.  Have a great morning/afternoon/evening.

Kevin

{ 1 comment }

Lot's if interesting stuff today. So here we go:

CNN.Com, Politically Motivated DDoS, and Asymmetric Warfare - A very insightful look at cybercrime and asymmetrical warefare.

Navigating the PCI DSS Standards... - Rafal Los has a good overview of the PCI update to 6.6.

New Phishing Scam Targetting Economic Stimulus Payments - mxlogic has a post about a new phishing scam.

5 Reasons Why IT Security People Shouldn’t Ignore Cloud Computing - Craig Balding tells us 5 reasons we should be paying attention to cloud computing now.

A little judicial oversight please - Martin McKeay has a good post about privacy and the need for enforcement agencies to have access to information, but with appropriate judicial oversight.

Information Week's Virtual NAC Tradeshow - Jennifer Jabbusch points out that there is an virtual trade show being delivered by Information Week. If she recommends it, you should go check it out.

Logs - A double-edged sword? Beating PCI Fines by bad security practices? -Declan Ingram gives and interesting and potentially worrisome issue with logs and PCI fines.

How to Make Security a Presence in Your Organization - Frank Cassano has some good tips on how to increase the impact of you security awareness program.

{ 0 comments }

Something Everybody should know - Andy puts together all the links to a series run by Computer World this week titled "things you should know about your company's data security."

Counting Vulnerabilities and SDL - No One Hears the Tree Falling & More on SDL & Counting Vulnerabilities - Interesting posts about software development lifecycle and counting vulnerabilities.

5 Ways to Molest Internet Users - Danny McPherson points out some sneaky things you can do if are in the DNS control path that give you the opportunity to be nasty to unsuspecting intarweb users.

{ 0 comments }