NBlog - the NoticeBored blog

I agree that password length is the key against br...

2011-11-18T05:19:49.496+13:00

I agree that password length is the key against brute force attacks. Note this article http://blogs.computerworlduk.com/unscrewing-security/2011/10/username-google-password-2bon2btitq/index.htm and others about the ads in Britain.
2bon2btitq is a passphrase as you mention but how long before password attack dictionaries contain the first line of every Top 40 or 100 song with every variation

Err - this blog! :) IBM Institute for Advanced sec...

2011-07-30T21:27:16.703+12:00

Err - this blog! :)
IBM Institute for Advanced security has some good articles - helps that I know the authours.
ReadWriteWeb still has good hot topics
Plus Lenny Zeltser
Currently ploughing my way through the Verizon back catalogue!

PPS If anyone doubts the value of this standard, ...

2011-06-01T08:32:41.186+12:00

PPS If anyone doubts the value of this standard, check this out: a researcher has discovered nearly 200 inadequately redacted documents in a collection of legal evidence.

http://wombletradesecrets.blogspot.com/2011/05/aba-journal-federal-pacer-document.html

PS I will be submitting the 'finished' li...

2011-02-21T10:04:57.078+13:00

PS I will be submitting the 'finished' list of redaction risks to SC27 as comments in order to suggest that the new standard should recommend controls that would address the risks. I believe it provides a meaningful structure and clarifies the purpose of the controls.

They explained what happened and apologized. What ...

2010-06-22T21:26:21.531+12:00

They explained what happened and apologized. What more to do.
They didn't do anything wrong, but the ignorant masses (of which there are most) are easily scared. So it would seem a calming message was what was called for.

Good article! Thanks a lot for sharing such a nice...

2010-05-18T21:29:41.819+12:00

Good article!
Thanks a lot for sharing such a nice and informative article which is very helpful.
so to be secured we must use a strong password. so its better to change the password very often to be secured.

By the way for more information check this link: http://www.eccouncil.org/certification/ec-council_certified_security_analyst.aspx

Thank you gentlemen. Sorry for my lack of respons...

2010-04-29T11:07:08.943+12:00

Thank you gentlemen. Sorry for my lack of response - been busy in other areas lately. I must put some time aside to explore the ISACA pages on this, particularly the details below that nice glossy image.

Keep up the good work!

Gary Hinson,
CEO IsecT Ltd.

While the original model was posted some time ago,...

2010-04-29T10:33:46.286+12:00

While the original model was posted some time ago, the work done at USC is being taken forward by ISACA. We believe this model has a great deal of relevance to information security. More information can be obtained at www.isaca.org/bmis

I think the ISC2 is also confused re awareness vs ...

2009-12-22T13:05:48.621+13:00

I think the ISC2 is also confused re awareness vs training (vs education). Check out the top 2 'Awareness' materials on their cyberexchange website: http://cyberexchange.isc2.org/download.aspx

Longer custom essays may also contain an introductory page in which words and phrases from the title are tightly defined. Most academic institutions will require that all substantial facts, quotations, and other supporting material used in an essay be referenced in a bibliography or works cited page at the end of the text.
One

Very useful - thanks for the link Gary.

2009-09-15T20:22:16.484+12:00

Very useful - thanks for the link Gary.

Good post Gary, and very timely. Thanks & kee...

2009-08-09T19:34:01.080+12:00

Good post Gary, and very timely. Thanks & keep up the marvelous work!

Some one break the IR computers? Surely not.. Let&...

2009-08-09T19:32:21.206+12:00

Some one break the IR computers? Surely not.. Let's just throw out the chaff that it must be people careless with their passwords.

It doesn't surprise me that many people would just throw a letter from the Tax office straight in the bin - after all how often do we get a "you've paid too much tax, here's a refund" type letter?

That's an excellent point, AH. I presume that...

2009-07-05T22:43:48.104+12:00

That's an excellent point, AH. I presume that during BC or IT DR testing, most organizations are entirely focused on the A part of CIA (confidentiality, integrity, availability), completely overlooking the rest. They should at least have placed an explicit contractual requirement on the BC/DR suppliers to maintain the confidentiality of their data securely erasing the data (or chainsawing

In numerous years of doing Business Continuity wor...

2009-07-05T20:54:57.835+12:00

In numerous years of doing Business Continuity work we regularly came across kit that had been loaned out to clients coming back with data on them.
Only once did this not happen. Some servers went to a 'sensitive' Govt. department.
The servers came back, along with a box containing the chainsawed hard disks. Plus new disks they had kindly bought to replace the 'deleted'

I'm intrigued, Scott: what's a workflow-ba...

2009-06-26T06:01:09.667+12:00

I'm intrigued, Scott: what's a workflow-based risk assessment?

G.

So true. I also use the approach of the risk works...

2009-06-25T23:15:14.842+12:00

So true. I also use the approach of the risk workshop. At the management level you can use the standards as a guide for discussion to generate more specific wordings for an organization.

I've also developed an approach which I call a "workflow-based risk assessment process". It can be delivered to smaller functional groups to lead them through their own information

While I agree with the general thrust of your comm...

2009-06-09T09:08:41.463+12:00

While I agree with the general thrust of your comment, Leigh Ann, I'm personally a bit dubious about focusing too much on security awareness as a project since, once established, the awareness program should ideally be integrated into the fabric of the organization, becoming a routine part of business as usual. Your comments apply in the main to an awareness implementation

A very informative post. A information security a...

2009-06-09T00:59:34.807+12:00

A very informative post.

A information security awareness program must be planned like any other major project in your organization. Behavioural change is not easy and requires continuous reinforcement. You need to create a project, assign a project manager, and recognize a project champion. Creating a project includes defining business objectives and scope (what’s included and what’

Great post, Gary. Thanks for the notice about the ...

2009-03-30T06:15:00.000+13:00

Great post, Gary. Thanks for the notice about the new NIST pub. It's good to see your take on it. Sounds like you're sort of endorsing it, but have some concerns. I'll also have a more detailed look.

In the end, I don't know if we'll ever really resolve the debate about awareness vs. training vs. education. But whether it's edutainment, awareness, training or making good risk decisions,

Hi Alex.

I feel governance is more than jus...

2009-01-05T08:51:00.000+13:00

Hi Alex.

I feel governance is more than just measurement/enforcement of corporate ethics: at a practrical level, it's also about management putting in place the reporting structures, processes, policies etc. in order to (a) better control what the organization's employees are doing, and (b) keep themselves well informed about what's actually going on. But I agree that crappy ethics

Depends, right?

Governance is only the me...

2009-01-05T07:50:00.000+13:00

Depends, right?

Governance is only the measurement (and enforcement?) of corporate ethics. You could then have great governance of crappy ethics....

I just recieved the same e-mail but I have to pay ...

2009-01-03T18:06:00.000+13:00

I just recieved the same e-mail but I have to pay $200 USD for my $800,000 !!
How do you rate getting out of the extra $50. :( LOL
AMB

Oh dear. If it's too late and you've alre...

2008-12-24T02:14:00.000+13:00

Oh dear. If it's too late and you've already fallen for this scam, fear not because the UN in West Africa is just dying to compensate you:

" SIR/MADAM,

This is to bring to your notice that we are delegated from the UNITED
NATIONS in Central Bank to pay 50 victims of scam $500,000 USD (five Hundred
Thousand Dollars) each.. You are listed and approved

And then she asked for $1100 for insurance she nee...

2008-12-23T17:34:00.000+13:00

And then she asked for $1100 for insurance she needed before sh could have gotten the Visa she claimed to have. She's innocent enough not to use the ticket price as the hook.

NBlog - the NoticeBored blog

I agree that password length is the key against br...

Err - this blog! :) IBM Institute for Advanced sec...

PPS If anyone doubts the value of this standard, ...

PS I will be submitting the 'finished' li...

They explained what happened and apologized. What ...

Good article! Thanks a lot for sharing such a nice...

Thank you gentlemen. Sorry for my lack of respons...

While the original model was posted some time ago,...

I think the ISC2 is also confused re awareness vs ...

Very useful - thanks for the link Gary.

Good post Gary, and very timely. Thanks & kee...

Some one break the IR computers? Surely not.. Let&...

That's an excellent point, AH. I presume that...

In numerous years of doing Business Continuity wor...

I'm intrigued, Scott: what's a workflow-ba...

So true. I also use the approach of the risk works...

While I agree with the general thrust of your comm...

A very informative post. A information security a...

Great post, Gary. Thanks for the notice about the ...

Hi Alex.I feel governance is more than jus...

Depends, right? Governance is only the me...

I just recieved the same e-mail but I have to pay ...

Oh dear. If it's too late and you've alre...

And then she asked for $1100 for insurance she nee...

Hi Alex.

I feel governance is more than jus...

Depends, right?

Governance is only the me...