weihuijuan.com

cwsandbox.org

Understanding IT Risk Management | The Sandbox

http://cwsandbox.org/understanding-it-risk-management

Understanding IT Risk Management. Firstly, we need to understand that Information is an asset that, like other important business assets, has value to an organization and therefore needs to be suitably protected. We need to ensure that information is accessible only to those authorized to have access, that we safeguard the accuracy and completeness of information, and that we ensure that authorized users have access to that information when required. The following figure (from ISO/IEC 15408, “Commo...

cwsandbox.org

Continuous Monitoring – A Critical Aspect of Risk Management | The Sandbox

http://cwsandbox.org/continuous-monitoring-a-critical-aspect-of-risk-management

Continuous Monitoring A Critical Aspect of Risk Management. Continuous Monitoring A Critical Aspect of Risk Management. The National Institute of Standards and Technology (NIST) first described continuous monitoring as a critical component of its Risk Management Framework, when in its Special Publication 800-37 Rev 1, Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach it advised agencies to put in place the following elements:. Security Status ...

cwsandbox.org

Top Hacker Secrets shared at DefCon | The Sandbox

http://cwsandbox.org/top-hacker-secrets-shared-at-defcon

Top Hacker Secrets shared at DefCon. The DEF CON conference, a meeting ground for hackers and those who want to learn what they are up to, was held last week in Vegas. There were some interesting topics and tips for cyber security I thought you might be interested in. So here is the abbreviated highlight reel. In the same category, make sure you have strong passwords on ALL your mobile devices. Don’t send passwords “in the clear,” make sure they are encrypted. Your hotel key card can be scanned by touch,...

cwsandbox.org

Project Honey Pot Success | The Sandbox

http://cwsandbox.org/project-honey-pot-success

Project Honey Pot Success. To celebrate this milestone, Project Honey Pot which came into existence in 2004, sifted through their collected data to learn more about spam and spammers who send it. Some highlights:. Monday is the busiest day of the week for email spam, Saturday is the quietest. 12:00 (GMT) is the busiest hour of the day for spam, 23:00 (GMT) is the quietest. Malicious bots have increased at a compound annual growth rate (CAGR) of 378% since Project Honey Pot started. AGRA, VIA6RA, etc.).

cwsandbox.org

Humans are the weakest link in Cyber Security | The Sandbox

http://cwsandbox.org/humans-are-the-weakest-link-in-cyber-security

Humans are the weakest link in Cyber Security. Humans the weakest link in cyber security. Details emerged about the notorious break-in at security firm RSA that resulted in the compromise of their SecureID two-factor authentication product and cost parent company EMC a reported $66 million. When the attached Excel file was opened an embedded Flash object was executed which then exploited Adobe’s vulnerability to drop a Poison Ivy backdoor to the system. Poison Ivy back door* is a remote adminis...The fil...

cwsandbox.org

Understanding The Sandbox Concept of Malware Identification | The Sandbox

http://cwsandbox.org/understand-the-sandbox-concept-of-malware-identification

Understanding The Sandbox Concept of Malware Identification. We need to get some definitions out of the way so we all know what we are talking about. WHAT IS A SANDBOX:. WHAT IS VIRTUALIZATION and VIRTUAL MACHINES / VIRTUAL WORLD:. Virtualization provides a separate environment within a computer that can function independently from all other environments on the computer. One virtual container cannot change or modify another virtual container. WHAT IS A HONEYPOT? In order for malware to be caught, classif...

cwsandbox.org

U.S. Critical Infrastructure Ripe for Attack | The Sandbox

http://cwsandbox.org/u-s-critical-infrastructure-ripe-for-attack

US Critical Infrastructure Ripe for Attack. The Enterprise Strategy Group (ESG), a leading IT analyst, consulting, and research organization, has conducted a research project to assess whether organizations categorized by the U.S. Department of Homeland Security (DHS) as Critical Infrastructure and Key Resources (CIKR) were vulnerable to security attacks due to weaknesses in cyber supply chain security. The frightening implication here is that many CIKR organizations may already be compromised. Critical ...

cwsandbox.org

Advanced Threats are source of major breaches | The Sandbox

http://cwsandbox.org/advanced-threats-are-source-of-major-breaches

Advanced Threats are source of major breaches. Cisco recently released their Cisco 2Q11 Global Threat Report which provided data on the breaches and risks occurring across the world. For me, it reinforced the mantra that companies are suffering and putting themselves at risk because they don’t know what they don’t know. Some of these capabilities include:. Some form of deep packet inspection that covers all the important choke points on your network. Development of trust-based relationships with other or...

cwsandbox.org

Out of the Loop Execs put Security at Risk | The Sandbox

http://cwsandbox.org/out-of-the-loop-execs-put-security-at-risk

Out of the Loop Execs put Security at Risk. A recent McAfee report states that only 22 percent of data center managers felt senior management is aware of their respective organization’s security measures and risk preparedness. The key findings of the 2011 Data Center Security Survey, conducted by Gabriel Consulting Group (GCG) on behalf of McAfee, essentially says management is ripe to be blindsided by a security breach according to Dan Olds, Principal Analyst at GCG. Respondents said that their manageme...

cwsandbox.org

Top Security Predictions for Coming Years | The Sandbox

http://cwsandbox.org/top-security-predictions-for-coming-years

Top Security Predictions for Coming Years. It’s that time of year again when we go through the security predictions for 2012 from the leading prognosticators and the wannabes. So until St. Nick comes, enjoy the Top lists we’ve compiled from M86, Websense, SecurEnvoy, CSO, the folks at SANS and others. You’ll get a different Top list in the next few blogs until Christmas. Targeted attacks grow more damaging and complex. Illicit social media scams escalate. Social media identity theft. We’ve already ...