Commons Blog

Mailing Lists Coming to ISM-Community.org

mcurphey — Wed, 27 Jun 2007 17:38:14 GMT

You might well notice some changes on the home page today. The portal hasn't really had much TLC for a while and its been hard to find things and participate. That is changing. Today I installed the enterprise email gateway. This allows you to subscribe to a forum as if it were a mailing list. In fact its the best of both worlds, its both a mailing list and a forum. You can start, receive and reply to discussions using email or online via the web site and even both at the same time. It's your choice. We are having some configuration challenges with receiving and processing mail so the upgrade is not complete but you can subscribe to receive new threads via email for the Risk Management forum now and within a few days I am sure well have it all ironed out. As soon as we have this major upgrade completed I will send out an email and we enable it on all the forums.

http://www.ism-community.org/forums/ForumSubscriptions.aspx

ISM-Community Combined Feed

rybolov — Sat, 23 Jun 2007 00:30:00 GMT

With some coaching and Yahoo! Pipes non-wizardry (it's CISO-proof, all drag-n-drop programming), I have thrown together a combined blog feed that contains the feed for the "official" ISM-Community blog feeds plus the personal/work/$foo blogs from community members. If you feel slighted that I didn't include your feed, please don't send me poison-pen email letters, just drop me a nice email and I'll add you in. =) I know there are people that I missed, but I'm trying to add them as I can.

The combined blog feed is linked to from here. It's not necessarily all ISM-Related (I go off about zombies and flyfishing from time to time, Curphey talks about the varieties of grapes in his vineyard, etc) so there might be some noise that you're not so keen on.

The "official feed is linked to from here. This is a feed from the 5 focus areas and hardly has any noise at all.

Cheers
--Mike

It's all About Semantics

mcurphey — Thu, 10 May 2007 14:18:32 GMT

As you can see from the rolling titles on the front page of the ISM Community just getting agreement on simple terminology is not as simple as it could be. Thanks to some great contributions from ebreece, jason and dave we are starting to roll.

I have added a definition block to the Glossary working document that looks like this and when we are happy with the first set of definitions I will add them.

Title

Authentication

Definition

The process of determining whether someone or something is, in fact, who or what it has declared itself to be.

Examples

User KLO is authenticated as she was able to provide her secret pass code.

I checked the dollar bill to authenticate that is was indeed real.

References

Insert them here

Notes

Insert them here

ISM Community Discussion URL

http://www.ism-community.org/forums/t/542.aspx

As always if anyone would like to volunteer to own updating the glossary and can commit to doing so in a regular basis please drop myself or Paul Zedeck an email.

Welcome to the Commons Project Blog

mcurphey — Tue, 01 May 2007 09:29:19 GMT

Welcome to the Commons Focus Area. I plan to blog post here weekly with news of progress for those that don't want to delve into the forums / mailing lists. You can subscribe to these updates via RSS at the side bar.

The first project I want to start is an Information Security Glossary. Why you may well ask? There are a million of the things there like NIST surely? Yes and yes! There are many glossaries and some are OK but not one I have found is good for the majority of cases. NIST is very US government centric, others quite frankly confuse the hell out of me and some are just plain old wrong. I think nomenclature does matter and its essential that all of our projects can reference a common source of definitions. Just yesterday I witnessed a dozen mailing to the Security Metrics mailing list debating definitions for Threats and Vulnerabilities.

Paul Zedeck has made a start by compiling various terms into a spreadsheet that I will be posting in the files area shortly. I will maintain a Word document and add to it gradually. I think the strategy should be to focus on quality definitions and not quantity.

If you are interested in helping, please email me or join the mailing list / discussion forum.