The ISM-Community

Security Dashboards / Performance Management Project

mcurphey — Fri, 04 May 2007 12:27:42 GMT

Rob Kroneman contacted me about starting a project related to dashboarding and performance management.

While it gets going it sensible to start it under another focus area, namely this one.

The idea of the project is to;

Capture and Document Ideas on What a Security Dashboard Should and Could Display
Collect Existing Dashboard Designs
Create a Few Reference Dashboards Based on Findings

So over to Rob. You now have write access to the file store.

Anyone want to share some dashboard screen captures and commentary?

Google Hacking Operators

halon73 — Tue, 17 Jul 2007 15:51:49 GMT

Well it's been a while since I have posted anything to this forum. I've been working and working and that is no exscuss but a buddy of mine sent this to me and I wanted to get it out to the group. Feel free to ammend as you like!

Operator	Operator Description
cache:	If you include other words in the query, Google will highlight those words within the cached document. For instance, [cache:www.google.com web] will show the cached content with the word "web" highlighted. This functionality is also accessible by clicking on the "Cached" link on Google's main results page. The query [cache:] will show the version of the web page that Google has in its cache. For instance, [cache:www.google.com] will show Google's cache of the Google homepage. Note there can be no space between the "cache:" and the web page url.
link:	The query [link:] will list webpages that have links to the specified webpage. For instance, [link:www.google.com] will list webpages that have links pointing to the Google homepage. Note there can be no space between the "link:" and the web page url. This functionality is also accessible from the Advanced Search page, under Page Specific Search > Links.
related:	The query [related:] will list web pages that are "similar" to a specified web page. For instance, [related:www.google.com] will list web pages that are similar to the Google homepage. Note there can be no space between the "related:" and the web page url. This functionality is also accessible by clicking on the "Similar Pages" link on Google's main results page, and from the Advanced Search page, under Page Specific Search > Similar.
info:	The query [info:] will present some information that Google has about that web page. For instance, [info:www.google.com] will show information about the Google homepage. Note there can be no space between the "info:" and the web page url. This functionality is also accessible by typing the web page url directly into a Google search box.
define:	The query [define:] will provide a definition of the words you enter after it, gathered from various online sources. The definition will be for the entire phrase entered (i.e., it will include all the words in the exact order you typed them).
stocks:	If you begin a query with the [stocks:] operator, Google will treat the rest of the query terms as stock ticker symbols, and will link to a page showing stock information for those symbols. For instance, [stocks: intc yhoo] will show information about Intel and Yahoo. (Note you must type the ticker symbols, not the company name.) This functionality is also available if you search just on the stock symbols (e.g. [ intc yhoo ]) and then click on the "Show stock quotes" link on the results page.
NOTE	Pay attention to preferences before you start, remove “safesearch” filtering to see true results
.	Use a period between words instead of a blank space (same as using “Mr Hankey”
+	force the inclusion of the word that follows, same as AND function, no space (+and justice for +all). Google automatically drops common words such as and, or, all, etc
-	excludes a word from a search, same as NOT function, no space (bird feeders –crows)
\|	Google to locate either one term or another, same as OR function (intext:username \| userid \| user)
“”	Use “ “ to search for exact string (“mr. Hankey”), can also use mr.hankey Google is not case sensitive
hl	URL syntax - language which the results page will be printed (hl=en) English, stays in preferences unless you change it
q	URL syntax – query to be submitted (q=”I hack stuff”)
lr	URL syntax – language restrict, only displays pages written in this language
as_qdr	URL syntax – locates pages updated within specified time frame, m3 equals 3 months, y equals past year (as_qdr=m6)
as_dt	include or exclude searches from the domain specified by as_sitesearch i equals include, e equals exclude (as_dt=i)
as_sitesearch	include or exclude this domain per as_dt (as_sitesearch=cnn.com)
intitle	query will return pages that have the word “Google” in page title(HTML TITLE TAG), (intitle:Google, intitle:”index of” private, intitle:”index of” “backup files”) Note: only the first value after the colon is considered “intitle”, other values could be found anywhere in the pageIf you include [intitle:] in your query, Google will restrict the results to documents containing that word in the title. For instance, [intitle:google search] will return documents that mention the word "google" in their title, and mention the word "search" anywhere in the document (title or no). Note there can be no space between the "intitle:" and the following word. Putting [intitle:] in front of every word in your query is equivalent to putting [allintitle:] at the front of your query: [intitle:google intitle:search] is the same as [allintitle: google search].
Allintitle	Same as intitle above except all values must be included in the title (allintitle:”index of” “backup files” “trunk monkey”) – does not work very will with other commands
Allintext	same as allintitle except searches page text, same rules as above
Inurl	If you include [inurl:] in your query, Google will restrict the results to documents containing that word in the url. For instance, [inurl:google search] will return documents that mention the word "google" in their url, and mention the word "search" anywhere in the document (url or no). Note there can be no space between the "inurl:" and the following word. Putting "inurl:" in front of every word in your query is equivalent to putting "allinurl:" at the front of your query: [inurl:google inurl:search] is the same as [allinurl: google search].
Allinurl	same as allintitle but searches URL’sSite searches for pages on a specific server or domain. Note: Google reads server names from Right to Left (site:apple.com, site:store.apple.com) site:store.apple is wrong – no “.apple” domain exists – Google reads right to left If you start a query with [allinurl:], Google will restrict the results to those with all of the query words in the url. For instance, [allinurl: google search] will return only documents that have both "google" and "search" in the url. Note that [allinurl:] works on words, not url components. In particular, it ignores punctuation. Thus, [allinurl: foo/bar] will restrict the results to page with the words "foo" and "bar" in the url, but won't require that they be separated by a slash within that url, that they be adjacent, or that they be in that particular word order. There is currently no way to enforce these constraints. This functionality is also available through Advanced Search page, under Advanced Web Search > Occurrences.
Filetype	searches for a specific file type such as PDF, doc, ppt, etc (filetype:xls) try http://filext.com/ for ideas. Google converts everything to HTML or text for viewing.
Link	search for pages that link to other pages (link:www.cnn.com) lists all pages that link to www.cnn.com. Only searches URL’s available to browser or URL’s found in source code
Inanchor	searches text representation (html anchor) of a link (inanchor:click, inanchor:”current page” or inanchor:current.page)
Cache	searches cached pages only (cache:blackhat.org or cache:http://www.flxracing.com). This command cannot be used with other commandsNumrange used to find a number within a range, need to supply a minimum and max number. To find 12345 (numrange:12344-12346, can also try 12344..12346 (two periods) or ext:12344-12346)
Daterange	locates pages based on date of last index by google. Must use Julian dates (daterange:2452164-2452164 would be 9/11/01. Much easier to use as_qdr function. Try http://aa.usno.navy.mil/data/docs/JulianDate.html for conversion
Info	shows summary information for a site such as link to, similar to, sort of a general info search. (info:www.csc.com). Cannot be used with other operators
Related	lists sites that are related to a site, same as “similar pages” link. (related:www.securityfocus.com). Cannot be used with other operators
Author	search for the author of a newsgroup post using name or email address. (author:jonny.long, author:sam@walmart.com)
Group	search title of google groups posts for search terms, wildcard “” works well. (group:.forsale, or group:windows)
Insubject	same as intitle operator. (insubject:dragon is the same as intitle:dragon)
Msgid	searches google groups by message id in the format xxx@yyy.com. (msgid:123998hsdf8@4ax.com) Cannot be used with other operators
Stocks	search for stock market info about a particular company based on ticker symbol. (stocks:xom). Cannot be used with other operators
Define	returns definitions for a search term. (define:ironic). Cannot be used with other operators
Phonebook	searches for business and residential phone listings. Rphonebook = residential, bphonebook = business or Phonebook = both. Every word listed after the operator is included in the operator search (phonebook:George Bush dc)
Go Anon	View cached pages to stay anonymous, watch out as you may lose anonymity when it loads any image files such as .gif, etc as it may pull it directly from the original server directly to your machine.

New Glossary Term: Corrective Controls

ebreece — Mon, 07 May 2007 18:05:15 GMT

Corrective Controls: A control designed to mitigate the severity or impact of risk related to errors, omissions, and inconsistencies

Example 1: Checking a date field for a known date format.

Example 2: The conversion of data entered into a date field from a known date format to a consistent date format.

Creation of a standard Privacy Policy

klo — Sat, 05 May 2007 17:24:00 GMT

A call for volunteers!

If you would like to volunteer to help please post to this thread. Of course it goes without saying that if any company would like to donate their privacy policy or anyone has anything which would make a solid base then please contact me. We can make sure there is nothing sensitive and all identifying data is stripped out before they are placed online.

New Glossary Term: Vulnerability

mcurphey — Thu, 10 May 2007 14:02:00 GMT

Vulnerability: A flaw or weakness in system security procedures, design, implementation, or internal controls that could be exercised (accidentally triggered or intentionally exploited) and result in a security breach or a violation of the system's security policy.

Example: A SQL Injection vulnerability exists in the PHP Nuke application

Example; Mac's are also susceptible to vulnerabilities don't you know ;-)

Hacking Festival! CODEGATE2009

hahoje — Thu, 02 Apr 2009 04:33:13 GMT

CODEGATE 2009 To strengthen the national power and train security specialists with the trend 'Future war is information war',

CODEGATE is consist of the yearly seminar by world best security specialists, authorities and scholars, the hacking competition-the brain war by hackers from all over the world-, the defense skill contest with new ideas to broaden the world of computer security and the exhibition of famous IT and security enterprises.

We are proud that CODEGATE is the first stone for raising world best security specialist, sharing security technique and knowledge and developing IT industry. We are promising more innovative and newer CODEGATE 2009.

Hacking Festival

* Preliminary: Mar 6 ~ 8 2009

* Final: Apr 7~ 8 2009 International Security Conference

* Apr 8 2009 * COEX Grand volume 101 ~ 105 Defense Skill Contest

* 1st registration: Feb 1 ~ Mar 18 2009 * 2nd registration: Mar 25 ~ 29 2009

* presentation: Apr 7 2009 * COEX ASEM hall 203 Job event of reliable IT enterprise

* Apr 8 2009

* COEX Grand volume Lobby IT exhibition

* Apr 8 2009

* COEX Grand volume Lobby

http://www.codegate.org/Eng

Before Risk Assessment?

sriramrox — Sat, 21 Nov 2009 20:12:41 GMT

Can anyone help me in knowing these?

1) What do you mean by baseline approach?

2) How can you Justify that Risk assessment is better than baseline approach for any type of organization?

3) How can you prove that qualitative risk assessment is better approach than quantitative for a particular organisation?

4) Definition of scope and Risk Assessment in terms of ISO 27001 ?

Please help

Roll out of Security Policies

MIKE S — Thu, 18 Oct 2007 08:19:49 GMT

I have, over recent months, been developing a suite of security polices for my organisation. To date the high level Corporate Security Policy and the Acceptable Use Policy hav been disseminated to all staff.

However, with regards to the other more specific policies e.g. Data Back-Up Policy, Portable Devices Security Policy etc., I would be keen to know what members think is the best way to roll these polices out to users, as I really do not want to suddenly "dump" another 8 or 9 policies onto staff, as it would make them totally ineffective.

I would welcome any view, perhaps from personal experience.

ISO Standards - Whats the Future?

mcurphey — Wed, 06 Jun 2007 09:30:05 GMT

30 mins of Googling and I am having a bad hair day. I am looking for a press release or roadmap of ISO security standards. Can anyone post a URL here?

Did You Know???

rybolov — Wed, 15 Aug 2007 00:12:22 GMT

That there is a link on the right-hand side of the forums to subscribe to specific forums? Here, I'll give it to you again. =)

Now if you click on the link, you can get to a dialog where you can subscribe to your favorite forums. That way, when somebody posts something on the forum, you get an email with the text of what they said.

We're working on getting the reverse working (send an email and it ends up on the forum), but it's been beating us up trying to get it going.

Long Security Tail

mcurphey — Wed, 27 Jun 2007 17:17:22 GMT

What a great post...simple, obvious and compelling.

http://www.guerilla-ciso.com/archives/177

When I used to work for a large financial services company in the bay area we used to be bombarded with BS ROI models. I saw a few created by sales guys at a large software vendors worked at as well.

Few people in the world are in the business of being secure and far fewer have yet worked out (or had the opportunity) to use security as a competitive differential so traditional economic models just don't translate.

Mapping Regulatory Requirements

dmarkiewicz — Thu, 12 Jul 2007 14:00:58 GMT

In ISMv1.0 there was a project for mapping varying federal and/or international regulations. Is that still a project somewhere?

What RA method is "good enough" for the GLBA examiners?

mcurphey — Mon, 23 Jul 2007 16:54:29 GMT

http://news.google.com/news/url?sa=T&ct=us/1-0&fd=R&url=http://www.pr.com/press-release/46019&cid=0&ei=n9qkRoOaN4P20QGjpcnvCg

I read this with interest and have to ask myself, what RA methodology is "good enough"?

Canadian Privacy Legislation

dmarkiewicz — Wed, 18 Jul 2007 15:15:52 GMT

Curious if anyone has experience with the Personal Information Protection and Electronic Documents Act enacted in Canada. Part 6 documents MODEL CODE FOR THE PROTECTION OF PERSONAL INFORMATION, CAN/CSA-Q830-96. Is this considered part of the actual law, an implementation standard much like the Privacy Rule is to HIPAA in the US or is this more of guiding principles similar to what the Federal Trade Commission would publish in the US? I was specifically looking at data sanitization and disposal requirements. Part 6 contains provisions but I don't see anything elsewhere in the legislation.

Here's the link to what I'm looking at:

http://laws.justice.gc.ca/en/P-8.6/text.html

ISO 27031 - New BCP Standard

mcurphey — Wed, 18 Jul 2007 14:59:10 GMT

Just thought I would post this. I am sure most have noticed it already but just in case. Anyone read it, contributed to it or have any good insight to share?

http://news.google.com/news/url?sa=T&ct=us/2-0&fd=R&url=http://compliancehome.com/news/ISO-17799/11052.html&cid=0&ei=KSmeRrTQLIK40QGcma2HAQ

The value of a SAS/70

dmarkiewicz — Wed, 11 Jul 2007 12:46:56 GMT

I've seen many situations where a company has blindly accepted a SAS70 as their only measure of control in managing risk associated with third-party services providers. It always makes me cringe. I ran across is again this week so I thought I'd generate some discussion. From the standpoint of risk management, is there any value in a SAS70? In its current form, has the SAS70 audit outlived its usefulness?

I see a couple problems with a SAS70. There's no guarantee that a SAS70 includes anything related to security or privacy controls. From my experience, even when they do, the controls are vague not comprehensive. Secondly, SAS70 audits are performed by accountants and there's no guarantee that the accountant is properly trained to validate whatever technical controls he's validating.

Policies and Standards Conference Call (Skype) This Saturday

mcurphey — Fri, 13 Jul 2007 08:19:59 GMT

A few of us will be having a conference call on Saturday to discuss how to get going with a Policies and Standards project at ISM Community. In fact Ciske Van Oosten has already done a lot of work that can be reused which you can see on his blog http://infosec-risk.blogspot.com/. The idea is to build a guide to creating good policies and standards and then a repository of well written and useful documents. We already have some donations from companies.

Please feel free to join us if you have any interest in this project. A voice call should make it easier to get kicked off. You will be able to Skype in for free or dial in from a regular phone.

Saturday July 14th, 2007

3pm GMT (8am EST)

From Skype: call to be a participant
Skype number:+99008275666088

From a regular phone...

Calling from the US call # 1-605-475-8500
(long distance costs apply).

International, call:
    Austria         0820 4000 1572
    Belgium        070 35 9987
    France         0826 100 275
    Germany      01805 00 7646
    Ireland          0818 270 032
    Italy              0848 390 172
    Netherlands        0870 001 931
    Spain           0902 886 048
    Switzerland   0848 560 152
    UK                0870 738 0760
The conference is free but national rate charges will apply to these calls.

Your Conference Room Number is : 5666088

Volunteers for Translating the ISM Community Top Ten

mcurphey — Fri, 18 May 2007 12:06:02 GMT

Any volunteers for translating the ISM Top Ten into non-English languages?

Periodic Phone Conferences

rybolov — Sat, 23 Jun 2007 15:58:29 GMT

Hello

I'm trying to gauge interest in holding periodic phone conferences. Think something along the lines of a quarterly shareholder's call where we discuss the status of Risk Management projects, focus the focus area, and associate names with voices.

What I would like to know are the following:

Do you see value in such an activity?
What frequency would you like to see (monthly, quarterly, semi-annually)?
What part of the world do you live in (determines call times)?
Would you be willing to skype in or dial long-distance for a phone call (1-800 numbers can get pricey)?

Cheers
--Mike

Whole Security Solutions

mcurphey — Sun, 01 Jul 2007 18:38:43 GMT

I have been on a rant recently about whole solutions versus point solutions. I think there is a real movement of people stopping trying to find the elusive silver bullet or widget or the next best thing and start to put things together that solve a complete problem. I say a movement as I see this coming from corp security folks and not product vendors. Am I alone?

ISM Community Chapters and Security Linkup

mcurphey — Tue, 03 Jul 2007 09:47:42 GMT

We built Security Linkup (www.securitylinkup.com) primarlily for the ISM Community. It is still in beta and has quite a few bugs but with your help we can iron them out and make it as usable as possible as quickly as possible. There is a code drop happening this weekend for Beta 0.3.

I have setup this forum to serve as a support forum for anyone wanting to start an ISM Chapter anywhere in the world.

Please use Security Linkup and post here is you have any issues, want to ask any question or need help in anyway.

This Weeks ISM Poll

mcurphey — Sun, 01 Jul 2007 20:01:59 GMT

[Poll]

What Would You Like to See on ISM-Community?

rybolov — Sat, 30 Jun 2007 16:43:13 GMT

Just a completely open question out there for the world at large. What else would you like to see from ISM-Community that you think is missing?

Cheers

--Mike

Going with Creative Commons

rybolov — Thu, 28 Jun 2007 20:44:02 GMT

We decided to release all of the ISM-Community products under the Creative Commons Attribution 3.0 license. Before, we had stated that we were using the FreeBSD Documentation License. We changed licenses based on the following considerations:

FreeBSD Documentation License and CC Attribution license are fairly comparable
FreeBSD Documentation License is "owned" by the FreeBSD Project and would need to be "forked" to become an ISM-Community License
While forking the FDL is fairly simple, ISM-Community is not that keen to take up license maintenance on top of all the other projects we have going
Creative Commons has a plethora of materials describing your rights so we don't have to =)

Where this matters to anybody who is involved is that when you submit anything to be an ISM-Community project, you're agreeing to license it under the CC Attribution V3.0 License.

This is my snippet of words for in-document usage, I'll upload a file with just this in a couple of jiffies:

Copyright and License

This work is licensed under the Creative Commons Attribution 3.0 License.

You are free:

· to Share — to copy, distribute and transmit the work

· to Remix — to adapt the work

Under the following conditions:

· Attribution. You must attribute the work in the manner specified by the author or licensor (but not in any way that suggests that they endorse you or your use of the work).

For any reuse or distribution, you must make clear to others the license terms of this work.

Any of the above conditions can be waived if you get permission from the copyright holder.

Nothing in this license impairs or restricts the author's moral rights.

To view a the full legal version of this license, please visit http://creativecommons.org/licenses/by/3.0/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA.

Non-Security Skills Need

rybolov — Thu, 28 Jun 2007 02:46:10 GMT

Hello All

To start off this forum, I would like to put out a call for those community members who have an excess of "soft skills". Now granted I'm 4 credits away from a liberal arts degree, but this doesn't mean that I'm an expert at PR. I just spent the evening writing a press release for the ISM-Community Top Ten, and I figured out one thing throughout the course of this exercise: geeks suck at hyperbole, security geeks even more so. =)

At any rate, I'm looking for people who would like to help out with some of the non-security functions of ISM-Community such as the following:

Writing press releases
Serving as media contacts (fielding calls, answering questions)
Technical writing
Proofreading
Document control and release management
Graphic design

Just send me a private message with what you can do and I'll add you to my "skills bench" to call on when we need the help. It might be a couple of months before you hear from me, or it might be within the hour.

Thanks Much

--Mike