Information Security Blog

Airport (in)Security = no Information Assurance

During a recent business trip to Phoenix I had an interesting interaction with the Transportation Security Administration (TSA). The lines were unusually slow going through the security checkpoint. When we got to the checkpoint the cause was easily deduced – a bunch of TSA agents were trying to figure out how to turn back on one of the x-ray machines that another TSA person had turned off while troubleshooting a problem. One observation of concern was the obvious lack of training/knowledge of the system that the vast majority of the folks had. From a security line over I could see they were not turning up the main power switch. Another interesting observation was that on boot up the familiar Windows XP emblem waived on the screen.

As a security professional I must confess to being a bit disappointed that such a critical piece of air security is running on a desktop OS, especially, one with a dubious record for security. One of the TSA agents overheard my OS derogatory comment to my travelling companion and laughed, ‘I know XP … I couldn’t believe it either’. It’s what happens when you buy from the lowest bidder”.

On the plane ride home I pondered his comment. I think he was half right. The problem isn’t necessarily that they bought from the lowest bidder – more likely it is that they failed to perform an appropriate level of requirements definition. A simple requirement (inserted into the RFP) such as “The application needs to run on a server level Operating System (or a 64 bit Operating System) for the highest possible levels of availability (or performance) would likely have been sufficient to preclude ending up with an XP based system.

Does your team have any purchases planned where insufficient requirements definition may result in the acquisition of a sub-optimal solution? One where Information Assurance and Information Security are critical. Based on 10 years of auditing experience I’m betting the answer is yes. :>)

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.

Is ISO 27001 Right for (Y)our Organization?

Thinking about ISO 27001 Certification? View our free On-Demand ISO 27001 Webinar

How to deal with increasing threats
How to manage multiple regulatory requirements
How to handle client requests for attestation
To validate that significant changes did not have unanticipated results

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Download: Information Security Attestation Guide

A Best-Practices Guide to Information Security Attestation

Download our proven Information Security Guide to simplify the process of protecting your data, proving you’re secure and growing your business.

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

Simplify compliance monitoring/reporting
Vastly improve Incident Detection & Incident Response
Contextualize event information with other business relevant information

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.