The InfoSec Blog

http://blogs.zdnet.com/security/?p=3809&tag=nl.e539

Oh, the ignominy!

On their way to search for clean IPs through which to send out yet another scam email, 419 con-artists (Mrs Sharon Goetz Massey) have recently started using Dilbert.com’s recommendation feature in an attempt to bypass anti-spam filters — and it works. The use of Dilbert.com’s clean IP reputation comes a month after 419 scammers used the same tactic on NYTimes.com ‘email this’ feature.

One thing in InfoSec is certain: the bad guys will always in a way round whatever controls we put up an find ways to subvert legitimate tools an protocols.

Related articles by Zemanta

• How Are ISPs Changing Their Spam Filters? (b2bemailmarketing.com)
• Scammers target AIB (gita.agiletech.ie)

http://www.darkreading.com/security/management/showArticle.jhtml?articleID=218600434

Well? Are you?

You’d think most professionals in a hot industry like IT security would
feel content and challenged technically and creatively in their jobs –
but not so much. According to the results of a new survey that will go
public next week at Defcon in Las Vegas, half of security pros aren’t
satisfied with their current jobs, and 57 percent say their jobs are
neither challenging nor fully tapping their skills.

Like most reports on survey, this is journalism at it worse. Read the rest of this entry »

When I took my undergraduate Engineering degree the attitude of my professors was that if we had chose engineering as our career then a few things were going on.

First, technology is changing, so teach fundamentals and principles and show how to apply them but don’t get hung up on specific technologies. (Who would have guessed then that the RF theory work on transmission  lines would have an impact on writing software for PCB layout and even chip design!)

Second, that if we stayed in engineering, then within three to five years we would have “managerial” responsibilities so we better know about “managerial” things such as budgeting, logistics/supply-chain,
writing proposals and reports.

I mention this to make the point that being a CISSP is not about being a techie-geek. Knowing all there is about crypto, pen testing, or any vendor or product is inherently self limiting. You have put a cap on the authority and influence you have.

To be effective in InfoSec you need to be able to do that “social engineering” – as a recent article says,

“… the application of social science to the solution of social
problems,” he said. “In other words, it’s getting people to do
what you want by using certain sociological principles.”

What you want is for your managers to implement certain strategies that
you believe are for the good of the company and society (see our code of
ethics an associated guidelines). This means you need communication
skills.

I realise many people reading this are in fact managers, but they too have to
report to higher authorities. Some here have MBAs. Management is more than the technical skill of a MBA course – that’s another form of geekiness. (I know of one very good technical guy who saw Dilbert‘s Principle being applied in his firm an went and got a MBA. The trouble is that he never had any ‘people skills’ and the MBA course didn’t supply them!)

So we get back to a parallel thread – “Trust”‘.

Occasionally I run a workshop “Why people don’t follow Policies and what you can do about it”. Its for technical managers, those who have to enforce many policies, not least of all InfoSec ones, and manage those who are carrying out the associated Procedures. Its always a difficult workshop since its about seeing the patterns in behaviour, something technical managers are quite capable of, but have never been taught before.

Its my belief that InfoSec is meaningless unless it deal with the social and psychological issues. Right now we treat the term “social engineering” the way we do “risk”, as something that has *only* a negative meaning. That has to stop. Management don’t see “risk” as being bad and as far as threats go, we know that People are the sourceof them all! First and foremost, InfoSec practitioners need to be able to deal with People. Technology is for geeks. If you want to being
about change you have to deal with people.

“Social Engineering” – in the broadest and positive sense – is every bit as key as any other of the domains of the CBK. Its omission just shows how technology-centred the profession is, despite the threats and despite what needs to be done by practitioners to fulfil their roles.

Related articles by Zemanta

• The One Minute MBA. Get Yours Here. (frontofficebox.com)

No, I don’t think this is a good start.
Its ignores such fundamentals as policy, change management, awareness, management reporting, risk assessment and risk tolerance …

And much like that. Read the rest of this entry »