Denial of Service, explained.

I was reading an article about a denial of service attack against the State of Maine's website that occurred today and read a terrific analogy to describe a denial of service attack that I've ever read.  It was contained in a response to a comment that was questioning whether or not the DOS attack was a data breach...

CISSP Preparation - Let's get started.

Getting started is sometimes one of the toughest parts of preparing for a certification.  That's not to say that there isn't a whole lot of work to be done in preparation once you've started, as that is always true, but if you approach the preparation for a certification exam methodically, this is where decisions have to be made.  There are so many different resources available, so many methods of study.  Websites, podcasts, videos, books, CBTs, practice exams, study groups, etc.  It goes on and on and it is easy to get buried in the weeds.  Add to that hundreds of posts saying "This is how I did it." and you can easily find yourself stuck in a plan that doesn't work for you and the way that your mind works.

I am still mapping out my strategy for attacking this very large body of information, but here are some of the resources that I have already determined that I may be using in some format or another:

Primary Books

• CISSP All-In-One Exam Guide - the massive work by the late Shon Harris and while I have heard that it is not the most enjoyable read, it is still filled with massive amounts of information.
• CISSP Study Guide - This book by Eric Conrad is a shorter, although from all accounts that I have read, easier to read and process, guide for the CISSP exam.  Very solid material.  I think I will be reading this first.

Review Guides

• Eleventh Hour CISSP Study Guide - Also by Eric Conrad, this is a guide for review and is one that I will likely purchase as well.
• (Sunflower) CISSP Summary v 1.1 - A very abbreviated guide for last minute review.

Podcasts & Some Practice Questions

• Shon Harris' Podcasts - The author of the CISSP All-In-One Exam Guide has a group of podcasts going over all of the 10 domains, as well as practice questions.
• Eric Conrad's Podcasts - The author of the CISSP Study Guide and the Eleventh Hour CISSP also has a group of podcasts discussing all of the 10 domains, as well as some practice exams.

Other Stuff

• 100 Questions
• CCCure.org - This is an interesting site with a lot of information.  From study guides and forums, to practice exams and such, I am sure that this will be a useful exam preparation site.
• ISC2 - Well, this one is somewhat obvious.  Here there is information on the exam, including the outline of the exam content, some domain webcasts, buy textbooks and attend training seminars, and finally register for the exam.

There are lots of other resources available, however these are the ones that I believe I will be using primarily.  This of course may change to some degree.  There is also the fact that the exam is changing in April.  I will have to address this when there are materials out there that address this, but in the mean time, there is nothing bad within these current materials, so it is where I am going to start.  

As for any sort of study group, I just don't know how that will work.  I mentioned forming a study group in a localish (2 hours away) ISC2 group on Linked in and the response I got was "people get excited to join a study group, until it's time to go to the study group".  In other words, they fizzle out.  In any case, I live in a somewhat rural area, which makes things tough, so we'll see how it goes.

My idea for a study group is going to be pretty straight forward and non-committal.  Each meeting, we'll address a particular facet of a CBK.  Discuss it, questions that anyone may have or just dig deeper into the meaning and how it is applied within business and IT.  If nobody shows up, I'll just take the time for quiet studying, but it will be scheduled and due to the free flowing nature of the plan, it won't be thrown off if someone shows up one week and not another.  I haven't ruled out the use of something like Google Hangouts for this as well, given that I don't exactly live in a highly populated area.  The beauty of this plan, is that it wouldn't only benefit those who are studying for the CISSP, but also to those who are just security professionals who may want to talk over a particular topic with other security professionals.  We'll see how it goes!  

As always, comments and/or feedback is always welcome.

It's Official

As of last week, I am officially CCNA certified. 

So far for goals on the year, I'm 1 for 2, and the second one being to write in this blog weekly.  It hasn't happened.  I don't know if it will happen.  I'm still learning, growing and adapting into a new position with a new company, but I have plenty to write about, I just have to start doing it.

So, with all of the champagne and fireworks that come with attaining a certification that I have worked hard studying for, I can say that I have passed my CCNA exam.

Next, I am giving myself a slight break with Cisco, to take advantage of the full 3 years I have for my next test and focusing on studying for my CISSP.  It is not only directly related to my current role, but it is a way to grow professionally and hopefully proves to be solid move for my own advancement as well as my budget eventually.  After this, it's my aim to keep my certification active, so I will probably start working towards attaining the CCNA Security certification. 

I also have a development project that I am kind of torn between starting and continuing on with my certification, so that will have to be worked out in my head.  However, I'm not one for waiting around, so until I get the full urge, CISSP prep is where I'm at.

So I will be trying to write to describe my process for learning and studying for the CISSP exam.  I don't want to fail.  My employer will only reimburse if I pass the exam, so I definitely don't want to fail!

On Information Security...

We work in IT.  Security should be inherent in all that we do within IT.  Going a step further, if information security is not considered in everything we do, then we're doing it wrong. 

Here are a few truths that we all have to recognize:

• Your business needs are not static.  They are continuously moving forward.  Your stakeholders have agendas, projects, new hardware and software that they need to deploy and/or update in order to remain competitive as a business.
• Adversaries and attackers that are threats to your information are continuously changing.  The attackers you have right at this moment are not necessarily the same attackers that you will have tomorrow, or even later today.
• The vulnerabilities and attacks are continuously evolving.  If your program is not evolving and improving, then it is falling behind every day.

C.I.A.  No, not that CIA...

Confidentiality, Integrity, Availability

Those are our goals.  That is information security.  However, that is not an effective information security program.   

An effective information security program is one in which the needs of the business are being met and improvement is continuous, measurable and communicated to the stakeholders effectively. 

Security Metrics, A Beginner's Guide

One of my Christmas presents this year was the book, Security Metrics, A Beginner's Guide by Caroline Wong.

I have been looking into expanding our security program and taking a larger role within my organization and I really believe that by incorporating security metrics into our program and my professional growth, that I will be not only able to continue on the path of my own professional growth, but also to improve our security footprint at my organization.

I am still waiting on the book and am expecting it on Monday, so there will likely be more information to follow, but I did watch a great quick talk from Caroline on YouTube, and took some notes that I will be using for my review.  Both a link to the video on YouTube and my notes are below.  Thanks Caroline for all of the information that you have already provided, as well as all that information that I will be able to glean from this book! 

RSA Conference 2011 - Security Metrics:  A Beginner's Guide

 Notes:

Why measure Security Metrics?

•  Limited resources
•  Measure the effectiveness of your information security activities to assure you that you are getting value
•  Measurements, allow to show continuous improvement.
•  GETTING BETTER
•  Outcomes oriented.
•  The question isn’t what are you doing, it’s what have you accomplished.
•  Lends itself to goal setting.
•  Gathered data allows to make better decisions
•  Gathered data allows to justify spend.
•  DON’T COLLECT DATA ON SOMETHING YOU ALREADY KNOW
•  How do you use data to energize people to drive change in their behavior?
• Going beyond the security team, the stakeholders and sponsors. 
• Security Metrics program can help to make sure that other stakeholders have an understanding of what we are trying to accomplish.

How to get started

• To determine, what security metrics should be for my company, examine the environment
• For all organizations, security metrics will likely be specific to that particular organization.
• Compliance
• PCI
• HIPAA
• Tools
• Determine what tools you have already that you can collect metrics from.
• Zero in on targets for improvement.
•   REMEMBER:  There are lots of ways that we can improve, so trying to focus on all of them at once is a sure fire way to not improve meaningfully in any single way.
•  Step 1:  Narrow in on one or two or 3 target areas to focus on
•  SET A BASELINE!
•  If you don’t know where you’re starting, you can’t possibly know how far you’ve come!
•  Step 2:  Set clear goals that you want to accomplish
• If you don’t know where you’re going, it doesn’t matter where you’re starting!
•  Useful Metric for Goals - S.M.A.R.T. Metric System
• Specific
• Measurable
• Actionable
• Reasonable
• Time Based
•  Step 3:  Continuously and consistently measure and report your progress.
•  Checking in with stakeholders
•  Adjusting expectations to make sure they remain reasonable

Choosing the right areas to focus on?  Where do I begin?

•  What’s important to your business?
• Compliance
• PCI, HIPAA, etc.
• Are we in a position to pass the next audit?
•  Risk
• What are our most high profile risk areas?
• How well are they protected?
• How important are they to the business?
• Build metrics to tell this story!
•  Enabling your business!
• What are the critical information assets
•  Who is responsible for managing these assets
•  What is the lifecycle for these assets
•  What’s broken and needs fixing?
•  Process - Process improvements should not be overlooked!!!!  Security is not a checklist!
•  How can we improve our security processes?  How do we improve our IT processes?
•  To assist with this, document our processes.
•  Do all people agree to the same steps.
•  Are they performed consistently?
•  Verify SLAs
• EXAMPLES:
• Exceptions Process
• Vendor Assessment Process
• Vulnerability Management Process
• Business Continuity Assessments
• Technology
•  Security Technology
•  What’s the coverage?
•  Does it work when off the network?
•  Where are the gaps?  Sniff them out.
•  Non-Security Technology
•  Is the data stored adequately protected?
• What is it?
• Where is it?
• Audit Findings
•  Develop metrics around the audit findings
•  What’s basic?  What’s expected?
•  Hot things in the news?
•  Big vulnerabilities?  Thank Hearbleed, Poodle, etc.  Are we able to scan for this vulnerability?  Know your threat footprint and be able to speak about it.
• What’s new?
• What are you developing that are new processes?

 Practical Advice for starting with Security Metrics

•  Fix processes before you automate them.  Don’t automate a broken process!
•  Key messages for specific audiences.  Your stories need to be keyed towards the specific audience for your talk or report.
•  List people you may meet with, and what types of metrics might they be interested in?
•  CFO
•  Might be interested in the justifiction for your security program
•  How many people are on the team?
•  How much are you spending?
•  Benchmark data comparing other industries
• CTO
•  Patch and vulnerability management
• Scanning processes
•  Be EXTREMELY CLEAR with defining your goals.
•  Start reporting immediately.
•  Show the data right away, even if it’s not perfect.
•  Be patient and be purposeful.
•  If you discover that something is wrong, that you didn’t know about before, take it as an opportunity to improve!

Resources:

• Security Metrics, A Beginner's Guide 
• Center for Internet Security 
• Cloud Security Alliance 

Keep growing!