http://adventuresinsecurity.com/blog Information Security Management for Business Managers Mon, 19 Feb 2007 16:08:58 +0000 http://backend.userland.com/rss092 en Selecting the right security controls can be a daunting task.  By applying the principles of risk management, however, security managers can meet the challenge with confidence.  Read the article http://adventuresinsecurity.com/blog/2007/02/19/use-risk-management-for-reasonable-information-asset-protection/ Unbelievable.  It's even more unbelievable because I live near the community of Oregon, Ohio where a police detective called a student's iPod a "criminal tool".  In an article in the Toledo Blade,  Robin Erb describes an incident in which a former Clay High School student was charged with a felony for accessing ... http://adventuresinsecurity.com/blog/2007/02/17/holy-toledo-the-ipod-did-it/ I was reading a Tim Wilson article at Dark Reading this morning in which he asked the question, "So are users hopeless?  Are they inherently brainless and/or evil?"  My first reaction to the question was raucous laughter.  When I finally regained my senses, I read the rest of the article in ... http://adventuresinsecurity.com/blog/2007/02/17/calling-endusers-stupid-isnt-helpful/ Yes, the title is in all caps.  Yes, I'll yelling as loudly as I can.  In a recent column at seearchsecurity.com, Bill Brenner reiterates the dangers of using Telnet over connections that are not secure.  The principle problem is that Telnet communicates user IDs and passwords in clear text between ... http://adventuresinsecurity.com/blog/2007/02/16/do-not-use-telnet-over-the-internet/ In a recent blog entry at invisiblethings.com, Joanna posted her comments on Vista UAC and integrity levels after having used the OS for more than a month.  Interesting reading. http://adventuresinsecurity.com/blog/2007/02/16/reflections-on-vista-security/ Cross site scripting (XSS) is a big problem in web application environments.  In fact, the 2007 OWASP Top Ten list of web application vulnerabilities has XSS at #1.  In a recent paper, Shreeraj Shah, founder of Net Square, describes in detail the process for protecting applications developed using the AJAX ... http://adventuresinsecurity.com/blog/2007/02/16/scan-ajax-for-xss-entry-points/ According to security best practices, there are four things you can do when risk to an information asset is identified and business impact assessed.  You can reject/ignore the risk.  This is not a smart move in most cases.  You can mitigate the risk to an acceptable level.  You can accept ... http://adventuresinsecurity.com/blog/2007/02/16/transfer-risk-when-mitigation-costs-are-too-high/ For the first time since 2004, the Open Web Application Security Project (OWASP) is updating its Top 10 Vulnerabilities list. As a supplement to an previously published article on the 2004 OWASP Top 10, this is the second in a series of articles in which I explore the 10 vulnerabilities ... http://adventuresinsecurity.com/blog/2007/02/15/lock-it-down-use-the-revised-owasp-top-ten-to-secure-your-web-applications-part-1/ ______________________________________________________ Check out my book, Just Enough Security, at Amazon.com Additional security management resources are available at http://adventuresinsecurity.com/. My podcasts –> http://blastpodcast.com/viewpodcast.html?id=441 Free security training –> http://adventuresinsecurity.com/SCourses _______________________________________________________ http://adventuresinsecurity.com/blog/2007/02/15/personal-gratuitous-post/ In this Geekzone article, Darryl Burling ponders the value of putting risk management on the user.  I don't know about you, but relying on users to protect data, even their own, is typically a losing proposition.  Read the artcle and you decide.   http://adventuresinsecurity.com/blog/2007/02/15/soft-versus-hard-security/