I've done a few System Security Authorization Agreements (SSAA's) but I
admit I'm doing Information Support Plans, ISPs (formerly C4ISPs) for
the first time.

I used to think that the SSAA was a little bit
too much information. Overtime I've learned that it make total sense.
It forces the Information System designers to answer important questions. Many times the
questions it answers aren't important until much later (such as life
cycle issues).

The ISP's puts the SSAA to shame in its sheer
volume of information that needs to be gathered. This is because it
includes the netcentric aspects of the system, the actual schedule and
money involved, acquisitions issues and a bunch of other things that I,
as a security guy, don't care about.

The ISP is a birds eye view
of the target system where the SSAA is a microscope into all levels of
security over the life of the system from cradle to the grave.

More on Information Assurace, DITSCAP, and DIACAP on infoassure.blogharbor.com

Content is king.  The more quality content you manage the more traffic you get.  There are a few methods of creating automated content that seem to be greatly over looked  Here is one:

Del.icio.us:

Del.icio.us has a built in automated tool that allows its users to recieve automated updates to their online bookmarks.

If you login and goto the “Settings” tab and look under Experimental you'll see “daily posting blog.”  Select “add new thingy”

Here are links with detailed instructions on how to configure the “add new thingy”:

Moveable Type:

Common Craft

Kevin Wen

BrownPau

WordPress:

Nozell (Rhyms with Oh, Hell)

Typepad:

LastMinute

HERE IS HOW I did it:

Get the Del.icio.us RSS URL of your choice (orange RSS button located in the bottom left corner).  Copy and paste that code into the RSS Parser of your choice. List of RSS Parsers: 

  http://p3k.org/rss/?setup=true
  http://rssxpress.ukoln.ac.uk/ 
  http://www.rssgov.com/rssparsers.html
  http://del.icio.us/tag/rss+parser

 It will take the RSS and crank out HTML with content baked fresh daily as the del.icio.us tag is updated.  With no further work on your part.  What a lazy bastard you are! You are getting new content with no work while everyone else slaves away by copying & pasting and children are still dying in Africa.  If you select a popular tag, it will actually send stuff you haven't seen on CNN, Digg, Slashdot or anywhere else… very entertaining at times.

Author Robert Slade reviews lots and lots of the technical books. Books include everything from “Artificial Minds” by, Stan Franklin to the Official (ISC)^2 Guide to the CISSP Exam to Snow Crash by Stephonson. Excellent reference before you buy.

read more | digg story

The following is a review by Robert Slade.  Robert Slade is a data communications and security specialist and author of Robert Slade's Guide to Computer Viruses: How to Avoid Them, How to Get Rid of Them, and How to Get Help

REVIEW: “Spies Among Us”, Ira Winkler  

by Rob Slade

“Spies Among Us”, Ira Winkler 2005, 0-7645-8468-5, U$27.50/C$38.99/UK#16.99 Ira Winkler www.irawinkler.com
5353 Dundas Street West, 4th Floor, Etobicoke, ON   M9B 6H8  2005 0-7645-8468-5
John Wiley & Sons, Inc.
416-236-4433 fax: 416-236-4448

  http://www.amazon.com/exec/obidos/ASIN/0764584685/robsladesinterne
  http://www.amazon.co.uk/exec/obidos/ASIN/0764584685/robsladesinte-21
http://www.amazon.ca/exec/obidos/ASIN/0764584685/robsladesin03-20
Audience n+ Tech 1 Writing 3 (see revfaq.htm for explanation) 326 p.  “Spies Among Us”

In the introduction, Winkler admits that the title is slightly
misleading: most surveillance is not done by international spies, but by common or garden thieves, competitors, and so forth.  The point that he is trying to make is that non-terrorists can hurt you, although he raises the issue with illustrations that are not completely clear.

Part one deals with espionage concepts.  Chapter one reviews spying terminology, but makes points about the process by explaining the jargon and distinctions.  Risk analysis is introduced in chapter two, but the calculations used may not be clear to all readers.  An attempt to assess the value of information is made in chapter three.  Chapter
four outlines threats (entities that might harm you) and five covers vulnerabilities–the way your own operations can make you subject to attack.

Part two describes some case studies of spying.  The content is interesting, although the value is rather concentrated in the short “vulnerabilities exploited” section at the end of each chapter.  I must say that I've read all manner of similar stories and case studies in various security books, and Winkler's are more interesting than most.

Part three deals with protection.  Chapter twelve lists a number of countermeasures.  These are described in a level of detail that is appropriate for non-specialists (in security), although the content related to technical safety might be a bit thin.  How to plan and implement an overall security program is outlined in chapter thirteen, which includes a very interesting section on how the Department of Homeland Security has taught us valuable lessons about how *not* to execute safeguards.

While not structured in a formal manner that would make for easier reference, this book nonetheless has some excellent content.  Like Schneier's “Beyond Fear” (cf. BKBYNDFR.RVW ), it is easy enough, and engaging enough, for those outside of the security profession to read.
Busy managers may find the work a bit wordy and disorganized, but it makes useful points, and has constructive suggestions.  Home users and amateurs will find the style most suited to them, although the recommended controls are aimed at businesses.  Security professionals will not (or should not) find anything new here, but may appreciate the “war stories” and explanations that can be employed in security awareness training.

copyright Robert M. Slade, 2005   BKSPAMUS.RVW   20050531

http://victoria.tc.ca/techrev         

Slade's book reviews — http://sun.soci.niu.edu/~rslade/mnbk.htm

Slade's Bio — http://sun.soci.niu.edu/~rslade/bkoigtce.rvw

======================
rslade@vcn.bc.ca      slade@victoria.tc.ca      rslade@sun.soci.niu.edu
            

Dear All,

saveral days ego my computer was infected by virus ~77.vys, it attack ms.word.
Please help me to remove it, I have tried to clean by mc.Afee & NAV, but they can not detect it.

Indrasp

What is it doing?

How did you orignally detect it?

I've done research and it sounds like a Macro virus.  But it does not seem wide spread as I only found one forum with anything about it: 

http://www.infokomputer.com/forum/display_messages.php?mid=54578&fid=60&ids=54578

(don't even know what language that is)

Here is a page you should try out:

http://support.microsoft.com/?scid=kb;en-us;187243 It is about Macro virus' from microsoft I believe it will give you more insight into what it maybe.

Have you tried Hijackthis detect it?

http://www.majorgeeks.com/download3155.html 

Make sure you update it with the latest definitions How to use Hijackthis –> http://forums.majorgeeks.com/showthread.php?t=38752 Not sure it hijackthis will detect macros.

Can you find the process running in Task Manager?

http://elamb.blogharbor.com/hacked/IDTools.htm

On 6/21/05, Indra> wrote:

Dear Mr. Robert

 

    Thank you very much for your attantion of my problem. “What is it doing?” , if your computer was infected by this virus, when you insert the disket to diskdrive automatically file ~77.vys will copy to your diskette, and when you open your ms.word document and than you save it, the document couldn't be opened. Virus ~77.vys will appear as vys~77.doc, and you can find your document content in vys~77.doc.

 

I will try to do your suggestion, thank you very much and I'm so sorry about my bad English.

 

Indra

Technical facts about W97M.Ethan.AK computer virus:

Indra, Check this out,

Could you have some variation of the W97M.Ethan.AK Macro virus?  Do you have Word 97?  97 seems to be pretty vulnerable to attack.

Here is what I found out about the W97M.Ethan.AK
The virus copies itself in a temporary file, named “evolve.tmp”, in “C:\”.

At opening, if the virus is a macro in a “.doc” file, it infects normal.dot.  If the virus is a macro in normal template (“normal.dot”), it infects documents when they are opened.

It verifies the file macros, and it doesn't infect a macro that begins with “Private Sub Open” and ends with “End sub”. So, it doesn't infect the same macro twice.

The virus doesn't have any destructive payload, it only spreads itself through Microsoft Word Application.

Bruce Schneier opens up discusion on an interesting application of DNA Identification.

read more | digg story

There are now dozens of different types of drones in the Pentagon's arsenal. But you'd be hard-pressed to find one smaller than this Wasp Micro Air Vehicle (MAV), now being tested aboard the Nimitz Carrier Strike Group off Southern California.

read more | digg story

———- Forwarded message ———-
From: laurahamp 
Date: Jun 17, 2005 6:46 AM
Subject: [security-awareness] New Version of ISO 17799 Released
To: security-awareness@yahoogroups.com
A quick heads up that the new release of the security standard, ISO
17799, has this week been published. From the 17799 Newsletter: