Elamb Cybersecurity

Category: Main Digg

  • Dating Site Spam Emails

    Almost 2 consecutive weeks from now, I am continuously receiving these kinds of emails that are really strange because I received this in my spam folder. Try to read both emails; they have almost the same formats and content. I tried my best to research about this kind of emails and it is really a dating scam emails. I don’t even know them, so why they are going to send me emails like this. And I am a female, obviously in their email they are looking for a male partner.
    Based on my research this is the way how they work:
    1. They will first act like an angel and will get your attention every now and then.
    2. They will agree on your sentiments and everything you say to them is like making them happy to get your trust.
    3. Here comes there drama telling that they need money for food, utility bills, hospital bills etc.
    4. Since you already trust her, you will give her the amount she needs, after that your money fly way!
    Another thing is, sometimes they are not going to asked for money but they just need your email address, chances are you’re not the only one who receive this kind of email because they are trying to collect emails as many as they can, so once you replied on emails like this expect to receive as many spam emails in your spam folders. The emails they collected were part of their marketing plan or they just sell it to others.
    So I just suggest don’t ever replied to this kind of emails! Unless you really know them and it is a verified email. Just read the emails below to find out the truth, those emails are not edited, it’s the original email I received.
    From: lenny dan

    To: lennydan22@yahoo.com – look at this: my email should be in this area but that’s not my email address, I think they are using some sort of program to generate and send emails.

    From: lenny dan

    To: lennydan22@yahoo.com – look at this: my email should be in this area but that’s not my email address, I think they are using some sort of program to generate and send emails.

    lennydan22@yahoo.com
    Hello
    My name is Lenny, i saw your profile and it was interesting so i would like to know more about you. It will be a pleasure to read from you, if you wouldn’t mind, you can email me in private at ( lennydan22@yahoo.com ) so that i can reply you quickly and also send my picture for you to know me. I want you to know that real love matters. I will be expecting your mail soon, kiss.
    Your lovely new friend,
    Lenny

    From: inocencia

    To: – When I received this email, this area was blank but why I received this email if I did not see my email address in this area, please look at the above explanation.

    Hello dear
    My name is Miss inocencia i i come acrossyour email address at internet google today that is the reason why i write to you to get accquintance with you, I will like you to contact me back with my private email so that i will send you my pictures for you to know whom i am,although i came on line searching for a true and honest man .I believe we can move from here!!!Remember,color,language or distance does not matter,but love matters a lot in life.
    best of my regards
    From inocencia.

  • Yahoo 2011 Lottery Scam Revealed!

    Below is the exactly email content I received from this email address nn–890@att.net with a name of “yahoo claiming award”. Before opening this email, I was not surprised anymore with the content saying that I am a winner of ONE MILLION UNITED STATE DOLLARS. Because in the first place, I always received this kind of email and it goes directly to my spam folders which is really strange. Second is there is no such thing as yahoo lottery, even if you search in Google all results will probably articles about scams.
    I suggest when you encounter this kind of email; don’t immediately jump into conclusion that you are really a winner of a lottery or any online raffle because it is obviously a spam email especially if it goes directly to your spam folder. It is always good to check, do some research about it, before communicating to the sender of the email or to the address/phone number indicated on the email. I hope this can help, always remember it is better to be safe than sorry.

    YAHOO LOTTERY RESULTS 2011

    CONGRATULATIONS!!!

    Yahoo! announces you as one of the 25 lucky winners in the ongoing 12 Yahoo lottery Award of the Year Held on 20th of February 2011.

    All 25 winning email addresses were randomly selected from a batch of 50,000,000 international emails each from Canada, Australia, United States, Asia, Europe, Middle East, Africa and Oceania as part of our international promotions program which is conducted annually, consequently, you have been approved for a total pay out of ONE MILLION UNITED STATE DOLLARS (USD$1, 000000)

    This Lottery was promoted and sponsored by a conglomerate of some multinational companies as part of their social responsibility to the citizens in the communities where they have operational base.

    Further more your details(e-mail address) falls within our Bangkok representative office in Bangkok Thailand, as indicated in your play coupon and your prize of (USD$1, 000000) will be released to you from this regional office in Bangkok Thailand.

    Your fund is now deposited with our Bank/Security Company Bangkok Thailand and insured in your name. Due to mix up of some numbers and names, we ask that you keep this award from public notice until your claim has been processed, and your winning Payment have being sent to you or remitted to your account, as this is part of our security protocol, to avoid double claiming and unwarranted taking of advantage of this program by participants, as has happened in the past.

    HOW TO CLAIM YOUR PRIZE
    These are your identification numbers.
    Ticket number…………………063-14628115-20
    Serial number…………………..77710-0
    Lucky number……………….02-09-12-27-18-04,10
    Ref number……………….N.EGS/42275486009/16

    To begin your lottery claims, Please contact our Yahoo Lottery Coordinator as follows,

    Email: donalsoniva@yahoo.co.th
    Name: Donalson Iva
    Tel: +(066) 817752351

    You are to send the completed verification form below to the coordinator whose email address is given above so that you will be advised on what to do to get your prize money.
    Congratulations once more!!

    1. FULL NAME
    2. COUNTRY OF ORIGIN
    3. PRESENT ADDRESS.
    4. DATE OF BIRTH
    5. OCCUPATION
    6. TELEPHONE NUMBER
    6. FAX NUMBER
    7. MARITAL STATUS
    8. TICKET NUMBER, SERIAL NUMBER,LUCKY NUMBER AND REF NUMBER.

    Remember, all prize money must be claimed not later than 27th of February 2011. Any claim not made by this date will be returned to HER MAJESTY’S DEPARTMENT OF THE TREASURY. And also be informed that 10% of your lottery winning belongs to (THE PROMOTIONS COMPANY). Because they are the company that bought your ticket and played the lottery in your name.

    Note also that this 10% will be remitted after you have received your winnings prize, because the money is insured in your name already.

    NOTE: In order to avoid unnecessary delays and complications, please remember to quote your reference and batch numbers in all correspondences with us, Furthermore, should there be any change of address, please do inform our Coordinator as soon as possible. Yahoo lottery is a free service that does not require you to be a Yahoo! Registered user.

    An original copy of your lucky winning ticket and your deposit certificate will be sent to you by Administrative Remittance Bank UOB Bank Bangkok Thailand.

    CONGRATULATIONS!!!! Once again from all members of our staff and thank you for being a part of our International Promotions program.

    We wish you continued good fortunes.

    Yours Sincerely,

    Dr. Mark Hisashi
    Vice President Yahoo! Lottery Org.

    Mrs. Rose Akira,
    President Yahoo! Lottery Org

  • Japan Earthquake Scams 8.9 – March 2011

    11 Mar 2011, Japan just had a series of huge earthquakes (including one that was 8.9). The result was a huge tsunami and loss of life still being calculated. The tsunami of fraud and scams have already started on Facebook and have surely hit the shores of email spam inboxes everywhere.

    Example:

    Submission date: March 2011

    To:

    The quake triggers a tsunami that threatens much of the Pacific. Up to 300 bodies are found in the city of Sendai in northeastern Japan, an area believed to have been hit hardest by the massive waves.

    Hundreds are dead after the worst earthquake in generations struck off the northeast coast of Japan on Friday, setting off a devastating tsunami that swallowed swaths of coastal territory and fanned out across the Pacific Ocean, threatening everything in its path.

  • DoD Risk Management FrameWork (Part 1): Look Ahead


    The DoD is working on using the National Institute of Standards and Technology (NIST) Certification & Accreditation method of assessing & authorizing systems. The NIST system of C&A is actually known as Risk Management Framework (RMF). This would require the the Assistant Secretary of Defense Networks & Information Integration ASD(NII) office to move the DoDI 8500.2, Information Assurance (IA) controls to be mapped to the NIST SP 800-53, Recommended Security Controls. I am not certain yet whether they will eliminate the 8500.2 or just have all departments move to the NIST SP 800-53. They will also need to switch the DoD Information Assurance Certification & Accreditation Process (DIACAP) to the NIST SP 800-37 rev 1, Risk Management Framework or something similar.

    If the transition is anything like their move to from DoD Information Technology Security Certification & Accreditation Process (DITSCAP) to the DIACAP then they will give about 2 years for the DoD to transition. As of Mar. 2011, there is no policy on this. It is serious because its on the DIACAP KS and the Department of Navy CIO has been releasing information on it since 2009. The DON CIO & the ASD (NII) have been working on the project to transition from DIACAP to some sort of DoD Risk Management Framework. So far, they have mapped the DoDI 8500.2 IA controls to the NIST SP 800-53 Controls: Certification and Accreditation Transformation: Security Control Mapping. Here is a May 2010 update to the NIST to DIACAP mapping. 800-53 to DoD IA contols map also includes the Director of Central Intelligence Directive (DCID) 6/3 controls. This is very telling. The plan seems to be to have one standard for all Federal Information System.

    Since DoD 8510.01, DIACAP & NIST SP 800-37, Risk Management Framework (RMF) cover so much of the same ground, I think the only real benefit is that reciprocity between Federal agency will be easier if all departments have one standard of risk management and one security control set.

    The DON uses the certification and accreditation (C&A) process to assess and understand the residual risk associated with operating information systems (IS) and information technology (IT). The DON is participating with the DoD, the IC, and the rest of the Federal government in C&A transformation. One goal of transformation is to achieve common security controls enabling the DON, the DoD, the IC, and the rest of the Federal government to develop systems to the same protection standards.

    The recently released National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, revision 3 provides recommended consolidated security controls in an effort to achieve common security controls across the Federal government.

    The DON will continue to use the DoDI 8500.2 as the authoritative source for security controls until otherwise specified. However, understanding the changes represented in NIST SP 800-53r3 will be essential as DoD and the DON begin transitioning to this new set of security controls. To support the transition, the DON CIO developed this security control mapping document to demonstrate how existing DoD and IC security controls map to the security controls recommended by the NIST SP 800-53r3 publication.

    —Security Control Mapping Document Aids Transition, DON CIO Site

  • Cisco Cert Beginner Part-2: Setting up a Network Lab (Rack)

    One of the reasons I failed the CCENT was that I didn’t prepare for router/switch simulators that are on the test. I knew the theory and concepts behind Interconnecting Cisco network devices, but I hadn’t spent much time on the command line of an actual router. Since the test is timed you don’t have a lot of time to try to figure commands out on the fly. You certainly can, because Cisco command line is pretty user friendly.

    To prepare for the test you must be comfortable in the Internetwork Operating System (IOS). That is why my CCNA, CCNP buddies encouraged me to set up my own Cisco network. They told me how to buy them cheap, what components to buy and how I should actually network them to prep for the Cisco certs.

    Cheap Cisco Equipment:
     Talking about what actual Cisco models to buy in this post will not be effective since anything I name will be completely obsolete by the time you read this. But I will tell you that my CCNA/CCNP friends recommended buying old Cisco equipment from ebay and Craig’s list. And even schooled me on what was a good deal. In some cases I would just give them money and they would buy if for me. I ended up buying a lot of stuff I don’t need but you are more than likely much smarter with your money.

    What to Buy:
    They told me that it was important to buy two switches and two routers to practice with routing protocols and spanning tree. They explained that it is important to understand the behavior of the technologies in order to know how to troubleshoot. Theory is important too, but to prepare for the CCENT you must get comfortable with the command line interface so you don’t waste time figuring out basic stuff on the fly.

    courtesy of Cisco land

    DIAGRAM:
    Build a diagram first! This is difficult for me because I like to just jump in and try things. But creating a network diagram and understanding what it is you want to set up is very important.

    from rate my network diagram

    Virtual Cisco LAB:
    Another very useful tool for those who really can not afford to drop $100 dollars on old Cisco equipment is the use GNS3. Its like a VM Ware for Cisco IOS. It allows you to create a virtual network and mess around with actual Cisco IOS. Its really pretty cool… and (best of all) it free!! Aside from air, I am not sure there is anything more useful. Its is a great tool if you are serious about studying for the CCENT/CCNA/CCNP.

    courtesy of gns3.net

  • Romantic Scams

    I have to speak out loud now because its eating me inside what I thought was a true relationship which continued for several months until mid beginning of December which questioned myself about the relationship I met someone on the British online dating site called meetic, I was going to close my account when I saw this gorgeous guy on site just the type I was looking for, I sent a wink and he winked back, then We started chating, he gave me his email address so We can communicate more as far as I knew this guy Kyle Maclaren this was his name was born in Aberdeen just up north of England he was just what I was looking for anyway, I asked what he did for a living he said he dealt with gems, I asked what do you mean ? he said precious gems oh I see, he said he had his eight daughter over weekends as he was divorced and they go to church and they were cooking dinner, he said he was trying to get full custody, anyway a few weeks along he says he is going to Ghana on business and will contact me when he got there, when I hear from him again he says his laptop has been stolen at the airport and ask me if I could send him a top of a range laptop, I thought Ive only just got to know this guy and he is asking me for a laptop I told him I couldn’t do it his English typing was terrible for a businessman I hadn’t fallen yet, anyway he asked me a favor again banks where so so we the bank he needed favor he needed 1000 pounds so silly me goes send him the money I said I would send it to his personal bank account he insisted western union under the name of Stephen before, when he asked me again because he had to go to the states to get a loan as he had brought into the gold mining business and sent me a two different types of certificate a sworn affidavit approving the sale of some land forestry, week later he asking me for more monies this time he equipment he has sent over from Houston, Texas which he had gone with a close friend helped him to get this loan, then I questioned my self if he got a loan for this equipment surely he has enough to cover any expenses, his excuse was the mining equipment was held at customs in Ghana a shipment from the states another from china, could I help him out I declined as he was already owing me 2000 pounds and I wasn’t going to put myself in any further date he pleaded with me and said he would pay me back with interest I declined and told him I couldn’t do it, he said he wouldn’t let money get between our relationship and he would sort it out himself, when I spoke to him he was always in a business meeting he was always going to church, or he was always driving, months went by and our conversations grew less he was too busy, he then asked me for two mobile phones again top of the range,one for him another for the security guard looking after his equipment, I go along with it once again, I last spoke to him on Dec 4th 2010, that was the last time he was selling his business up I asked for the monies back once he sold his business, I never heard from him, I rang his mob number and some stranger answered it I asked for him and said what are you doing with his mobile, where is he, he declined to answer I asked him again he said he had gone to south Africa, I asked if he was coming back he was in decisive said don’t know, I rang the number he used to speak to me from the states the old woman who answered it didn’t know of Robert who was his friends number, I came to realize he was a scammer for sure this man needs to be stopped he uses Kyle Maclaren, kyle love, kyle dean
    I should have heard alarm bells ringing but he had me reeled in for the catch I feel so stupid and the biggest fool alive I thought he was so genuine he deceived me real good he need to be stopped now he could be scamming some other woman this minute, please pass this on to the authorities he belongs behind bars with his accomplices.

  • SSL and S-HTTP: “Website Security for sending confidential information over World Wide Web”

    SSL is the short term for Secure Sockets Layer. It is a protocol designed to enable applications to transmit information back and forth securely. Applications that used Secure Sockets layer protocol inherently know how to give and receive encryption keys with other applications, as well as how to encrypt and decrypt data sent between the two. While the S-HTTP is an extension protocol of HTTP to support sending data over World Wide Web. Not all Web browsers and servers support S-HTTP. SSL and S-HTTP have very different designs and goals so it is possible to use the two protocols together. Both protocols have been submitted to the Internet Engineering Task Force (IETF) for approval as a standard.

    Some applications that are configured to run SSL include web browsers like FireFox, Internet Explorer, and Google Chrome, email programs like Outlook, Mozilla Thunderbird, Apple Mail app., and Secure File Protocol programs, etc. These programs are able to automatically receive SSL connections. To establish a secure SSL connection, however, your application must first have an encryption key assigned to it by a Certification Authority in the form of a Certificate. Once it has a unique key of its own, you can establish a secure connection using the SSL protocol.

    These Technologies are mostly used in e-commerce and banking sites to avoid stealing information from the user. Web browsers automatically notify users when connections are insecure. Your potential E-commerce customers and online banking transactions are used to secure shopping and banking process, and will NOT send their private information unless their browser assures them it’s safe to do so! You cannot offer secure authentication to your customers without an SSL or S-HTTP Certificate. There are cheap SSL certificates out there; you can search over the internet.

    Here is some information that might help you to determine whether the website you are browsing has a secure connection.

    • When you are logging in at yahoo the left side of your address bar is in colour blue, try to point the mouse over the blue area and it will appear that the website was verified by DigiCert Inc.
    • In google, it is also colour blue and was verified by Thawte Consulting (Pty) Ltd.
    • In other websites, like website of a bank it has a lock icon on the left side of the address bar.

    You can easily notice if the site you are browsing is not verified and has no certificate because it will appear an X on the upper left side of the browser. It means it is not safe to feed confidential information. So I hope this will help all of you.

  • Cisco Cert Beginner Part-1: where to start

    Since I failed the Cisco Certified Entry Networking Technician (CCENT) (lol), I have decided to get smart on Cisco again. I have been out of it a long time doing mostly DoD Certification & Accreditation work. I used to be a network engineer with a CCNA, until I found a career that pays better with less competition. So now, I am just doing Cisco stuff for fun.

    After failing the CCENT, I talk to my resident networking GURU’s (a CCNA Security, a CCNP and a CCIE). I wanted to know what was the best approach on attacking the CCNA again. They told me what they did.. set up a Cisco lab in the house was he most common answer.

    The book they recommended to start with was CCNA-CCNENT ICND1. Its really not the most fun book in the world to read, but if your starting out or starting over with this stuff it should be like your networking bible. Among technical Cisco books, its a solid first start.. which is much more than I can say about any of the first start Cisco’s 5500 ASA books– there is just now such thing. You will be expected to have a solid understanding of networking, the OSI model and TCP/IP. If you have a Comptia Network+, the CCENT might be the logical next step. If you do networking pretty regularly, have been doing it for about a year and are familiar to Cisco equipment, you might be better off going straight to the Cisco Certified Network Associate (CCNA). If you’re going for the fully blown CCNA, the book to get is the CCNA ICND2. I have been warned that you need to very, very good at subneting!! The CCNA is much harder than it was when I took it in 2001. I would even say that the CCENT is harder than the CCNA used to be.

    In addition to getting the right books to read, the Cisco Gurus told me to set up a lab.

  • When does a DoD Information System require a re-accreditation

    How do you determine when a DoD Information System should have a full re-accreditation?

    We are not talking about the obvious:
    -3 year expiration
    -completely new version and/or overhaul of a system

    We are talking about a single client on within an Information System getting an upgraded operating systems, or a firewall being upgraded or the addition of 4 Cisco internetworking devices and a VLAN change.

    How do we know what is a basic sustaiment change, a configuration management changed (approved by the Configuration Board members) or a full blown 100,000 dollar re-accreditation.

    You would think there was some kind of matrix that could match up modifications to a DoD IS with what actions must be performed. If there is one, I have not seen it.

    All we have is high level regs that tell us IA Workforce peons (who must deal with details, schedules and limited funds) almost nothing we don’t already know.

    Assessing the IA Impact & Maintaining Situational Awareness:
    DoD 8500.2, Information Assurance gives us IA Controls such as
    DCII-1, dealing with IA Impact Assessment. Its states, “Changes to the DoD information system are assessed for IA and accreditation impact prior to implementation.” The DoD instruction also tells us the we are supposed conduct comprehensive annual reviews of our systems process, procedures and IA Control status.

    How are we supposed to monitor “Changes to the DoD information system?

    We know that we are supposed monitor all DoD IS’s to keep track of the baseline. And according to the regs, we are supposed to do this by a configuration management process (DCPR-1, CM Process). That configuration management process is supposed to have a “configuration control board that implements procedures to ensure a security review and approval of all proposed DoD information system changes, to include interconnections to other DoD information systems.”

    So Configuration Management gives us oversight on changes to DoD IS but who within the CM process determines whether changes to a system should have a re-accreditation?
    IA Control DCCB-2, Control Board tells us that” all information systems are under the control of a chartered Configuration Control Board that meets regularly according to DCPR-1.” Is also tells us that the Information Assurance Manager (IAM) is a member of the CCB.

    From my interpretation of these high level statements, the IAM is the subject matter expert who has a lot of say so on the IA impact of modifications to a given DoD IS.

    But the question remains.. HOW DO WE KNOW WHAT NECESSITATES A RE-ACCREDITATION?

    I did not find anything for that in 8500.2 so I moved on to CJCSI 6510.01, but it only says the same things that 8500.2 says (Configuration Management, CCB, having a baseline). But it did say this:

    “Ensure a configuration management (CM) process is implemented and establish appropriate levels of configuration management to maintain the accredited security posture. The security impact of each change or modification to an information system or site configuration will be assessed against the security requirements and the accreditation conditions issued by the DAA..”

    Still pretty high level, but we are getting closer since the instruction is telling us: “..security impact of each change or modification to an information system or site configuration will be assessed against the security requirements and the accreditation conditions issued by the DAA“.

    I thought that the only way to get more insight is to look at the lower level regulations within specific branches. Air Force’s Certification & Accreditation Program, 33-210, for example talks specifically about reaccreditation. It states, Information system owner (ISO) “Alerts AFNetOps of any changes to the topology or software affecting the security posture of the enclave boundaries so that the gateway package can be reaccredited if necessary. (3.8.6.6.4.)” And in table 3.2. it states “PM/SM/ISO will enter information in EITDR, host an initial stakeholder meeting, and initial security review to determine if a new version is to be created.” It mentions different reaccreditation actions for Networked and Standalone systems. Its goes on say that “if changes will not affect the security posture of the IS, the PM/SM/ISO will annotate the outcome of the meeting and make necessary edits to the C&A package.”

    The Army’s AR 25-2, Information Assurance regulation, has an entire section on Accrediation & Reaccreditation (5-5), but offers still no specifics. The Army does have AR 380-19, AIS Information System Security and it is pretty specific (see excerpt below).. but it is now OBSOLETE and replaced by AR 25-5.

    All regulation and instructions are inline as far as the need to reaccredit if there is an IA IMPACT, but no specifics on what constitues an “IA Impact”. 8510, DIACAP mentions that the IA posture of an IS must remain acceptable, in order to retain its Authorization to Operate (ATO). If I were the IAM for a day.. I would hang my hat of this important statement.

    We have to work with what we have!!
    Based on what we have:
    Changes in a DoD IS’s IA Controls determine whether or not a system will need a reaccrediation. There is no specifics on what can force a reaccrediation. So we must conclude that there is no “magic bullet” that will instantly create the need for a reaccreditation. In other words, no modifications to a certain hardware or software or certain subsystems or even the changes to network architecture will be the reason for reaccreditation every single time.

    Significant changes to IA Controls are the only thing we can really put our finger on.

    So lets say that IA Control, DCCS-2, Configuration Specification was changed on an Information System. This IA Control deals with making sure the all IA Enabled and IA Products have the DISA Security Technical Implementation Guides (or equivalent) applied. Maybe an example will help us understand the process of determining reaccreditation: A DoD Information System Owner requests the addition of four new storage devices to the system enclave. Lets say, that these storage devices will have an adverse affect on the security posture of the overall system because they are not in compliance with DCAS-2, Acquisition Standards… so the storage devices have not gone through NSA/Common Criteria. Additionally the storage devices will not be compliant with DCCS which means they will not have security in accordance with DISA/NSA checklists and guidance.

    Prior to being implemented or even tested the request for this change should go through the configuration management process where the IAM will tell the Program Manager and System Owner (or is representative) the security impact to the over all system. He or she would have to explain to them that the change may affect the current ATO, because they will now be non-compliant on two (possibly more controls) that were previously compliant. The IAM would also be wise to get in contact with other subject matter experts such as the system administrator and/or IAO would be in charge of implementing and testing the system. The IAM might also contact the Certifying Authority (or representative) to determine if such a change would create the need for a reaccreditation.

    One thing the IAM does NOT want to do is simply sign the Program Managers and System Owners up for some changes to the system that would jeapordise the Authorization to Operate. The IAM should do their homework and present the real risk of the modifications to the system owner. CYA is paramount.

    Once the IAM determine the impact, and the modification are made:
    According to DoD 8500.2, 5.8.5. “ensure that IA-related events or configuration changes that may impact accreditation are reported to affected parties, such as Information Owners and DAAs of interconnected DoD information systems.”

    Some older regulations are more specific. AR 380-19, AIS System Security for example:
    3-6. Reaccreditation

    a. All AIS, except those designated as nonsensitive, will be formally reaccredited within 3 months after any of the following occurs:

    (1) Addition or replacement of a mainframe or significant part of a major system.

    (2) A change in sensitivity designation (para 2-2a).

    (3) A change in security mode of operation (para 2-2b).

    (4) A significant change to the operating system or executive software.

    (5) A breach of security, violation of system integrity, or unusual situation that appears to invalidate the accreditation.

    (6) A significant change to the physical structure housing the AIS that affects the physical security described in the accreditation.

    (7) Three years has elapsed since the effective date of the existing accreditation.

    b. Reaccreditation will include the same steps accomplished for the original accreditation; however, those portions of the documentation that are still valid need not be redone.

    AR 380-19 has been replaced with AR 25-5 which is pretty high level.

  • What is Autorun.inf?

    What is AutoRun.inf?
    What exactly is an autorun.inf? Is it a virus or just a file that needed by other application in our computer to run? Have you ever gotten alerted by your system anti-virus application that autorun.inf was detected as a threat to your computer?

    AutoRun.inf is a primary instruction file associated with Autorun function. Autorun.inf is just a simple text-based configuration file that tells the operating system which executable to start or which icon to use. In other words, Autorun.inf simply tells the operating system how to deal on the programs or executable files and how the operating will treat the contents of a CD or any removable disks that is plug to your computer.

    Autorun.inf is not a malware, but a virus might use autorun.inf to get access to your computer programs and files. Common virus like bacalid, ravmon.exe and even Trojan virus hides in autorun.inf to easily spread to your computer. These viruses save themselves in the root directory of the infected hard disks and will run themselves every time you double click the drive. Usually if a USB stick or a CD was infected by a virus, once it was plugged to your computer the device automatically runs itself especially with the device where autorun was enabled.

    If autorun.inf was detected by your anti-virus as a threat to your computer but not yet tried to make an action then here are some tips to remove autorun.inf which are infected by virus.

    You can disable autorun.inf for all drives by configuring the registry of your computer. First you need to open the registry by typing regedit.exe to the command prompt or you may execute it in run. Then look for this registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
    Double-click the NoDriveAutorun DWORD entry and type the value HEX: FF (255 in Decimal). (If the NoDriveAutorun does not exists, you can create it by right-clicking the right side area of the regedit window, then click New->DWord Value -> type NoDriveAutorun) Close the registry and restart the computer. This procedure will disable all the autorun for all drives of your computer and at least will prevent the autorun function of infected USB drives or CDs and avoid the infection of viruses like the Bacalid and RavMon.exe.

    Another procedure to disable or delete autorun.inf that has been infected by virus is by using the command prompt, type cd\ then press enter. You may type the letter of your USB drive or CD drive, for example F: then press enter. Type this attrib –h –r –s autorun.inf then press enter, type del autorun.inf.That’s the easiest way to avoid spreading virus from your computer especially using sutorun.inf. If you have any questions, you can comment on this post, thank you!