Jim Ovia is a real person and Zenith Bank is a real Nigerian bank. There is a scam flooding the Internet using Zenith to profit. Picture of Jim Ovia
Many scammers (definitely not all) on the Internet are from third world countries. The case listed below is a scam coming from West Africa. We can assume that the use of actual banks and people from Nigeria that this scam is based in Nigeria. The following scam alludes to a real bank in Nigeria called Zenith. It also mentions Jim Ovia, a real person, who is a former CEO of Zenith bank.
From Reader:
I have been sending money by Western Union a very large sum of money to a Jim Ovia of Zenth Bank for help in geting 2.5 millinon dollars. Now if I have not been dealing with this man someone else has beeing using his name and title.
I have read a Biography of Jim Ovia on the internet and after learing what
a wire transfer is I feel like I have been scamed bad cause I have been sending the money through Western Union.
nmw
Always research and double check unsolicited (and solicited) claims of wealth on the Internet and in your inbox. Most things are not what they appear to be on the Internet. Your trust should be hard earned especially on the ‘Net. Some signs of the foul play will include (but will not be limited to):
Use of free email such as .gmail and .hotmail: Remember scammers do not typically have the resources to devote to setting up an email box and website that looks legit so they will use everything free that they can.
BAD ENGLISH: If they have very poor grammar, it is an indication that they probably don’t have the education to be put in a place where they would be responsible for other people’s money particularly an English client.
Check the links of the email: Some emails look like the come from the real “paypal” or the real “Zenith Bank” but it is actually what is called “phishing”. The email has all the official logos and letterhead but the links lead to fake sites. If you look “under the hood” of the email, you will find the real URLs and IP address. You may also see the use of free email. If you go into the email and “Show Original” or “Show source” you will see where email actually came from, where it is being forwarded to and where the links go to.
If it looks to good to be true, it probably is. This is an axiom that is an unfortunate truth due to human greed and selfishness.
2014 Update: Â DIACAP has been replaced by RMF for DoD IT. Â The RMF for DoD IT is almost completely derived from the NIST SP 800-37.
NIST roles and responsibilities are addressed throughout the special publication 800 series. The definition of the roles & responsibilities are as follows:
Head of Agency
The Head of Agency is also known as the Chief Executive Officer. This role is the highest level executive senior officer within an organization. They have ultimate responsible for the providing information security protection. The level of protection must be at the same level as the importance of the information. The Department of Defense equivanent is a DoD Head of component (i.e. Secretary of the Army).
image of secretary army john mchugh
Risk Executive Function
The Risk Executive Function’s main focus is the overall risk to the entire organization. They create a risk strategy for the organization that guides mission/business process and system-level risk assessments. The Risk Executive Function is and important role for Tier 1 activities of managing risk of information systems IAW NIST SP 800-39.
CIO
Chief Information Officer is an organizational official responsible for (1) designating a senior information security officer; (2) developing and maintaining information security policies; (3) ensure that those with responsibilities in system security have proper training.
Information Owner/Steward
“The information owner/steward is an organizational official with statutory, management, or operational authority for specified information and the responsibility for establishing the policies and procedures governing its generation, collection, processing, dissemination, and disposal.” NIST SP 800-37 The Information Owner must coodinate with the Information System Owner (DoD PM equivalent) for decisions involving the overall system.
Senior Information Security Officer
The SISO is directly responsible to the CIO. They’re focus is the information security of the organization’s data. They act as a liaison between CIO and the Authorizing Official. The DoD equivalent (circa 2010) is known as the Senior Information Assurance Officer (SIAO).
Authorizing Official
AO formally accepts the risk of a system in the Implementation/Assessment phase of the System Development Lifecycle and Step 5, Authorization step of the Risk Management Framework.
Common Control Provider
“The common control provider is an individual, group, or organization responsible for the development, implementation, assessment, and monitoring of common controls.” NIST SP 800-37. A common control is a security controls that covers multiple information systems within and organization. Examples of common controls: Incident Response, Network boundary protection (firewalls, IDS/IPS).
Information System Owner
“The information system owner is an organizational official responsible for the procurement, development, integration, modification, operation, maintenance, and disposal of an information system.” NIST SP 800-37
Information System Security Engineer
“The information system security engineer is an individual, group, or organization responsible for conducting information system security engineering activities.” NIST SP 800-37 The ISSE implements security into the design of systems. The ISSE is often a consultant or Subject Matter Expert who focus is applying information assurance frameworks and regulations in an information system.
Information System Security Officer
This role is initiated at the Initial phase of the System Development Lifecycle (SDLC). “The information system security officer
is an individual responsible for ensuring that the appropriate operational security posture is maintained for an information system and as such, works in close collaboration with the information system owner” NIST SP 800-37. This role has been called and Information Assurance Officer (IAO) within the Department of Defense. Within the DoD this role is appointed by the Information Assurance Manager (IAM). Also known as the Information System Security Manager (ISSM). The ISSM is often responsible to over site and being a supervisor of ISSO positions.
Security Control Assessor
“The security control assessor is an individual, group, or organization responsible for conducting a comprehensive assessment of the management, operational, and technical security controls employed within or inherited by an information system to determine the overall effectiveness of the controls” NIST SP 800-37.
The NIST & DoD have very similar roles with different names:
DoDI 8510.01 DIACAP
NIST SP 800-37 Security Authorization
Heads of the DoD Components
Head of Agency (CEO)
Designated Accrediting Authority (DAA)/
Authorizing Official
Program Manager (PM)/ Systems Manager (SM)
Information System Owner
Information Assurance Manager (IAM)
Information System Security Officer
Information Assurance Officer (IAO)
Information System Security Officer/ Information System
Security Engineer
The ever changing trend in technology brought the necessity for the automation of everything from paper-and-pen based to absolute computer domination. The overwhelming emergence of computers paved way to easier access of information that leads to increased production, efficiency and reliability.
The increasing urbanity of modern information system allows the information and communication technologies to be utilized in different actions. In fact, the educational institutions are one of the leading users of computer applications in order to manage student data.
Student Record System (SRS) is a computer application that deals with the generation, collection, organization, storage, retrieval and dissemination of recorded knowledge. SRS provide capabilities for entering student information, building a student record and managing other student – related data needs in the school.
In the light of recent high profile cases there is increased emphasis being placed on all institutions to be able to demonstrate good record management. The effective management of records ensures sound decisions based on full, accurate and up-to-date information and by ensuring that the underlying principles behind those decisions can be traced, scrutinized and justified as necessary.
This breakthrough gave way to the development of databases which became useful for storing data for important information.
In the development of database management system, the organization of storage of data was prioritized. A DBMS controls the creation, maintenance and use of the database storage structures of educational institutions of their users. It allows institutions to place control of institution wide database development in the hands of Database Administrators (DBAs) and other specialists.
An SRS provide the following benefits:
1. It helps facilitate decisions about courses students should take and assist with problems that may arise
2. It assist with monitoring accountability and future planning
3. It helps teachers make instructional decisions and to obtain specific information that may assist in working with a student
4. It helps evaluate the success of various programs in a certain curriculum
Filipinocupid.com (also known as “philippine heart”, “filipino heart”, “filipina cupid”, or fc, fh for short) is a dating site. Although, philippine cupid is focused on Filipino men and women, there is huge presence of westerners there (mostly European & American males). The on line dating interface of the site is similar to the every grown genre of race specific dating sites (i.e. thai cupid, japan cupid, korean cupid, dominican cupid, columbian cupid, latina cupid, caribbean cupid and all the other cupid dating sites).
Philippine culture can be found among the profiles of the members, however the language on the site is almost exclusively English (with some spanish, french, italian and almost no tagalog). Western men will quickly see that they are the primary target of many (if not most) of the filipinas on filipino cupid. The same cannot be said of some of the other “cupid dating” sites.
Although the site is completely legitimate, popular and well done, members should be careful of the MANY date scams, romance scams and fake date profiles on the site.
NIST Special Publication 800-50, is a regulation dedicated to IA Awareness Training
NIST SP 800-5, Building an Information Technology Security Awareness & Training Program
The 800-50 includes guidance on development and sustainment of an awareness & training IT Security (aka information assurance training) program for all users, employees and supervisors within an organization. Having a training program is mandated by the Federal Information Security Act of 2002.
IA Awareness Training – Roles & Responsibilities
Agency heads – must ensure that high priority is given to effective security awareness and training for employees. Appoint a CIO CIO – Establish overall strategy, funding, tracking and report is in place for the IT security awareness and training program IT Security Program Manager – tactical deployment, development and maintenance of the IT security & awareness program. Managers – responsible for complying with IT security awareness program. Work with CIO and IT Security Program Managers to share responsibility. Ensure all users are trained to fulfill their security roles before access is giving. Promote professional development and certification of the IT staff. Users – largest audience in any organization and are the single most important group of people who can help to reduce unintentional errors.
800-50 calls learning a “continuum”. The continuum of learning starts awareness and builds into education.
Awareness – awareness is not training. Awareness focuses on security concerns to ensure users are mindful of basic rules and issues in a given environment.
Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly. – 800-50
Training – is a formal focused method to develop a skill for job performance.
Training strives to produce relevant and needed security skills and competencies – 800-50
Education – combines multidisciplinary areas into a common body of knowledge.
Education integrates all of the security skills and competencies of the various functional specialties into a common body of knowledge . . . and strives to produce IT security specialists and professionals capable of vision and pro-active response. –800-50
Google has a search tool call “What do you love?” You type in whatever you “love” and it gives you results of books, video, emails, products and items related to what you typed in.
I am a HUGE fan of Google despite my fear of the organization potential power and inevitable growth into our personal lives. So I type in something I love.. SEX.
And it gave me kittens. WTF
Why does google hate sex? I don’t get it.
The only thing better than Google would be a Google that does not wuss out about sex and porn because it might offend people. Google is pretty strict on pornography.
They recently got tough on religions. They recently removed churches from their non-profit list. I guess Google allows non-profits the ability to get Google Ads free! Which shows some sort of backbone although some religious organizations are incredible (and REAL non-profits) so I hope they don’t to secular on that decision.
Understand the Risk Management Approach to Security Authorization
The concept of management of information security risks across an enterprise is discussed in 800-39. An organization takes a multitier approach to the risk management at the organizational, mission, and system levels. Risk management framework is a process that is broken down in NIST 800-37, Risk Management Framework. The CAP addresses the following:
Distinguish between applying risk management principles and satisfying compliance requirements
Identify and maintain information systems inventory
Understand the criticality of securing information
Understand organizational operations
Distinguish between applying risk management principles and satisfying compliance
Risk management includes satisfying compliance. Even though some controls may not be able to be made fully compliant due to limited resources, residual risk to the organization can still be mitigated and managed. – Concepts of NIST SP 800-37, Guide of RMF
Identifying and maintaining information system (IS) inventory is addressed in NIST 800-37, Risk Management Framework, 800-18, System Security Plan & 800-64, System Development Life Cycle. 800-37 addresses inventory of the IS in RMF Step 1 – Categorization of IS. Of the tasks of categorization includes information system registration which begins with by identifying the information system in the system inventory. This is documented in the security plan. NIST SP 800-18 discusses how the inventory is documents, and logically separates the system authorization boundary. That inventory is maintained and monitored throughout the life cycle of the IS (from imitation to disposal and from categorization to monitoring of the system).
A CAP candidate can understand the criticality of security information from reading FIPS 199, categorization of federal information systems.
Understanding the organizational operations of the system is imperative to a CAP candidate for the purpose of scope guidance described in NIST SP 800-53.
Risk Assessments and Risk Management will apply to National Security Systems (NSS).
What is a Risk Assessment?
A risk assessment is the results/process to determine the likelihood that a threat will exploit a weakness. Risk assessment is a part of the risk management.
What is risk management?
Risk Management is the on-going process of determining assessing, identifying and prioritizing of risks.
Is My System a National Security System?
NIST SP 800-59, Guidance for Identifying an information system as an NSS. 800-39 is a 17 page document developed in conjunction with the Department of Defense, including the National Security Agency, for identifying an information system as a national security system. It is basised on the Federal Information Security Management Act of 2002 (FISMA).
Who determines if you have an NSS?
The head of each agency is responsible for designating an agency information security official to determine which, if any, agency systems are national security systems.
Tools to determine if you have a NSS system:
National Security System Identification Checklist (NIST SP 800-59, Appendix A). The NSS ID Checklist asks (6) questions. Answering yes to any of these questions qualifies your system as an NSS:
• Does the function, operation, or use of the system involve intelligence activities?
• Does the function, operation, or use of the system involve cryptologic activities related to national security?
• Does the function, operation, or use of the system involve command and control of military forces?
• Does the function, operation, or use of the system involve equipment that is an integral part of a weapon or weapons system?
• Is the system critical to the direct fulfillment of military or intelligence missions?
• Does the system store, process, or communicate classified information?
NSS RMF
The guidance of CNSSI 1253 is the result of NIST collaborated with the Intelligence Community (IC), Department of Defense (DoD), and the Committee on National Security Systems (CNSS) to ensure NIST SP 800-53 contains security controls to meet the requirements of National Security Systems (NSS).
KEY DIFFERENCES BETWEEN CNSS INSTRUCTION NO. 1253 AND NIST PUBLICATIONS
The key differences between CNSSI 1253 and the rest of the NIST publications is that NSS systems do not follow “high-water mark”, NSS maybe tailored through risk-based adjustment, control profiles, and a method that allows organization to practice reciprocity.
NSS and High Water Mark
Both FIPS 200 and NIST 800-53 apply the concept of a high-water mark (HWM) when categorizing information systems according to the worst-case potential impact of a loss of confidentiality, integrity, or availability of information or an information system. This Instruction does not adopt this HWM usage. In the National Security Community, the potential impact levels determined for confidentiality, integrity, and availability are retained, meaning there are 27 possible three-value combinations for NSI or NSS, as opposed to the three possible single-value categorizations obtained using the guidelines in FIPS 200. – CNSSI 1253
Risk-Based Adjustment
Potential impact-based security categorizations for NSS may be tailored through the use of a risk-based adjustment. This adjustment takes into consideration the physical and personnel security measures already employed throughout the National Security Community and factors such as aggregation of information.
Control Profile
Method by which organizations may designate sets of controls for NSS based on their enterprise-wide risk assessment and taking into account business objectives, system risks, and mission needs.
NSS Reciprocity
It is the policy of the National Security Community that member organizations practice reciprocity with respect to the certification of systems and system components to the greatest extent practicable. Reciprocity of certification reduces the cost and time to implement systems and system components.
