Elamb Cybersecurity

Category: security

  • DIACAP Essentials + IA Control Validation Training (part 4): DIACAP/AFCAP Day 4 & 5

    UPDAT: 2014 - Risk Management Framework for DOD IT released.

    Days 4 & 5 bring the DIACAP/AFCAP Essentials Class to a close. The
    biggest things I learned were: CNSSI 4009 is the the official glossary of DOD IA, there is a big difference between theory, policy and practice, Agents of the Certifying Authority (ACA) are official validators and there is a difference between acquisition Mission criticality and IA MAC levels.

    Stuff I learned from people in the class:

    -AFCA is changing its name (to what?)

    DOD is going to put the new IA controls in NCSSI 12-53 (currently in draft)

    -a lot of what I need in there is in NIST 800-53

    Marines use something called Exacta

    Site called securitycritics.org

    33-202 is now completely irrelevant and obsolete (not even mentioned ONCE in the class)

    800-30

    Feds call Certification &Accreditation (C&A) “Security authorization”

    NIST SP 800-37

    Day 4:

    Validator Activities & Issue Accreditation Decision

    Prepare POA&M

    Validate Results/Scorecard

    Scorecard

    Make certification determination

    CA/DAA Package review

    Day 5:

    Validation procedures were discussed. On day five, we looked at how the validators look at a system.

    I thought is was interesting. It should help me get through the EITDR/DIACAP process easier.

    Maintain Situational Awareness

    Maintain IA Posture

    Conduct Review

    R-Accreditation

    Retire system

  • Unable to create directory-parent directory writable? wordpress 2.7

    I was having uploading images on one of my WordPress 2.7 & 2.8 blogs. It gave me the following error:
    Unable to create directory /home/username/server/wp-content/uploads/20XX/MM/ Is it parent directory writable by the server?

    After a long time searching I found this solution from http://www.cyriac.me

    Step 1: Log into your admin panel

    Step 2: Go to Settings>>Miscellaneous

    You will see two options,

    Store uploads in this folder
    Full URL path to files
    Most probably you will see

    /home/.boogee/XXXXX/XXXXXXX/wp-content/uploads

    in the first field.

    Step 3: Edit that to just

    wp-contents/uploads

    Some people were suggesting that you solve the problem my making the folders permissions 777, meaning anyone can do anything to that particular folder. As a security guy, I knew this was a bad idea (and it also did work for me 🙂 ). I kept searching and ran into that solution.

    Worked like a charm! thanks cyriac for putting solution on the blog.

  • DIACAP Essentials + IA Control Validation Training (part 2): DIACAP/AFCAP Day1

    DIACAP/AFCAP Day 1.
    This is the second installment of the DIACAP Essentials journal.

    In the first day of class we’ve taken a high level look at the big picture of the Department of Defense Information Assurance Certification & Accreditation Process (DIACAP) and Air Force Certification & Accreditation Program (AFCAP). It is a very valuable tool for a beginner.

    Since I’ve gone through the entire process (with a legacy system) more than once through all the growing pains of Air Force C&A from DITSCAP to DIACAP, I found that I knew about 90% of everything taught. I don’t mind having a refresher, though and quite frankly, I need the CPE’s for my CISSP :).

    There were a couple of golden nuggets that I’ve been able to get out of some of the old timers. I learned some interesting things about how the Navy, Marines and Army do things.
    Navy (as weird as their dumb ass rank system.. yep, I said it.. its dumb) have like three systems: DITPR-DON, DA-DUMB and some other BS, Marines have something called Exacta and the Army has APMS (Army Profile Management System). Also learned cool off topic stuff like history of eMass.

    I must admit I’m looking forward to day two.
    pros of day 1: Good solid start on basics GREAT for beginners. SecureInfo gets mad props for have a great instructor John M.(don’t know if he wants his full name published.. but he’s highly, highly knowledgeable and very positive).

    cons of day 1: Right off the bat I am noticing a huge hole in the training… a lack of in depth teaching of EITDR, which is how the Air Force implements, manages and maintains the entire DIACAP/AFCAP process. I don’t really see how you can teach one without the other these days. I guess contractually, SecureInfo can not touch it since some other company has the contract. But unfortunately, the folks that are new to this are going to suffer. Because if they goto this class without knowing the EITDR they will know why but now how, and if they go to the EITDR class without knowing the DIACAP they will know how but not Why.

  • GET BACK TO US: WESTERN UNION MONEY TRANSFER scam

    *SCAM*

    Send Money Worldwide

    Dear Sir/Madam,

    There is an issue with the WESTERN UNION MONEY TRANSFER in the amount of $850,000.00 USD directed in cash credited to file UNP/9066336466/08, at the owner of this email address.

    The International Monetary Fund in collaboration with the Government of this country contacted us for your compensation a couple of hours ago due to your allocated security code which your email address was selecetd with an automated machine that selects email addressess through internet.So we require some more information in order to complete this transfer.

    FULL NAME:
    FULL CONTACT ADDRESS:
    MOBILE PHONE NUMBER:
    OCCUPATION:
    MARITAL STATUS AND AGE:

    In order to resolve this problem,please email via Western Union Solicitors Fund Verification Department:
    Name: Mark Wilson
    Email:mw2764773@googlemail.com
    TELEPHONE:+233249841613

    As soon as this information is received,and you have Complied with the requirements of payment of the western union charges,payment will be made to your nominated bank account or at the counter directly from The Western Union Transfering Bank.

    When emailing,please use reference number 72912 for our mutual convenience.

    THE MANAGEMENT OF WESTERN UNION MONEY TRANSFER OFFICE.

    Sincerely,

    MR.Morris Edward
    Western Union Payments

    As we focus on making a difference in people’s lives, people focus on
    Western Union and acknowledge the possibilities we offer to those we
    serve

  • You Hack US, We Nuke You!

    The United States’ top commanding officer for the space and cyber domains told reporters last week that a cyber attack could merit a more conventional military response.

    During a press briefing on Thursday, U.S. Air Force General Kevin Chilton, who heads the U.S. Strategic Command, told reporters that top Pentagon advisors would not rule out a physical attack on any force that attacks the United States through the Internet. Currently, the military’s networks are probed thousands of times a day, but the goal of attackers seems to be espionage, not to take down critical networks, he told reporters –

    — Security Focus

    I don’t believe that military force is the equivalent action for a cyber attack. Arrest and/or apprehension is the physical response necessary for criminal hackers attacking from other countries. Cyber counter-attacks are the correct response for government funded & coordinated attacks.

    I think if the U.S. reciprocates a cyber attack x10 when other countries are playing little games, we’d get our message across effectively. We should do so in a well funded and covert way in which the enemy has NO DOUBT that the face slap came from a U.S, hand, but no proof at all allowing plausible deniability. It should be black Ops hacks, very well coordinated, very well funded and full time.

    I don’t think the US can be complacent or wrecklessly meek in matters of cyber warfare. Instead, it must be fair, quiet and heavy handed when it comes to one of its most valuable asset, information.

  • Weaponized Hacking

    This is not your momma hacking. This is militarized hacking, Pentagon style. It is state funded with the intent of allowing the killing of people and the breaking of things.

    “U.S. Defense Department officials were so impressed with the level of coordination between ground military ops and cyberattacks against strategical targets during the recent conflicts, that they are now looking for ways to weaponize hacking. Aviation Week glanced at such a device and reports that it is being designed to be easily used even by non-techy soldiers.”
    softpedia

    Welcome to the neo-CyberArms race! Where uncontrollable cyber weapons that can turn off cities and detonate public utility plants with the touch of a button! This is not the beginning of a William Gibson novel, this is not the synopsis of Snow Crash, or the theme of a cyberpunk trilogy this is reality… virtual reality.

    On a serious note, I think China has already weaponized hacking. Hopefully, this is not the first time the US has thought about this.

  • Validation: Track the Results

    If you are doing Certification & Accreditation then you know it’s all about the documentation.

    But its not just about reviewing the documentation that a system is supposed to have. If you’re in the business of getting systems validated sometimes you’ll have to produce the documentation.

    An IA Analyst, system security engineer or Information Assurance Officer (IAO) usually documents the results of their security tests. For example, if they run a Retina Scan they will want to generate a report that has the results of that network or system scan.

    DoD Information Assurance Certification & Accreditation (DIACAP) Knowledge Service, the Enterprise Information Technology Data Repository (EITDR) and other IT profile databases have very detailed information on what the final Validators are looking for.

    If you’re in line with the final validators you will not have much of a problem, because they will approve the system and move it on to the Designated Approval Authority (DAA).

  • Star Trek Based Anti-Virus: Klingon Anti-Virus (KAV)

    Sophos put out a Star Trek Based Anti-Virus. Pure genius. The downloads for it are off the charts. Its free. Its fun and its increbibly smart marketing. Like many brilliant ideas it was an accident. Well, it was put out as an accident. But I for one am glad it was.

    The Star Trek movie was awesome by the way! Great move for a franchise that deserves a larger commercial audience. I’m anxious for more movies and shows.

  • Dangers of Surfing the Web with an Admin Account

    If you bought a Dell or Gateway, more than likely you only have one account on your computer with no password. That account runs as the administrator. If your system has no user name or password applied, it is running as an administrator account.

    This is how so many people get viruses. When you surf the web as an administrator is allows malicious applications (viruses, worms, Trojans and other malware) to download to your computer and run as the administrator. This means they can replace system files with viruses, create back doors and harm other computers on your network. They can also spy on you manipulate your browser or do anything else they want to do.

    One way to greatly minimize the effects of viruses is to create accounts on your system and only use the administrator account when its necessary. Create a limited user account that you use when surfing the web, getting into your email or doing other small tasks that don’t require downloading or installing applications.

    With a limited account, even if the malware is downloaded, it will not be able to install.

  • Claim Your Winnings Now! *China Lotto* SCAM

    *We’ve seen the Australian lotto, the UK lotto and the international internet lotto. Here is the China Lotto.**
    ** How do we know this is a scam?
    1) It comes from a free email account. Legitimate organization usually have their own email account on their own domains.
    2) They want too much personal information.
    3) Common.. CHINA opening up a national lotto?!

    CHINA-LOTTO Headquarters,
    No.189 Tianhe Bei Road,
    Guangzhou, China.
    Post Code: 510075.

    Customer Service
    Ref: CH/9420X2/68
    Batch: 074/05/ZY369

    OFFICIAL WINNING NOTIFICATION

    We happily announce to you the draw (#1277) of the CHINA NATIONAL LOTTERY, online Sweepstakes International program held on Wednesday 14th of April, 2009 in GUANGZHOU, CHINA.

    Your e-mail address attached to ticket number: 564 – 75600545 – 188 with Serial number 5368 – 02 drew the winning numbers:16 – 29 – 30 – 32 – 38 – 45 – [ 40 ] Bonus Ball, which subsequently won you the lottery in the Match 6 category (JACKPOT PRIZE). You have therefore been approved to claim a total sum of $4,500,000.00 (Four Million, Five Hundred Thousand United States Dollars) in cash, credited to file CHNL/12662203/08.

    The selection process was carried out through random selection in our computerized email selection system from a database of over 250,000 email addresses drawn from all the continents of the world. The CHINA National Lottery is approved by the ASIA Gaming Board and also licensed by the International Association of Gaming Regulators (IAGR).

    Our funds release authorising officer will immediately commence the process to facilitate the release of your funds as soon as you contact him. For security reasons, you are advised to keep your winning information confidential till your claim is processed and your money remitted to you in whatever manner you deem fit to receive your prize. This is part of our precautionary measure to avoid double claiming and
    unwarranted abuse of this program. Please be warned!!!

    To file for your claim, contact the funds release authorising officer by quoting your reference and batch numbers in your claims.

    THE CHNL PRIZE AWARD DEPARTMENT.
    Mr. Edward G Williams.
    Funds Release Authorising Officer.
    Email: robertg.deng1@gmail.com
    Tell: 0086-13480002124

    Fill in with your winning information below:

    FULL NAMES:……………………………………
    CONTACT ADDRESS:……………………………….
    CITY:…………………………………………
    STATE:………………………………………..
    COUNTRY:………………………………………
    NATIONALITY:…………………………………..
    ZIPCODE:………………………………………
    SEX:………………………………………….
    AGE:………………………………………….
    MARITAL STATUS…………………………………
    TEL NO:……………………………………….
    EMAIL ADDRESS:…………………………………
    OCCUPATION:……………………………………
    ANNUAL INCOME:…………………………………
    AMOUNT WON:……………………………………
    REFERENCE NO:…………… BATCH NO:……………….
    WINNING NO:…………….. TICKET NO:………………
    SERIAL NO:……………… LOTTERY DATE:……………

    Congratulations once again from all members and staff of this program.

    Yours faithfully,
    Mrs. Cynthia Culo.
    Online Catergory Coordinator,
    China National Lottery.

    Copyright ? 1994-2012 The CHINA National Lottery Inc.
    All rights reserved. Terms of Service – Guidelines. – Guidelines.