Information Security Today is brought to you by Auerbach Publications


IT Management


Risk Management

Business Continuity and Disaster Recovery Planning


Operations and Data Center

Networking and Telecommunications

Project Management

IT Performance Improvement


Auerbach Information Management Service

Editorial Calendar


Contributor Guidelines

Contact Editor


New Books

Secure Data Provenance and Inference Control with Semantic Web by Bhavani Thuraisingham, Tyrone Cadenhead, Murat Kantarcioglu, and Vaibhav Khadilkar; ISBN 978-1-4665-6943-0
Ethical Hacking and Penetration Testing Guide by Rafay Baloch; ISBN 978-1-4822-3161-8
The Frugal CISO: Using Innovation and Smart Approaches to Maximize Your Security Posture by Kerry Ann Anderson; ISBN 9781482220070
PCI Compliance: The Definitive Guide by Abhay Bhargav; ISBN 9781439887400
Security without Obscurity: A Guide to Confidentiality, Authentication, and Integrity by J.J. Stapleton; ISBN 9781466592148
Conducting Network Penetration and Espionage in a Global Environment by Bruce Middleton; ISBN 9781482206470

Click on a book cover for more information or to order.
SAVE 20% AND GET FREE SHIPPING when you order these or any book online! Simply enter this code--813DA--at checkout.

IT Performance Improvement Focuses on Hardware
In the current issue of IT Performance Improvement Gay Gordon-Byrne explains how software selection drives hardware selection. She also examines the issues surrounding the maintenance of IT equipment. Greg Schulz delves into the reasons why data and storage are so important today. Hubbert Smith on metrics for hard disk drives. Also in this issue regular columnist Nancy Settle-Murphy is joined by Stephen Laroche, and together they give tips on how to give effective meetings.

Don't Leave Remote Participants Hanging: 8 Tips for a Meeting of Equals
Let's face it: It's almost impossible to make remote callers feel like they're on equal footing with people who are gathered in the conference room for the big meeting. But with some thoughtful planning, you can come pretty close. Taking the perspective of a frustrated remote participant, Nancy Settle-Murphy, author of Leading Effective Virtual Teams: Overcoming Time and Distance to Achieve Exceptional Results, offers eight tips for people who plan and run "hybrid" meetings, consisting of people who are gathered face-to-face and those who join from afar. Here she assumes that the meeting planners are using WebEx and phone conferencing, but these tips can apply with almost any kind of virtual meeting set-up.

"Digital Forensics Explained" Cited as Expert Testimony in US Supreme Court Case
Greg Gogolin's book, Digital Forensics Explained, was cited eight times in a recent US Supreme Court case. The case concerned whether evidence admitted at petitioner’s trial was obtained in a search of petitioner’s cell phone that violated petitioner’s Fourth Amendment rights. Greg's book was cited as expert testimony.

Beyond PCI Compliance
An organization begins a journey when it achieves PCI compliance. It is usually a starting point for a continuing path to information security and assurance. It is very important for the organization to understand the potential challenges and effectively address them after they achieve successful PCI compliance. This excerpt from PCI Compliance: The Definitive Guide briefly discuss the challenges and success factors that the organization must be aware of to maintain compliance and achieve optimum information security for the enterprise.

Before You Take Your Next Trip
I don't know if you've ever read Stratfor's guidance on personal security, such as "Taming Chaos with a Personal Plan," but this new book, Personal Security: A Guide for International Travelers, provides a comprehensive approach to personal security and safety when travelling, or even while at home. To support your pre-trip preparations, this chapter, "Before You Go," maps out expert advice and lessons from real life cases to give you insights into basic planning questions.

Ethical Hacking: The Postexploitation Phase
After you have successfully exploited a target and managed to gain access to it, you enter the postexploitation phase, which is the last phase of the penetration testing process. Read on to learn how to exploit our targets further, escalating privileges and penetrating the internal network even more.

Building a Penetration Testing Lab
What do you need to build an effective pentesting lab? This checklist from Bruce Middleton's new book, Conducting Network Penetration and Espionage in a Global Environment, details exactly what you need.

Physical and Cybersecurity Have Converged
People have been talking about this for years. Now, convergence--the IP-enablement of everyday business functions creating an overlap of physical and cyber security issues--is no longer a "concept." It is now a reality, or should be. Ask Target, where hackers accessed the company's network via an attack on the third party provider for the heating/ventilation/air conditioning (HVAC) system to steal the financial information of more than 110 million customers.

Heartbleed Disclosure Timeline InfoGraphic
This infographic looks at the vulnerability from March 21-April 7 from the perspective of NCSC-FI, Codenomicon, Google, Open SSL and other providers. In addition to the factual timeline, there is some analysis/commentary as well.

Digital Signatures
This report is based on Arthur D. Little’s survey of 50 market experts in Europe, as well as comprehensive secondary market research. This report provides an overview of the digital signature technology, its current and potential market, as well as the benefits and challenges it brings. It also presents examples of practical applications of digital signature solutions.

Data Classification
Data classification is the practice of assigning information into predefined groups where each group has a common risk and corresponding security controls. This excerpt from JJ Stapleton's Security without Obscurity: A Guide to Confidentiality, Authentication, and Integrity discusses how information can be organized into categories based on its impact of unauthorized disclosure due to insider or outsider threats. It also discusses the concept of data tagging of other attributes that affect data management.

What You Need to Know First about Penetration Testing
This is an excerpt from Conducting Network Penetration and Espionage in a Global Environment by Bruce Middleton.

Introduction to Wireless Intrusion Detection Systems
This is an excerpt from The State of the Art in Intrusion Prevention and Detection edited by Al-Sakib Khan Pathan.

Security MetaMetrics
If you are struggling to make sense of security metrics, then check out Security MetaMetrics. Run by Krag Brotby and Gary Hinson, the website supports the global community adopting innovative measurement techniques. If you believe that you can’t manage what you don't measure, then visit Security MetaMetrics today and take the first step to measure and manage information security properly.

Anonymity in Network Communication
In today’s interactive network environment, where various types of organizations and individuals are eager to monitor and track Internet use, anonymity is one of the most powerful resources available to counterbalance the threat of unknown spectators and to ensure Internet privacy. Find out more in this excerpt from Anonymous Communication Networks: Protecting Privacy on the Web by Kun Peng.

Big Data
This month's issue of IT Performance Improvement focuses on Big Data. David Garmus provides "A Guide to Sizing and Estimating Projects." Michael West discusses how to measure the effects of process improvement. Carl Lehmann provides an overview of Kaplan and Norton's Balanced Scorecard. Also in this issue, Marco Sampietro and Tiziano Villa on "Reducing Change on Projects" and Nancy Settle-Murphy and Beatrice Briggs on building consensus.

Service-Oriented Architecture
This is an excerpt from Security for Service Oriented Architectures by Walter Williams.

Future Trends in WAN Security
This is an excerpt from Intrusion Detection in Wireless Ad-Hoc Networks edited by Nabendu Chaki and Rituparna Chaki.

Security Issues in Machine-to-Machine Communication
This is an excerpt from Security for Multihop Wireless Networks edited by Shafiullah Khan and Jaime Lloret Mauri.

Overcoming Top 10 Facilitation Fears
If you'd rather walk through fire than facilitate a virtual meeting, you're not alone! In this month's Communique, Nancy Settle-Murphy, author of Leading Effective Virtual Teams: Overcoming Time and Distance to Achieve Exceptional Results, and her colleague Dr. Keri Pearlson answer a few common questions from people who are thrust into the role of meeting facilitator, and would prefer to do practically anything but facilitate!

DDoS Threat Landscape Report
April 1, 2014 - Incapsula has released its "2013-2014 DDoS Threat Landscape Report." The study, which took place over 5 months and is based on records of over 154 million unique DDoS bot sessions. Incapsula's Evolution of DDoS report also uncovered emerging trends in DDoS amplification, namely that the vast majority (81%) of network DDoS attacks were multi-vector.

The Hybrid (Frugal) CISO
This excerpt from Kerry Ann Anderson's The Frugal CISO: Using Innovation and Smart Approaches to Maximize Your Security Posture presents theFrugal CISO as a hybrid professional. Frugal CISOs possess a diverse set of qualities and is adaptable in choosing to utilize them depending upon the specific circumstances in which they are operating. Being able to adapt to a variety of environments and circumstances is fundamental to information security that is dynamic and constantly under pressure to securely manage new technical innovations.

Killer Music: Hackers Exploit Vulnerabilities in Media Players to Infect User Machines with Advanced Malware
Listening to music can have a positive impact on our brain. And of course, music improves our mood because it triggers the release of the "pleasure chemical" Dopamine. But what most organizations don’t realise is that, while music can have a positive impact on its employees, the media players employees use to listen to their music of choice, or watch videos, can expose them, their machines, and their organization to risk of exploits and advanced malware infections.

Introduction to Wireless Intrusion Detection Systems
This excerpt from The State of the Art in Intrusion Prevention and Detection categorizes the typical operation of a common WIDS into six sections. These six categories are relevant for any IDS although the focus in the descriptions has concentrated on wireless IDSs. Discussion of the major attributes of each of these categories demonstrates that the choice of IDS characteristics can influence the performance of subsequent stages. Poor choices in the design of lower stages in the WIDS process can impact on the outcome of the entire system, leading to cascading suboptimal performance.

Internet Exploitation: The Web, Your Computer, Your IT System
In this excerpt from Trade Secret Theft, Industrial Espionage, and the China Threat, Carl Roper details vulnerabilities and attacks from hardware, software, and firmware (supply chain security issues) as well as network attacks.

McAfee Labs 2014 Threats Predictions Report: Cybercriminals Will Exploit Mobile Devices, the Cloud, and PCs
New technologies that enable business—like the cloud and mobile devices—are also attracting the attention of cybercriminals. In 2014, hackers are expected to exploit new attack surfaces and expand and refine their stealthy attack maneuvers. A view of what's expected in 2014: The BYOD trend is fueling attacks on mobile devices that will target enterprise infrastructures; Cybercrime exploits will become more difficult to detect than ever before; Nearly all major social media platforms will be subject to theft of user authentication credentials for the purpose of extracting user identity data.

Mobile Medical Devices
This is an excerpt from Chapter 6 of Wi-Fi Enabled Healthcare by Ali Youssef, Douglas McDonald II, Jon Linton, Bob Zemke, and Aaron Earle.

Before You Decide to Outsource
This is an excerpt from Chapter 3 of Managing Risk and Security in Outsourcing IT Services: Onshore, Offshore and the Cloud by Frank Siepmann.

Bitcoin Exchange in China—Gameover?
Cybercriminals’ interest in Bitcoin has continued to grow alongside the mainstream media’s heavy coverage of the currency and its high rate of adoption by both consumers and businesses. The surge in demand for Bitcoins in the Chinese market led to the currency’s sharp increase in value, as well as making BTC China the largest Bitcoin exchange. While a recent ban by the Chinese government on dealing with third-party Bitcoin exchanges has already taken its toll on the currency’s value, cybercriminals are going after the consumers who use Bitcoins.

New Series on Critical Infrastructure and Cybersecurity Engineering
Edited by Ross Leo, Chief Systems and Security Architect at Cirrus Informatics, Inc., the objectives of this series include providing timely, well-researched, and informative pieces on the specific areas and issues associated with safeguarding America's critical infrastructures.

Maintaining Professional Certification
This is an excerpt from The Basics of Achieving Professional Certification: Enhancing Your Credentials by Willis H. Thomas.

The Risk of an Uncertain Security Strategy
In spite of high-profile issues including LexisNexis and Evernote data breaches and the potential business impact of cyber attacks and data loss, small and mid-size organizations are not making cyber security a priority. Sophos and Ponemon Institute recently released Risk of an Uncertain Security Strategy, which reveals that security is not a key priority because IT is uncertain about their organization’s security strategy and the threats they face.

Leadership and Mentoring
This is an excerpt from The Four Components of a Fast-Paced Organization: Going Beyond Lean Sigma Tools by Robert Baird.

Creativity Life Cycle Models in Project Management
This is an excerpt from Creative, Efficient, and Effective Project Management by Ralph L. Kliem, PMP.

McAfee Labs Sees New Threats Subverting Digital Signature Validation
McAfee Labs today released the McAfee Labs Threats Report: Third Quarter 2013, which found new efforts to circumvent digital signature app validation on both PCs and Android-based devices. The McAfee Labs team identified a new family of mobile malware that allows an attacker to bypass the digital signature validation of apps on Android devices, which contributed to a 30 percent increase in Android-based malware. At the same time, traditional malware signed with digital signatures grew by 50 percent to more than 1.5 million samples. Less surprising but no less daunting was a 125 percent increase in spam.

Forensic Document Expertise
This chapter from Expert Bytes: Computer Expertise in Forensic Documents describes common scenarios in the work of forensic document examiners (FDEs), the objects they examine and the goals of the expertise. To calibrate their intended research projects, it is important that computer scientists know and understand what the issues are that FDEs have to solve.

Securing Storage
Like securing networks, securing storage involves logical and physical approaches. Given that there are different types of storage devices, systems and mediums to support various applications and usage from high performance online to low cost removable, multiple approaches are needed. Protecting the end-points--on one side the applications and servers (virtual and physical) that access storage and on the other end the storage itself--is part of the solution. Also involved is protecting the network on a local and remote basis. More ...

Security for the Enterprise Mobile Device Life Cycle
This article explains the entire life cycle of enterprise mobile device solutions, involving everything from policy to operations. It references a five-phase life cycle model to help organizations determine at what point in their mobile device solution deployments a recommendation may be relevant. Organizations may follow a project management methodology or life cycle model that does not directly map to the phases in the model presented here, but the types of tasks in the methodology and their sequencing are probably similar.

Data Protection: Setting the Right Objectives
Recognizing where there may be problems in an organization's data protection strategy is not enough. Organizations need to understand what the right objectives for the risk management part of a data protection strategy should be. Setting the right objectives is critical, but not necessarily easy.

CA Security Council on Code Signing
Code signing certificates from publicly trusted Certification Authorities (CAs) fulfill a vital need for authentication of software distributed over the Internet in our interconnected world. The CA Security Council (CASC) is starting an education initiative around code signing. The use of code signing certificates is not as popular as using SSL certificates, but the risk might be greater. To start the initiative off, the group has posted a white paper that provides an overview of code signing, some configuration choices, and best practices.

Should You Trust the NSA?
Here's a prescient article from 2000 by Ben Rothke. The National Security Agency plays a paradoxical role in security and encryption. Since the efficacy of the NSA is largely due to its ability to decode messages, strong cryptography is clearly a major threat to that ability. Since the agency is also involved with the creation of encryption standards, several well-known security experts answer the question, "Should the NSA be trusted?"

Defining Addressing Social Media Security and Privacy Challenges
Addressing information security and privacy within business organizations has provided numerous additional challenges with recently introduced technologies and comparatively new online habits of individuals. It is important when planning to take advantage of those benefits to also know and understand the associated risks, both to privacy and to network and information security.

Recent Industry Acquisitions Highlight Need for Big Data Heuristics to Deliver the Next Generation of Security
Cisco's recent acquisition of Sourcefire, for a whopping $2.7 billion (a 78 times multiple of projected earnings) has brought a lot of attention to next-generation security. Given the huge premium, and the fact that Cisco already has its own IDS/IPS, it should be apparent that it wasn't Sourcefire's IDS/IPS technology Cisco was after. It was Sourcefire's next-generation threat detection capabilities.

Defining Enterprise and Transformation Challenges
This is an excerpt from Enterprise Dynamics Sourcebook edited by Kenneth C. Hoffman, Christopher G. Glazner, William J. Bunting, Leonard A. Wojcik, and Anne Cady.

Setting the Foundation of an Enterprise Architecture
This excerpt from Enterprise Architecture and Information Assurance: Developing a Secure Foundation by James A. Scholz looks at ten processes that are by-products of security as the foundation of am enterprise architecture.

The Role of Data Governance in an Organization
Developing an appropriate data strategy that fits the marketplace is one necessary ingredient for business success. Effective data governance reduces uncertainty and helps improve an organization’s performance. An organization’s ability to collect pertinent information and act on signals that others miss provides it a strategic advantage.

Just Published! Information Security Management Handbook, Sixth Edition, Volume 7
All-in-all, this is a good volume of the Information Security Management Handbook. We are working on the next, all new 7th edition now. If you would like to contribute, please contact me at 917-351-7146 or

Taming the "21st Century's Wild West" of Cyberspace
The world faces unprecedented risks across the Internet in what has become known as "The 21st Century's Wild West," where attacks on computer systems and networks are generally conducted with the complete anonymity and impunity for those perpetrating these acts. Establishing a robust system of monitoring, controls, and sanctions to ensure that the Internet functions as a trusted and heavily defended environment that fosters cooperation, collaboration, and commerce will have a dramatic effect on the stability, viability, and resilience of our interconnected global economy.

Debunking the Myths about CAs and SSL Certificates
Over the years a few misconceptions about CAs and the SSL infrastructure have arisen. Despite reports and scare tactics about the collapse of the SSL/CA model, the CA Security Council (CASC) is here to set the record straight and dispel the myths of the industry. Here are nine myths and facts about CAs and SSL certificates.

An Ethics for the New (and Old) Surveillance
As the recent revelations about the NSA's Prism and Tempora programs shows, new surveillance technologies and various forms of electronic location monitoring raise important social, political, and cultural questions. This chapter suggests concepts to order the rich variation the topic offers across kinds of tools for collecting personal information and across various contexts regardless of whether they involve national security, work, commerce, family, or friends.

Enabling Pain-Free SSL Certificate Management
According to a recent Certificate Management Survey conducted by Symantec, one of the most significant issues facing businesses today is the sheer number of certificates there are to manage. In fact, organizations are now managing nearly 2,000 certificates on average. One-third of companies surveyed felt that their certificate catalogue is less than somewhat accurate. The average organization ended up losing $222,000 just in the last year due to a variety of certificate-related mishaps. This article provides best practices to effectively manage SSL certificates in order to maintain positive company perception and revenue.

Call for Book Chapters--Cryptography: Algorithms and Implementations Using C++
The main objective of this book is not only to describe the state of art cryptographic algorithms, but also to demonstrate how they can be implemented using a programming language; i.e., C++. Generally, books that discuss cryptographic algorithms do not elaborate the implementation issues. Therefore, a gap between the understanding and the implementation remains unattained. The motivation of this book is to seal that leakage and to educate someone in such way that he will be capable of developing and implementing his own designed cryptographic algorithm.

Green Servers and Data Centers
This chapter describes how to green your data centers and servers by choosing green suppliers when you buy in data center services. It explains why you should start now, and discusses planning buildings, power supplies, and servers, storage, and networking.

SCADA Security
There has been a wide interest in the secure design and implementation of smart grid systems. The SCADA system is on of the most important legacy systems of the smart grid systems. In this excerpt, the authors demonstrate the challenges to secure the current automation systems, such as SCADA systems, with examples.

Wireless Network Security: An Overview
Wherever wireless networks are deployed, security vulnerability will always exist. Security attacks and vulnerabilities can only be mitigated if best practices, as well as correct policies and standards, are used. This chapter discusses some of the important and best practices that can be implemented for improving mobile and wireless security. Wireless security will continue to be a research topic as long as there are ways to attack or obtain unauthorized access to wireless networks.

Subscribe to Information Security Today

E-mail Marketing by VerticalResponse

Google Reader or Homepage
Add to My Yahoo!

Bookmark and Share

Search the Site

The Blog


From Our Authors

Rebecca Herold: Privacy Professor Tips of the Month, August 2014—Enjoy the Season without the Privacy Pests

Nancy Settle-Murphy: CommuniqueDon't Leave Remote Participants Hanging: 8 Tips for a Meeting of Equals


Super Mobility Week in Las Vegas on September 9-11, 2014

SPTechCon on September 16-19 in Boston

Industrial Control Security Europe on September 29-30 in London

Cyber & Data Risk Insurance in New York City on September 29-30, 2014

Industrial Control Security Europe on October 6-7 in Sacramento, California

STARWEST on October 12-17, 2014 at Disneyworld in Anaheim, California

Big Data TechCon in San Francisco on October 27-29, 2014

AnDevCon on November 18-21 in San Francisco

Oil and Gas Cyber Security on November 24-25, 2014 in London

Big Data in Retail Financial Services on November 27, 2014 in London, UK


Here are links to all Rebecca Herold's monthly Privacy Professor Tips to date.

Guided Insights

© Copyright 2014 Auerbach Publications