A CEO's tale of disappointment
I met the CEO of a holding company on a recent flight to North Carolina. Our conversation started on the topic of my 'Art of War' column. The column, I explained, is focused on sharing Sun Tzu's insights on strategy with information security practitioners. At firts he was silent, but I could tell something was wrong.
The effect of paradigms on our perspective of security.
“Your paradigm is so intrinsic to your mental process that you are hardly aware of its existence, until you try to communicate with someone with a different paradigm.” --Donella Meadows For some of us, security is realized through physical and network controls that address the risks to a given environment. Others view techniques aimed at education and user empowerment as critical to organizational security. Then there are those who march onto the risk landscape under the banner of effective governance and oversight.

Business Continuity Event Planning: The Incident Response Team
No amount of planning or redundancy can prevent process failure. When a BCE occurs, an effective response helps ensure minimal impact on customers, employees, and investors. It also provides input into a process which incrementally improves both prevention and response.
Business Continuity Event Planning: Documentation Overview
We continue with our look at Business Continuity Event Management (BCEM) planning by looking at developing and managing the two key BCEM documents: the incident response plan (IRP) and the business continuity plan (BCP).
Business Continuity Event Planning: Business Impact Analysis (BIA)
BIA is a continuous process, with repeated analysis when new systems are implemented, major upgrades occur, or processes change. The output of the BCEM BIA includes not only useful insight into business continuity event risk and ways to mitigate it. It also includes documented controls and event response processes ensuring rapid detection and effective recovery of failed process components. In this article, we step through how to conduct a BIA as part of business continuity event management.

Major flaw found in .pdf reader
Core security says they've found a major bug in a .pdf browsing product and will release more information on the problem Tuesday.
Sarah Palin hackers hit the wrong Yahoo account
If hackers hit Governor Sarah Palin's Yahoo account looking for official state business, then they broke into the wrong account.
Black Hat: Litchfield's Oracle talk nixed
David Litchfield has canceled his Black Hat talk on Oracle. Blame it on the price of gas.

It’s Just That Simple Amos!
CSIRT’s are easy to setup and run. Just ask the C-Suite.
Certifications Have Value
What do you do when HR questions you on the value of security certifications?
Little Known Fact - People Security Has Solid Training Packages!
If you want solid training on how to write 'proper' code - see peoplesecurity.com!

Virtual Affair, Real Divorce: Selling Cyberethics at Home & Work
Recent news headlines are full of intriguing stories about real-life consequences to virtual actions at home and work. Virtual world travels, combined with Web 2.0 interactions, are merging with real life behaviors at the office as never before. Security professionals had better take notice - now.
A new post-election Internet security paradigm?
From Newsweek to The Drudge Report to The Huffington Post, it seems that everyone is talking about an unexpected big winner on election night - The Internet.
Research.gov Worth A Visit
NASA has joined the National Science Foundations (NSF's) Research.gov portal. The site offers great information on federally funded research projects, grants, policies and more.

Trojan Horse Contracts?
Vendor contracts are increasingly including provisions that could lead to breaches of security. At first glance, these types of provisions may appear innocuous, but they create the circumstances under which compromises of security may occur. A few examples:
Basic Elements of Document Retention Policies
Following up on my last posting, this week I talk about the basic elements of a document retention policy. While a review of the broad range of applicable laws cannot be addressed here, there are certain general guidelines for the establishment and implementation of a retention program that should be considered in developing a policy:
Document Retention Policies May Decrease Litigation Costs
Most businesses have retention policies governing how long documents are to be retained before being destroyed or discarded. A growing number of businesses are extending their existing retention policies to include electronic documents, particularly e-mail. For example, a common retention policy for e-mail would require deletion after 60 days. In many instances, the deletion is accomplished automatically by programming the business’ computers to review the dates on e-mail and to delete those messages having dates beyond the allowed limit. If an employee desires to retain a message past the automatic deletion date, she must take affirmative action to preserve the e-mail (for example, contact the MIS department or copy the e-mail to a special directory).

Two identity pieces for a Friday
There are two identity-related pieces I wanted to highlight for some Friday reading:
Quest acquires NetPro Computing
Coming off an extremely successful Digital ID World conference, we've got an acquisition to take note of, as Quest Softwa
Jon Oltsik nails it
Jon Oltsik has a blog post up that absolutely nails what should be going on in the world on NAC and

The best-laid plans of mice and men sometimes go for naught
You can invest years in protecting the integrity and resiliency of your business...and then along comes something out of left field and you're ruined...just ask Indymac Bank.
Snapshot of the Gartner IT Security Summit
This week's Gartner IT Security Summit saw some new things...but how much Gartner can anyone take in three days?
Do we need whistle-blower laws in security?
Following the firing of a TJX staffer for disclosing ongoing security failings at the retailer, should we protect those who disclose?

Recent Moves: UMass Memorial Hospital Names Aske CISO
New position for former CSO of state Health and Human Services
Bank of the West Names Ford CSO
FBI veteran Joseph Ford to lead integrated security operations
Dassault Systemes names Swiatek CISO
Dassault Systemes has named Dr. Wojtek Swiatek Chief Information Security Officer.

Olympics - Forensic Files?
Is nothing safe from forensics? It seems everything can be found out!
This Could Happen To You
I'm just glad this wasn't me
Email Scams - Will It Ever End?
How Dumb Do You Really Think We Are?