|
|
|||
|
|
|
|||
Shon Harris TrainingShon's CornerGreat Resources from Shon Harris Library of Documents Main Library Area  COBIT© Standard Governance ISO Standard 27001/17799/BS7799 Security Awareness Security Policies SSE-CMM© *Quality versus Quantity* Forum Postings Exam on December 21 in New York City Need advise Dec. 13, 2008 Results help me CISSP---GROUP FOR DUBAI--March 2009 RBAC or RBAC??? Dreamed you fail the CISSP exam? Confused over the 'krutz' book many ppl have mentioned ... Does anyone know when the next AIO shon harris book is out ? Realistic date for sitting the exam - 2 choicesRecommended PodcastsCISSP's BlogsHere is a list of Blogs maintained by CISSP's. - Allen Baranov LEGAL INFO - Cyber Law Update ISO 17799/ISO 27001SurveysSecurity BooksTop10 Downloads· 1: Domain 1.zip
· 2: CRAM Study guide on the 10 domains of the CBK · 3: Study Guide for Domain 1 - Access control Systems and Methodologies · 4: Access Control Presentation · 5: Great Document on Security Models · 6: Overly Updated.pdf.zip · 7: Intro1.zip · 8: Domain 3.zip · 9: Domain 7.zip · 10: Cram Study Guide for Domain 1 - Access control Systems and Methodologies Top10 Links· 1: CISA et CISSP Quizzes
· 2: Exam Introduction and overview · 3: Ben Rothke's Web Site · 4: Resume of the 10 domains of the CBK · 5: Erik Chang, CISSP Study Resources · 6: 1. Information Security and Risks Management CBK Tutorial · 7: China CISSP Study Group · 8: International Information Systems Security Certifications Consortium Inc. · 9: Rob Slade's CISSP Books reviews · 10: Review of CISSP Training Material Who's OnlineThere are currently, 79 guest(s) and 15 member(s) that are online. You are Anonymous user. You can register for free by clicking here |  |
Copyright infringement and the CISSP, Part 1
|
||||||||||||||||||||||||||||||||||||||||||||||
| Contact the author: M. E. Kabay, Ph.D., CISSP-ISSMP, is Program Director of the Master of Science in Information Assurance at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site. |
(comments? | Score: 0)
Baseline Security Manual available online
Posted by boss on Wednesday, 22 February 2006 @ 05:00:00 EST (1223 reads)
Topic Docteur Kabay
By M. E. Kabay
For many years, I used the English-language _IT Baseline Security Manual_ created by the German Federal Office for Information Security (BSI: Bundesamt fur Sicherheit in der Informationstechnik) from its German-language _IT-Grundschutz Standard-Sicherheitmassnahmen_.
Some years ago, the English translation disappeared from the Web, and I continued to rely only on saved versions of the 1997 version. However, in recent correspondence, reader Claus Stark, the business information security officer of the Frankfurt office of Citigroup, very kindly pointed me to a new English translation of the 2004 version of the Baseline Security Manual available in PDF online.
The 269-page Introduction and Modules 2004 file (7.2 MB) starts with an overview of the documents (Chapter 1) and recommendations (Chapter 2) on the analysis and modeling of information systems security requirements and safeguards.
* Chapter 3 covers fundamentals such as security of personnel, contingency planning, data backups, anti-malware, cryptography and incident management.
* Chapter 4 looks at infrastructure (buildings, cabling, rooms, cabinets, telecommuting and operations centers).
* Chapter 5 discusses standalone systems such as PCs running DOS, Windows, Unix, and the like.
* Chapter 6 continues with networked systems.
* Chapter 7 continues with data transmission systems - data media, modems, firewalls, e-mail, Web servers, remote access, Lotus Notes, Internet Information Services, Apache Web server, Exchange/Outlook 2000, and routers and switches.
* Chapter 8 on telecommunications presents basic security principles and practices for PBXs, fax machines and servers, voice mail, ISDN connections, mobile phones and personal digital assistants.
* Chapter 9 adds notes on application software, databases, more on telecommuting, Novell eDirectory 8.6 and archiving.
The Threats Catalog (426 pages) includes:
* Force majeure
* Organizational shortcomings
* Human failures
* Technical failures
* Deliberate acts
The Safeguards Catalog (2056 pages) includes:
* Infrastructure
* Organization
* Personnel
* Hardware and software
* Communications
* Contingency planning
All the PDF documents have extensive bookmarks and are easily searchable. I am confident that security practitioners and system/network administrators will find these free documents a valuable addition to their libraries of reference resources
|
Contact the author: M. E. Kabay, Ph.D., CISSP-ISSMP, is Associate Professor in the Division of Business and Management at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site. New information assurance journal - Norwich University Journal of Information Assurance (NUJIA). See http://nujia.norwich.edu |
"
(comments? | Score: 0)
INFOSEC Year in Review database
Posted by cdupuis on Friday, 12 November 2004 @ 15:56:18 EST (1217 reads)
Topic Docteur Kabay
Today's focus: INFOSEC Year in Review database
By M. E. Kabay
Ten years ago, I was an adjunct professor in the Institute for Government Informatics Professionals in Ottawa, Canada under the aegis of the University of Ottawa. I taught a one-semester course introducing information security to government personnel, and I enjoyed the experience immensely. Many of the chapters of my 1996 textbook, _The NCSA Guide to Enterprise Security_, were field-tested by my students.
In 1995, I was asked if I could run a seminar for graduates of my courses to bring them up to date on developments across the entire field of information security. Our course had 20 students and I so enjoyed it that I continued to develop the material and teach the course with the NCSA (National Computer Security Association; later called ICSA and then eventually renamed TruSecure, its current name) all over the U.S., Canada, Europe, Asia and the Caribbean.
After a few years of working on this project, it became obvious that saving abstracts in a WordPerfect file was not going to cut it as an orderly method for organizing the increasing mass of information I was encountering in my research. I developed a simple database in 1997 and have continued to refine it ever since. The database allows me to store information in an orderly way and - most important - to _find_ the information quickly.
For that purpose, I put in as many keywords as I can think of quickly; I also classify each topic using a taxonomy that has grown in complexity and coverage over the years. These numerical codes help users locate articles quickly using filters (queries).
This year, I was privileged to begin working with Norwich students Karthik Raman (project leader), Krenar Komoni and Irfan Sehic as my research assistants. These excellent students have provided invaluable assistance in transferring data from NewsScan, NIPC/DHS reports and other sources into the database and have also done the first cut of classification and keyword generation. They have enormously improved the coverage of the field and are continuing their work with me to expand the database to further sources in the coming year. It is difficult to estimate the hundreds of hours of time they have saved me.
The IYIR reports are posted on my Web site now; see the introductory page at:
http://www2.norwich.edu/mkabay/index.htm
Click on the IYIR button for a list of PDF files you can read on screen, search, or print out at will. So far I'm up to 2003.
In addition, I have posted the complete abstracts as a Microsoft Access database file (.MDB) as well as a compressed version (.ZIP) on the Web site for use by anyone for non-commercial purposes. On the Web page, I will post the date I update the files.? I hope that these resources will be helpful to the IA community as we variously prepare articles and lectures for readers and students. Have fun.
To contact: M. E. Kabay
M. E. Kabay, Ph.D., CISSP
Associate Professor in the Division of Business and Management
Norwich University in Northfield, Vt.?
Mich can be reached by e-mail
Master's degree in the management of information assurance in 18 months of study online from a real university - see:
(comments? | Score: 0)
An iron vault for passwords # Today's and Tomorrow's solutions
Posted by cdupuis on Wednesday, 08 September 2004 @ 00:01:05 EDT (1470 reads)
Topic Docteur Kabay
By M. E. Kabay
How do your users handle so many passwords? Badly, I'm sure.
I recall one poor, overworked system administrator whom I met on a security assessment of a large corporation some years ago; he sheepishly admitted that he had 15 administrator passwords - and kept them written in plaintext on a piece of cardboard in his wallet. One of the oldest social engineering tricks around is for a criminal hacker to make a sys admin drunk or sleepy and rifle through his or her belongings in a search for such a list.
It's known as a bingo card because finding it makes the hacker say, "Bingo!"
Some users store their passwords in files. Putting passwords in an unencrypted, unprotected file is little better than writing them on cardboard, and so people have been turning to a more sophisticated approach: using special password storage programs that provide encryption and access controls. When a user visits a Web site, the password utility fills in the right user ID and password; some products go further and fill in names, addresses and even credit-card numbers.
Examples include:
* Advanced Password Manager
http://www.rayslab.com/password_manager/password_manager.html* Internet Explorer's own AutoComplete and Profile Assistant?functions?To manager these functions in IE v6, use Tools | Internet???Options | Content
* KeyPass from Dobysoft?http://www.dobysoft.com/products/keypass/
* LoginWallet for Macintosh?http://www.public.asu.edu/~cjfoste/LoginWallet/
* My Password Manager 0.1 for Mac and Unix?http://www.nwfusion.com/nlsec564
* Norton Password Manager (part of the Norton SystemWorks suite) http://www.symantec.com/passwordmanager/
* Opera browser's own Wand function???To manage this function in Opera v7, use Tools | Preferences |?Security | Manager Wand passwords
* PasswordLock?http://www.internetpeace.com/pwlman/password_wallet.htm
* Password Manager XP?http://www.cp-lab.com/
* Password Wallet from InfoCard?http://www.winsite.com/bin/Info?4000000037217
* Password Wallet from TigerSoft?http://www.inet.hr/tigersoft/pwallet.htm
* PasswordWallet for PalmOS and for Macintosh?http://www.selznick.com/products/passwordwallet/
* RoboForm?http://www.roboform.com/
Naturally, with all this ultra-sensitive information in a single location, the password file is a tempting target for attackers.
Lark Allen is executive vice president of Wave Systems. He recently wrote to me about protecting centralized password files using hardware controls. The following is an edited version of Allen's comments:
Although existing systems use software security to protect logon information, we know that security breaches involving software vulnerabilities are a constant worry. To respond to this class of vulnerabilities, the Trusted Computing Group (TCG) has developed new security hardware specifications.
A Trusted Platform Module (TPM) is a hardware security chip based on open industry specifications developed by the TCG. The TPM provides important new security functions such as:
* Secure storage - A place to protect secrets in hardware,?including encryption keys for data and credentials for users and?platforms.
* Authentication - The ability to determine that a user or a?platform really is who they claim to be.
* Binding data to a platform - Assuring that sensitive?information cannot be moved to other platforms without?permission.
* Platform trustworthiness measurement - Determining whether a?PC can be trusted or has been compromised.
A TPM is currently being shipped in some PCs from Fujitsu, HP, IBM and Intel. Many companies are working on applications that take advantage of the hardware security of the TPM. Wave Systems' Private Information Manager (PIM) is the first TPM-protected wallet for managing personal information, including identities and passwords. The PIM wallet uses the TPM hardware to protect the keys for encrypting the sensitive information held in the wallet. In addition, the TPM is used to authenticate the user as part of the wallet's access controls.
Strong multifactor authentication, including the use of a biometric fingerprint, with or without an associated password, can be specified and applied to individual wallets for different people.
Some attacks install a keystroke logger on the user's PC to collect passwords, PINs, and other personal information as users enter their account and password data. Wave's PIM wallet does not allow the login information being automatically filled in for the user to be captured by keystroke-loggers.
The TCG is continuing its work to improve security on cell phones, personal digital assistants, peripherals, and other devices.
Trusted computing should not only increase protection of user information but also simplify the user's life in dealing with the new electronic world.
* * *
As a matter of record, I have no financial interest whatever in any of the products or companies mentioned in this article.? Inclusion of a product does not imply endorsement or recommendation; exclusion does not imply criticism. - Mich
RELATED EDITORIAL LINKS
Trusted Computing Group?
The Password Is... Confusion?
http://www.technewsworld.com/story/18937.htmlTo contact: M. E. Kabay
M. E. Kabay, Ph.D., CISSP, is Associate Professor in the Division of Business and Management at Norwich University in Northfield, Vt. Mich can be reached by e-mail mailto:mkabay@norwich.edu
> and his Web site http://www2.norwich.edu/mkabay/index.htm>.A Master's degree in the management of information assurance in 18 months of study online from a real university - see http://www3.norwich.edu/msia
>(comments? | Score: 0)
Call for Input from a great friend of CCCure.Org: Doctor Kabay
Posted by cdupuis on Tuesday, 31 August 2004 @ 22:24:54 EDT (1040 reads)
Topic Docteur Kabay
By M. E. Kabay
Teaching information assurance requires a tricky balance between technical subjects and management skills. We academics sometimes flounder in curriculum design because of the fundamental dearth of sound, statistics-based information about security issues.
We have problems gathering data for IA because:
* As far as we can tell, many or perhaps most computer?intrusions and computer crimes go undetected (estimates range?from nine out of 10 crimes to two out of three intrusions).
* Many detected intrusions or crimes are unreported (perhaps as???many as 95%, according to some studies).
* There is no central database keeping track of computer crimes?or security breaches.
* Almost all computer-security surveys suffer from?methodological inadequacies (they rely on voluntary responses,?have no independent verification of the accuracy of answers, and?don't include internal validation measures to catch careless or?silly answers).
We are left with the hope that forging consensus on best practices is one of the approaches that can improve IA. Under these circumstances, you'll understand how important it is for academics to get information directly from practitioners when designing courses.
Professor John Beachboard of Idaho State University is doing precisely that. In a recent call for participation sent through a security-educators' list, he explained that "Business-oriented MIS and CIS programs have tended to emphasize requirements analysis and business application development over the development of technical skills and knowledge associated with development and operation of IT infrastructures. Many business schools are now adding courses (e.g., in data communications and systems architecture) intended to fill this gap."
He has developed a survey designed "to gain practitioner input regarding the fundamental technical concepts that all aspiring IS/IT professionals should be taught in an undergraduate systems architecture course."
His survey is here:
http://cobhomepages.cob.isu.edu/beach/survey/1.aspAnd it took me only a few minutes to complete.
Beachboard will send results of his analysis to any participants who would like to be informed of the findings. I hope that readers will be willing to take the time to help him and the field as a whole by participating in this research.
(comments? | Score: 0)
Tips for evaluating security training (part 1)
Posted by cdupuis on Wednesday, 31 March 2004 @ 10:45:25 EST (1214 reads)
Topic Docteur Kabay
http://www.nwfusion.com/newsletters/sec/2004/0322sec1.html ?
Sign up to receive this and other networking newsletters in your inbox.
By?M. E. Kabay
Network World Security Newsletter, 03/23/04
At a recent conference, Roger Quane of the National Security Agency in the U.S. Department of Defense presented a stimulating lecture on ?Evaluation Activities: Management?s Nightmare or Dream Come True.?
Speaking at the March 2004 Annual Conference of the Federal Information Systems Security Educators? Association (FISSEA) at the University of Maryland campus, Quane pointed out that evaluation metrics for training programs can be ranked by difficulty as follows:
* Reaction - how participants like the program.
* Learning - what the participants can show they have learned.
* Application - how the participants apply their knowledge in their work.
* Business impact - the effects on how the organization runs its operations.
* ROI - monetary measures of benefit divided by costs required to achieve.
The role of the manager is critical; the manager leads the project and is responsible for its success. To avoid conflict of interest, the manager should have someone else evaluate the program.
Such evaluations are often needed to see if the training program is justified or worthwhile; unfortunately, says Quane, sometimes managers are confronted with a stark choice between honesty and what may seem like professional survival. Regardless of the apparent danger, honesty is the only policy that makes sense. If a program hasn?t worked out, it?s important to say so and take the consequences (?falling on one?s sword? in Quane?s description). In reality, such honest self-appraisal is rarely treated as grounds for dismissal.
In general, Quane recommends that formal evaluations not be applied to projects that cost less than $100,000. In addition, the projects should have organizational visibility, must be needed for organizational success, should be relatively new, and should be requirements-driven (i.e., not simply done because everyone has to do it).
Not every training project should be evaluated, says Quane, but it is essential that evaluations be carried out in sequence. First you have to collect information about participation reactions, then you can study how well they learned, and only after that should you look at behavior in the workplace. Each of these levels is more complex and more expensive to measure than the previous one. Measuring effects of training on security is much more complex and will be the subject of a separate article.
Reminder: Robert Gezelter, author of last Tuesday's Security Newsletter, will be presenting a session entitled "Internet Dial Tones & Firewalls: One Policy Does Not Fit All," at two Central Florida IEEE Computer Society chapter meetings this week. Click here (http://www.rlgsc.com/ieee/tampa/2004-3/announce.html?Source=NWFUbiquitous2004-03) for details about the session in Tampa on Wednesday, and here (http://www.rlgsc.com/ieee/orlando/2004-3/announce.html?Source=NWFUbiquitous2004-03) for the event in Orlando on Thursday.
RELATED LINKS
M. E. Kabay, Ph.D., CISSP, is Associate Professor in the Department of Computer Information Systems at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site.
Come to the? Sixth Annual e-ProtectIT Infrastructure Protection Conference?at Norwich University in Northfield, Vt., March 23-25, 2004.
All contents copyright 1995-2003 Network World, Inc. http://www.nwfusion.com
(comments? | Score: 0)
Tips for Evaluating Security Training (part 2)
Posted by cdupuis on Wednesday, 31 March 2004 @ 08:28:59 EST (1628 reads)
Topic Docteur Kabay
Today's focus: Tips for evaluating security training, Part 2
By M. E. Kabay
Measuring ROI is growing in popularity among managers, especially those with a strong background in finance. The ROI methodology for training and education has been developed and applied over the last 20 years and is being used in thousands of impact studies every year.
However, ROI is the most complex and expensive measure of value for any program and should be limited to those programs where the exercise will have an operational effect; that is, no one should undertake an ROI exercise without having a specific goal in mind such as a go/no-go decision or a decision on increase in funding.
Contrary to a common misconception, ROI evaluations are not limited to producing a single number consisting of monetary benefits divided by costs, pointed out Jack Phillips, chairman of the ROI Institute, at the March 2004 Annual Conference of the Federal Information Systems Security Educators' Association.
Phillips argued that the ROI process generates six types of data:
* Reaction, satisfaction and planned actions.
* Learning.
* Application and implementation.
* Business impact.
* Return on investment.
* Intangible measures.
An effective application of the ROI methodology, according to Phillips, can
* Align programs to business needs.
* Show contributions of selected programs.
* Earn the respect of senior management and administrators.
* Build staff morale.
* Justify and defend budgets.
* Improve support for human resources, learning and development.
* Enhance the design and implementation process.
* Identify inefficient programs that need to be redesigned or?eliminated.
* Identify successful programs that can be implemented in other?areas.
Phillips presented a thoroughgoing evaluation process, which is described in Patricia Phillips' book entitled _The Bottomline on ROI_.
The ROI Institute runs a closed Web site for its 600 members; visitors are permitted to send e-mail to a contact address for further information.
RELATED EDITORIAL LINKS
ROI Institute
Measuring ROI in the Public Sector
The Bottomline on ROI
Network World, 03/29/04
http://www.nwfusion.com/news/2004/0329q1.html
To contact: M. E. Kabay
M. E. Kabay, Ph.D., CISSP, is Associate Professor in the Department of Computer Information Systems at Norwich University in Northfield, Vt. Mich can be reached by e-mail mailto:mkabay@norwich.edu
> and his Web site http://www2.norwich.edu/mkabay/index.htm>. Archive of the Security newsletter:http://www.nwfusion.com/newsletters/sec/index.html
(comments? | Score: 0)
E-ProtectIT Conference
Posted by cdupuis on Wednesday, 17 March 2004 @ 17:11:41 EST (972 reads)
Topic Docteur Kabay
E-ProtectIT 6
By M. E. Kabay
I invite you to attend the Sixth Annual e-ProtectIT Infrastructure Protection Conference at Norwich University in Northfield, Vt., March 23-25. As Program Chair, I'm delighted to announce another excellent lineup of workshops and speakers.
We start with three concurrent two-day workshops on Tuesday and Wednesday. World-famous forensic scientist Peter Stephenson will present a tutorial on network forensics. Peter's workshops have been well attended and much appreciated in previous e-ProtectIT conferences.
Norwich CIO and Vice President of Technology & Strategic Partnerships Phil Susmann will present his sparkling introduction to information security. Phil is a gifted teacher whose courses are not only informative but also stimulating and fun.
Finally, I will give my annual INFOSEC Update workshop, in which I stuff participants with this year's results of the ongoing INFOSEC Year in Review project. Typically we have about 25 people in the workshop, and we review around 300 pages of abstracts classified according to a taxonomic scheme that starts with computer crime cases, new viruses, and other threats and then progresses through evolving vulnerabilities, management issues, developments in cryptography, and legal issues.
The colloquium on Thursday has a fascinating series of speakers and topics.
* The conference opens with distinguished keynote speaker Gen. Alfred Gray, USMC (Ret.), former commandant of the Marine Corps and a member of the Joint Chiefs of Staff.
* Our next speaker is Dan Wolf, director of information assurance at the National Security Agency. His topic is "Educational Collaboration as an Essential Component of National security."
* Rob Rosenberger of Vmyths fame is a military historian who has just returned from four months duty in Iraq. He will present a shocking case study entitled, "Antivirus Firms Threaten U.S. National Security."
* Patrick Gallagher, former director of the National Computer Security Center at the NSA and affectionately known as the Father of the Rainbow Series, will speak on "Technology, Public Policy and Social Change: Finding the Dots and Connecting Them."
* Yonah Alexander, noted author and director of the International Center for Terrorism Studies (ICTS) of the Potomac Institute for Policy Studies, will speak on "Perspectives on Cyberterrorism."
* R. Pierce Reid, Vice President of Marketing for Qovia, will speak on "The Role of Fear, Uncertainty and Doubt in Marketing Security."
* Maj. Gen. Jack D'Araujo, Army National Guard (Ret.), will speak on "Cyber Simulation - Preparing for Cyberwar."
* The last presentation will be a spirited panel discussion on "Integrating IA Across the Curriculum" with professors from Champlain College, Dartmouth College, Norwich University, University of Vermont, U.S. Military Academy at West Point, and William (Vic) Maconachy, program manager of the National INFOSEC Education and Training Program of the NSA.
Finally, I invite anyone interested in helping to sponsor the conference to pay special attention to the sponsorship opportunities described at:
http://www.e-protectit.org/sponsorship.htm>
Sponsorship allows us to keep the base price down to $495 for three days and $195 for the colloquium alone. Sponsorship also allows us to provide minimal prices to law enforcement officials and members of the armed forces of the U.S.
Full information and registration is available on the conference Web site at: http://www.e-protectIT.org
http://www.e-protectit.org/>Join us!
"(comments? | Score: 0)
Fifth e-protectIT Infrastructure Protection
Posted by cdupuis on Friday, 31 January 2003 @ 21:22:31 EST (1325 reads)
Topic Docteur Kabay
Fifth e-protectIT Infrastructure Protection conference
25-27 March 2003
Norwich University, Northfield, Vermont
Addressing the need to make information security a high priority in all aspects of today's world, Norwich University invites you to join us for two days of pre-conference training in computer forensics, INFOSEC basics, and the yearly INFOSEC UPDATE on Tuesday and Wednesday the 25-26 March 2003 and then to participate in the one-day colloquium on Thursday the 27th of March 2003.
Speakers with practical experience in securing all sectors of society will share their insights in an open forum with many opportunities for stimulating discussions.
Full details of the program, speakers, sponsorship opportunities and registration, see:
M. E. Kabay, PhD, CISSP # Program Chair
* Assoc. Prof. Info. Assurance
* Prog. Dir., MSc in Info. Assurance
Norwich University, Northfield VT
+1.802.479.7937
mailto:mkabay@norwich.edu
(Read More... | 1 comment | Score: 0)
New book by one of CCCure.Org contributing member.
Posted by cdupuis on Sunday, 13 October 2002 @ 17:36:55 EDT (1074 reads)
Topic Docteur Kabay
DESCRIPTION OF THE BOOK:
The definitive formula for computer security, from power outages to theft and sabotage.
Whether you are in charge of many computers, or even one important one, there are immediate steps you can take to safeguard your company?s computer system and its contents.
The Computer Security Handbook provides a readable and comprehensive resource for protecting computer mainframe systems and PC networks. This Fourth Edition continues a long tradition of maintaining highly regarded industry guidelines for detecting virtually every possible threat to your system and prescribes specific actions you can take to eliminate them.
The collected chapters are written by renowned industry professionals. Requiring minimal technical knowledge to understand, covered topics include: foundations of computer security, threats and vulnerabilities, prevention (technical defenses and human factors), detection, remediation, management?s role, and other considerations such as using encryption internationally, anonymity and identity in cyberspace, and censorship.
Protect the information and networks that are vital to your organization with Computer Security Handbook, Fourth Edition.
Click here to get more details from Amazon or simply to preorder your own copy now.
(Read More... | 1 comment | Score: 0)
Two introductory security courses
Posted by cdupuis on Tuesday, 02 April 2002 @ 21:06:11 EST (1185 reads)
Topic Docteur Kabay
NOTE FROM CLEMENT: Below you have a copy of M.E. Kabay newsletter, it has some real good links to resources online to learn about security, and it happen to match very well with the 10 domains of the CBK.
By M.E. Kabay
My friend and colleague David Kennedy, chief curmudgeon (and director of research) at ICSA Labs, recently forwarded news of an interesting resource for teaching and learning information security.
Wanja Eric Naef (w.naef@iwar.org.uk) has announced that Mark Burgess, associate professor in the Faculty of Engineering at University College in Oslo, Norway, kindly gave him permission to mirror his introductory security course at:
http://www.iwar.org.uk/comsec/resources/security-lecture/index.html
The 14 lectures are available in English as well as in Norwegian:
1. What is security?
2. Trust and Risk Analysis
3. Basic Information Security
4. Identity & Authentication
5. Protocols & Data Integrity
6. Access control
7. Security models
8. Object orientation
9. Software security I
10. Software security II
11. Encryption
12. Intrusion detection
13. Internet security
14. Site security summary
Click Read More... Above for the full story.
(Read More... | 3477 bytes more | comments? | Score: 4)
Login here
Our Sponsors
CCCure Supporters
Random Headlines
[ OCSIG Tech News ]
Today's Big Story
Past Articles
| Thursday, February 28 | |
| · | A great book on intrusion detection |
| Wednesday, May 23 | |
| · | PKI Primer from M.E. Kabay, PhD, CISSP - Part 7 |
| Wednesday, May 16 | |
| · | CAREER ADVICE - BREAKING INTO INFOSEC |
| Monday, May 14 | |
| · | PKI Primer from M.E. Kabay, PhD, CISSP - Part 6 |
| Thursday, May 10 | |
| · | PKI Primer from Doctor kabay - Part 5 |
| Monday, April 30 | |
| · | PKI Primer from Doctor kabay - Part 4 |
| Monday, April 23 | |
| · | PKI Primer from Doctor kabay - Part 3 |
| Thursday, April 19 | |
| · | PKI Primer from Doctor kabay - Part 2 |
| Wednesday, April 11 | |
| · | PKI Primer from Doctor kabay |
| Monday, April 02 | |
| · | Articles from Mich Kabay |
Recommended
Most Active Members
Total points: 10900
· 2: Lopezco
Total points: 8443
· 3: cissp_newbie
Total points: 7586
· 4: cdupuis
Total points: 5596
· 5: mikeyoung_fla
Total points: 5301
· 6: Vladimir
Total points: 4605
· 7: MMM
Total points: 2969
· 8: vijayu
Total points: 1859
· 9: Deepakseth
Total points: 1714
· 10: educk
Total points: 1311
The comments are property of their posters, all the rest © 2007 by CCCure.Org, and the site maintainers Clement Dupuis and Nathalie Lambert. Reuse is strictly prohibited without written permission of CCCure.Org or it's maintainers.
This web site is not associated directly or indirectly with ISC2, the SANS Institute, ISACA, or other certification authority. The GCFW, CISSP, SSCP, ISSEP, ISSMP, CISA, and CISM are all the property of their respecful owners. The content of this site is provided to you freely due to the generosity of our sponsors.
- Home Page
- Start Here
- Contribute
- Quizzes
- CISSP Quizzes
- CISA Quizzes
- Contributed Quizzes
- CISSP
- Coming Soon
- CISSP
- Forums
- Mailing Lists
- Contact Us
- Certifications
- ISC2 Certifications
- CISSP
- CISSP CBT By Shon Harris
- CISSP Total Learning Package
- CISSP Documents
- CISSP FAQ
- CISSP in the news
- CISSP Quizzes
- CISSP Study Books
- Official ISC2 Book Errata
- CISSP Study Forums
- CISSP Study Guides
- CISSP Study Group HOWTO
- CISSP Study Links
- CISSP Study Mailing List
- CISSP Study Tips
- CISSP Training
- SearchSecurity CISSP Webcasts
- ISC2 Official Webstore
- How to get CPE's
- LinkedIn for CISSP
- SSCP
- ISC2 CAP
- ISC2 ISSEP
- ISC2 Information
- CISSP
- ISACA
- SANS GIAC
- GCFW Certification
- ISC2 Certifications
- Tutorials
- Contributed
- CCCure Flash Tutorials
- Training
- Career
- Magazines
- EDPACS
- Hackin9
- Information Security Magazine
- Information System Management Magazine
- The official journal of ISC2
- InfoSecurity Magazine UK Version
- InfoSecurity Magazine US Version
- Journal of Digital Forensics
- Journal of OC and Electronic Commerce
- Conferences
- Study Books
Page Generation: 1.16 Seconds