Links Directory

Might have been better in vendors, but ...

Good article from ISMH 1998 edition

US government and military sponsored program to assess face recognition biometric products.

Pawsense is a program to determine whether a cat has been walking across your keyboard, and to disable the keyboard input until reactivated. It's a bit of a joke, but an example of keystroke analysis biometrics.

Various resources

Information sharing project to detect and reduce bots and botnets

A new way for marketers and malicious sites to store and use information on your computer.

Rich Skrenta created probably the second or third computer virus.

Excellent presentation (but then, everything Ross does is worth noting) on botnets, related malware and fraud, and the command and control systems. Interesting research on the various types that are more resistant to takedown.

Rather simplistic but possibly handy overview of malware and surfing threats

Part of the Software Assurance program, a project of the Strategic Initiatives Branch of the National Cyber Security Division (NCSD) of the Department of Homeland Security (DHS). The Software Engineering Institute (SEI) provides support, and, with other contributors, develops and collects software assurance/security information to help software developers and security practitioners create secure systems. Based on software engineering and addressing a software development life cycle. Links to best practices, tools, guidelines, rules, principles, and other resources.

Thoughts from the Google development security team: some useful points in regard to secure Web apps.

Interesting discussion of cheating in online gaming and implications for application security.

Most of the white papers are a bit thin and "rah rah," but the security newsletter does have some worthwhile pieces.

Create threat model documents for applications using entry points, assets, trust levels, data flow diagrams, threats, threat trees, and vulnerabilities

Example of permission or privilege hijacking on Windows XP and Vista. (PDF)

Note also that resources for Web development security can be found under the Telecom category. (NB: due to technical limitations, this link is recursive ...)

Guidance on forming and operating a computer security incident response team (CSIRT)

Fairly simplistic explanation of the home router DNS attack.

In Canada you'll get the mail back, postage due ...

Interesting discussion of cheating in online gaming and implications for application security.

You may have seen or heard of Peter Gutman's review of Vista. Despite controversy, it has some important things to say not only about DRM, but also about the security of the platform, in certain respects. (For example, the DoS possibilities, and also the new impetus for hackers of all stripes to delve into the internals of the system.)

Satirical article on how not to review security (antivirus) software. Although Sarah Tanner, a secretary, is credited with the artice, it was actually written by Alan Solomon

Classic paper on "how far back do you have to check?" (This paper has spawned a widely held myth that Thompson actually did create a backdoor into all versions of UNIX and every program created with C.)

Excerpt from the book, detailing the flaws in "security by obscurity"

Gene Spafford on our "putting out fires" mentality

Want to know how to have more secure logins online? Don't ask the banks ...

Interesting video commentary from the UK on photography in public places.

Cartoons based on subject lines in spam messages.

Colbert Report take on the Protect America Act. Political and biased, but amusing look at aspects of privacy and surveillance.

Cute video on mailing list/forum/group netiquette

A cute pictorial essay (PDF) with pictures of unsafe and insecure working situations. (Don't try these at home ...)

Some fun advertising videos from Iron Mountain starring John Cleese.

An extremely long, but somewhat amusing, ad for Kaspersky, in old silent movie style.

Amusing commentary on the Playmobil Security Check Point toy

Practicing safe hex, version 2. Since I use key signing parties when teaching about digital signatures and certification, I probably found this *way* too funny ...

Amusing list of excuses we've all heard before. (I wonder where the master list is?)

Cute and sometimes painfully accurate

Some decent reminders of safe practices

We were discussing DNA identification, and someone came up with this ad for a PCR machine ...

Australian video, "would anybody be stupid enough to let a trojan horse in today?"

Funny, but rather profane

My kinda cartoon. Besides, if you haven't looked through xkcd, you should.

A game to help people recognize phishing sites

Mostly research

A list of free security utilities by category. Could quibble about whether they are all best of breed, but a handy list for home and small office users.

Interesting project to provide low-cost computers for education in developing countries. Security implications, anyone?

Almost no tutorial value, but some crypto fun and a bit of history.

Colossus was the "brute force" part of the attack against Enigma during the second world war. Recently one of the devices was rebuilt.

Kerchoff was right: proprietary and secret systems need to be viewed with extreme suspicion.

Various stuff by a science popularizer

GnuPG developers

Home of the project

Download and install

Open-source disk encryption software

Guidance on forming and operating a computer security incident response team (CSIRT)

List of resources and documents

Tips for detecting falsehoods in interviewing and interrogation.

US NIJ simple guide for collecting digital evidence. (PDF)

Information about the Canadian Do-Not-Call list and legislation, as well as an "opt out" message generator to get you off the lists of "exempt" organizations.

Intended to enable communicating organisations to include privacy enhancing technologies (PETs) in large-scale web-based services for the general public and customers.

Map listing the different aspects of data breach notification laws in the US: click on a state and a popup box gives you specifics.

They don't even spell it right ...

Create threat model documents for applications using entry points, assets, trust levels, data flow diagrams, threats, threat trees, and vulnerabilities

Advice for hardening

Instructions and recommendations for security of Windows Vista in a domain with Active Directory

Recommendations about how to harden computers that run Windows XP with SP2

Listings for local groups in a number of places. Some aren't representative of the local scene.

Relatively new group, starting some local chapters

According to Bob Tremonti, the Security Professionals Information Exchange (www.SPIE.ca) meets the last Thursday of the month (plus a rather secretive sub-group of security folks in the energy sector), and the Disaster Recovey Information Exchange (DRIE West) meets -- well, it meets when someone finaly gets a meeting organized ...

Paper advising on termination procedures for sensitive positions

Operational risk is how the banks refer to what we know as risk management.

Fairly hefty process, but some interesting ideas for risk assessment.

Limited articles and papers on risk management.

Various guides and papers

Sample documents for the method

Security assessment framework from the Open Information System Security Group (OSSIG, www.oissg.org), mostly concentrating on pen testing, but some project planning material for general security or risk assessment. Document/project seems to have been abandoned mid-2006.

Paper

A collection of online courses, mostly free. Registration is required, and may be annoying. Courses require IE for use. Some are general, some MS product specific. Even those that are generic have MS specific mentions, sometimes in surprising places. The course content tends to the simplistic, but does, usually, stick to generally accepted policies and guidelines. The usage of the courses is idiosyncratic at times, but you can usually puzzle it out. The material is a mix of page-turner and slide plus voice-over. There are occasional references: these must be obtained separately. There are review questions: these are basically useless.

Variation on Pascal's Wager: interesting take on risk analysis and management that could probably be used more widely.

Collection of papers, posters, and presentations by CISSPs. Also at http://www.isc2.org/csa

A game to help people recognize phishing sites

I'm not sure how useful it is, but it sure is pretty. Maps kidnappings, shootings, bombings, terrorist acts, piracy (non-recording), and a bunch of other nasty stuff.

This portal says it is under the direction of ISSA UK, but Reed Exhibitions seems to play a major role ...

Some of this is only accessible to registered students, and most of it is fairly simple, but it's good, straightforward, and clear. Decent model to follow. (Some aspects do date quickly ...)

EU programme for home computer security, mostly benchmarking filtering software

A list to jumpstart some thinking ...

Pamphlet from Office Depot, but good for small businesses.

Portal site, fairly simplistic material

"Security Awareness for Small Business, Home Office and Home computing." A brief outline, plus some links. Contact the page owner to download additional handout materials.

Rather simplistic but possibly handy overview of malware and surfing threats

Prices for the standards vary tremendously. For those that have been accepted as ANSI standards, this is one of the cheapest places to get copies of the standards.

Mostly links to buy the standards

British Standards Institute

A cooperative effort from the ISO 27001 security mailing list

ISMS International User Group (IUG), also ISMS Journal. (ISMS, Information Security Management System, is a term used in BS 7799 and descendents and almost nowhere else: it is an indication of BS 7799/ISO 27K relation.)

An apparently free electronic magazine. (Existing issues all seem to date from 2004: the most recent edition brings up a link to a German consultancy that seems to be doing the publishing.) News (mostly old) of meetings and events, some general security articles, remarkably little on BS 7799/ISO27K materials. (Issue 5 does have a nice piece on 17799 and software development.) The subscription address currently appears to be defunct.

International Organization for Standardization, group responsible for many international standards, particularly in communications: a number relate to security such as ISO 9000 (on quality) and the ISO 17799 security guideline framework. You will note that the name of the organization does not fit the acronym. Legend has it that, since the body was international in nature, it would be unfair to have the name in a particular language, and therefore the acronym ISO was derived from the Greek word "isos" (which means equal) so that no language would have an expansion that fit. (Many English-speakers refer, incorrectly, to the "International Standards Organization.")

White papers, templates, and sample documents from the ISO27k implementers’ forum.

Mailing list for discussion of, and resources for, ISO 27000 family and other security frameworks. (Not an official ISO list: run by Gary Hinson.)

Information and resources on ISO 27000 family and other security frameworks. (Not an ISO site: run by Gary Hinson.) A handy (though short) FAQ, list of books, and links to relevant sites.

A fairly simplistic set of questions, and you, basically, do all the work, but it an give you a bit of a feel. Seems to be based on the capability maturity model. (I'm reasonably sure that they will use the data to try and sell you some consulting, but ...)

An internet user group dedicated to the ISO information security standards. Content is very thin.

Public collaboration 'wiki' for both ISO 17799 and ISO 27001. At present, the contents are rather thin.

In starting phases

This copy hosted on the CCCURE site. I don't know who the U.S. Cyber Consequences Unit (US-CCU) is (aside from the two authors), but the material is generally decent. (Some of the items are a bit bizarre.) It can also be found at http://www.cyberunitss.com/files/cybersecuritychecklist2007.pdf

Watch this space. To report in January 2008.

No lack of self-esteem for these guys, but they do have some documents publicly available, particularly the Standard of Good Practice. This is incredibly verbose, but boils down to a checklist both of objectives and of specific activities or controls. You have to register to get the doc.

Quite exhaustive listing of a wide variety of infosec frameworks, guidelines, and documents. Brief descriptions. Covers ISO, NIST, RFCs, and FIPS, among others.

ISACA produces the CObIT audit guidelines.

No results yet, but a worthy effort.

An attempt to map all of the various security frameworks. Some useful information, not always presented in ways easy to understand. They will also try to sell you spreadsheets of the comparisons.

Repository of the old "rainbow" series of books, including the TCSEC "Orange Book," at the NIST CSRC site.

What type of organization (how mature) you are, based mostly on formality of processes.

Yet anohter outline?

A product of the banking and financial community, at one time, BITS stood for “Banking Industry Technology Secretariat” but apparently it doesn't anymore. In any case, the BITS Website has some documents that relate to security and risk analysis. Of particular interest is the BITS Kalculator, a risk measurement/comparison tool. (Note that the site does not work with all browsers.)

Global Threat Map, Threat Briefs, Top Threat Sources, Threat Index, Top Internet Attacks, and Vulnerability Risk Index using a distributed network of sensors

Collection of open source tools and display components

Free Network Project, demonstrating the use of encryption and onion routing in securing a network against analysis.

Tor onion routing anonymizing project.

Reporting site for annoying behaviour

Africa

multiple whois database lookup

Various resources

Handy to run through when telemarketers call. The Do Not Call list link is US, but the script should be useful for anyone.

Asia Pacific

One of the sources for tracing domains

Alan Solomon's PhD dissertation

Volunteer organization to agitate for solutions against spam.

Good article on how to dissect and trace email

Various tools for tracing spam and URLs

SPAM vs spam

A very useful "one stop" site for reporting spam. Submission is by file, rather than form, which is a pain, but you can also report by forwarding email. (There are specific instructions in order to get hearders.) Knujon ("no junk" spelled backwards) seems most interested in shutting down Websites, but also has provisions for submitting general spam (to knujon@coldrain.net) as well as stocks (stockjunk@coldrain.net), drugs (rx@coldrain.net), phishing (phishing@coldrain.net), and one of the only addresses I've found for 419/advanced fee/Nigerian scams (for some reason called deposit scam: depositscams@coldrain.net).

Just to keep your sanity in the battle ...

whois tracing tool. At one time also had utility software available.

US, EU, and other countries

Like PIRT, this allows you to submit spam messages for takedown of the spam server.

Open Web Application Security Project (OWASP), presentations, video, papers, blogs, mailing lists.

Excellent presentation (but then, everything Ross does is worth noting) on botnets, related malware and fraud, and the command and control systems. Interesting research on the various types that are more resistant to takedown.

Just a list of XSS attacks, but a way to check that your Web app filter will catch things.

ESET SysInspector is a diagnostic tool for Windows NT based systems. It allows an in depth analysis of various aspects of your operating system, including running processes, registry content, startup items and network connections. ESET SysInspector makes dealing with malware infected system easier.

Accurate and wel-respected scanner

Firefox addon restricting JavaScript, Java, and other forms of active content.

Web filtering proxy. Can be used to restrict various content, including outgoing, so useful for privacy as well. Can also be used to manage Web browsing appearance and display, including size, images, and backgrounds. Certain functions by default, highly customizable, but may require knowledge of HTML and HTTP. Because it is a proxy, works with any browser.

Accurate and well-respected scanner: office in Vancouver. Also spam filtering.

Automated creation of throwaway email addresses

sender identity spam filter

Automated throwaway email address for spam filtering

Spam filter

Filtering software, company formerly (and still) produced antivirus scanner

Spam filtering program