INFOSEC MANAGEMENTThis section includes papers from a variety of sources that bear on the management of information security. |
|
Video ReviewsThis section include page-long summaries and evaluations of some excellent awarness and training films available on VHS and DVD.
Computer Security Incident Response Team Management PDFHow to set up and run an effective CSIRT. Developing Security Policies PDFChapter 44 from the Computer Security Handbook, 4th Edition (CSH4) reviews methods for developing security policies in specific organizations. It was later updated to become Chapter 66 of the CSH5.
DISA Computer Incident Response Team Management CD-ROM ZIPThe Defense Information Systems Agency (DISA) stopped producing the excellent training CD-ROM "Computer Incident Response Team Management" in 2007. In response to my enquiry about providing the CD-ROM to MSIA students enrolled in the CSIRTM Elective, someone from DISA with a bit of gender confusion about me caused by my name responded "Dear Ms Kabay, / Thank you for your interest! However we discontinued that product, CIRT Management, just recently. We do have a few copies may have kept on hand, if you want a copy, then you can make copies of it for your students. There is no charge for our products. . . ." THEREFORE, feel free to download the 358 MB ZIP file and install it to disk. Use the README file for instructions on installation. By the way, DISA helpfully shipped me ONE THOUSAND COPIES of the disk (a few by US government standards. . . .). End of Passwords, The PDFWhy I hate passwords as a method for authentication. Facilities Security Audit Checklist PDFQuestions to help you evaluate the security of your building.
Identification, Authentication and Authorization on the World Wide Web PDFThis white paper appeared in 1997 as part of the ICSA (International Computer Security Association) [previously National Computer Security Association and later TruSecure and then CyberTrust] Web site. This version has a few updates to the identifying information (e.g., removing and old e-mail address) but is otherwise as originally written (and thus now out of date). The HTML version is not usable because of the extensive use of tables and diagrams.
Implementing Computer Security: If Not Now, When? HTML PDFThis little paper reviews key threats to information and urges managers not to wait in developing and implementing security policies.
Net Present Value of Information Security HTML PDFThoughts about ways of presenting information security as more than just loss-avoidance. This paper was later published with additions by colleagues Karen Worstell and Mike Gerdes of AtomicTangerine and published on the now-defunct SecurityPortal Web site. Over the years I have added to my original version with corrections and updates.
Personnel Management and INFOSEC HTML PDFHiring, management and firing with an eye to information assurance. Later became a chapter in the Computer Security Handbook, 4th Edition and then in the 5th edition.
Preparing for the Next Solar Max PDFSolar storms threaten the critical infrastructure. Get ready.
Protecting Your Reputation in Cyberspace PDFThis paper looks at how we can use e-mail and other electronic communications responsibly and professionally. It is intended to provide useful information for corporate INFOSEC awareness programs.
Securing Your Business in the Age of the Internet HTML PDFFive pages this time to convince your bosses to pay attention to INFOSEC.
Security on a Budget
|
|