Skip to main content

Home/ NBISE Institute/ Group items tagged Security

Rss Feed Group items tagged

dhtobey Tobey

Outgunned: How Security Tech Is Failing Us -- InformationWeek - 0 views

  • "Years ago when we started writing checks, we might have been tackling five to 10 a day," says Paul Wood, a senior analyst with Symantec Hosted Services. "It's now well over 10,000 a day and growing." According to McAfee's 2010 Q2 Threat Report, the company identified 10 million pieces of malware in the first half of this year and is tracking close to 45 million in its malware database.
  • Vulnerability assessment products are also behind the curve, as Greg Ose and Patrick Toomey, both Neohapsis application security consultants, found when they recently set out to measure the relative effectiveness of various vulnerability scanners. "It's a question frequently raised by our customers," Toomey says. "They know the tools aren't going to catch all of the problems, but can they count on them to catch, say, 80% of the bad ones?" What Ose and Toomey discovered was far worse than even they had anticipated. Out of the 1,404 vulnerabilities accounted for by the Common Vulnerabilities and Exposures project during the sample period, there were only 371 signatures. In the best cases, the tools were in the 20% to 30% effectiveness range.
  • Toomey's observations are in line with those of security researcher Larry Suto, who earlier this year reported that Web application vulnerability scanners missed almost half (49%) of the vulnerabilities present during his tests.
  • ...5 more annotations...
  • But there's also a new twist to consider: With an increased number of attackers targeting and hijacking the credentials of IT personnel, the outsider can become the insider, at least from the perspective of our technology controls. Forward-thinking companies will move now to address this scenario. Think about how you'll detect large, anomalous query spikes against key tables in sensitive databases. Ensure you can spot large-scale document downloads from file shares and internal document management systems. If a hijacked credential is used to log into a large number of machines during a short time frame, you should have the ability to spot that activity.
    • dhtobey Tobey
       
      Investing in workforce development and professionalizatino of the infosec workforce may do more.. combat ingenuity with ingenuity, not automation.
  • investing even a small percentage of your security budget in only a few specialized systems to help here will go further than throwing good money at yesterday's outdated controls.
  • Stop rewarding ineffectiveness and start rewarding innovation. Maybe right now you're struggling with a scary realization: "The millions I'm spending on firewalls and antivirus technology is relatively worthless if my adversary is skilled."
  • Greg Shipley is an InformationWeek contributor and a former CTO
dhtobey Tobey

Security Training, CEH, Ethical Hacking, Penetration Testing, Certified Ethical Hacker,... - 0 views

  •  
    Potential partner in developing and distributing assessments targeting the entry level of operational security testing.
Michael Assante

App security testing - 0 views

  •  
    About application security testing
dhtobey Tobey

Whatcom Community College's computer program honored for its cyber security - Top Stori... - 0 views

  • BELLINGHAM - Whatcom Community College's computer program is now considered one of the best in the country, especially in the areas of cyber security.The college was recently named as a National Center of Academic Excellence in Information Assurance by the National Security Agency and the Department of Homeland Security.
  • "It is a major threat to our security," said Corrinne Sande, Computer Information Systems program coordinator at WCC,
  • WCC is one of only 13 two-year schools in the country with the designation, which was opened to community and technical colleges last year. The University of Washington is also a Center of Academic Excellence in this area, but for a university instead of a two-year school.
  •  
    Candidate for Northwest ADAPTS program
dhtobey Tobey

2011 DHS S&T CSRD BAA - Federal Business Opportunities: Opportunities - 0 views

  • The Department of Homeland Security (DHS) Science and Technology (S&T) Homeland Security Advanced Research Projects Agency (HSARPA) Cyber Security Division's (CSD) announce a Broad Agency Announcement (BAA) for Fiscal Year 2011 to improve the security in both Federal networks and the larger Internet. This Broad Agency Announcement (BAA) seeks ideas and proposals for Research and Development (R&D) in 14 Technical Topic Areas (TTAs) related to CSD.
dhtobey Tobey

Cyber Hiring to Surge by 2015 - Wired Workplace - 0 views

  • The federal cybersecurity workforce could grow to more than 61,000 employees by 2015, in part due to new demands, such as mobile computing, cloud services and social media, according to a new report. The federal government-specific results of the 2011 Global Information Security Workforce Study, conducted by (ISC)2 and Frost & Sullivan, indicate that federal information security professionals are being stretched too thin by their work to secure the increasing amount of critical information flowing through government networks. The new demands placed on cyber professionals as a result of the government's push for mobile devices, cloud computing and social media could result in a federal cyber workforce that is 61,299 strong by 2015, the report noted. The survey of 145 C-level federal executives also found that the most serious challenges facing federal IT departments are application vulnerabilities (73 percent), mobile devices (66 percent), viruses and worm attacks (64 percent), cyber terrorism (58 percent) and internal employees (58 percent).
  • Hord Tipton, executive director of (ISC)2, said
  • "We need new people, and we need younger people," he said. "The government needs defined career paths to help find the skills it needs, get them classified, evaluate what those jobs are worth and put good standards in place." The study also found that certification is far more important to the federal government than it is to other sectors. For example, 63 percent of CIOs and CISOs said security certifications were "very important," compared to 45 percent of worldwide survey respondents.
dhtobey Tobey

Cyber security certification program launches | ISA - 0 views

  • Sypris Electronics, LLC, a subsidiary of Sypris Solutions, Inc. partnered with Career Technical Education Foundation, Inc. (CTEF) and The MITRE Corporation to develop, establish, and host a cyber security curriculum for local and national high school students. The curriculum was co-developed by Sypris, MITRE, and CTEF, and it is under evaluation by (ISC)².
  • Students who successfully pass the program, along with a Systems Security Certified Practitioner (SSCP) certification exam, will become an Associate of (ISC)² toward the SSCP certification, an opportunity not currently available to any other high school students in the nation.
  • There is no other cyber security curriculum available for secondary education anywhere in the country, and we are the first to make it available,” said Paul Wahnish, president of CTEF
dhtobey Tobey

GIAC Security Expert (GSE) - 0 views

  •  
    Potential source of Competency Model Development Panel members.
dhtobey Tobey

European e-Competence Framework - Home - 0 views

  • The European e-Competence Framework (e-CF) is a reference framework of 36 ICT competences that can be used and understood by ICT user and supply companies, the public sector, educational and social partners across Europe.
  • European e-Competence Framework 2.0 for download
  • European e-Competence Framework 2.0 - downloadUser guidelines for the application of the European e-Competence Framework 2.0 - downloadBuilding the e-CF - a combination of sound methodology and expert contribution - downloadEuropean e-Competence Framework 2.0 - Executive overview - download
  • ...2 more annotations...
  • European e-Competence Framework 2.0 - downloadUser guidelines for the application of the European e-Competence Framework 2.0 - downloadBuilding the e-CF - a combination of sound methodology and expert contribution - downloadEuropean e-Competence Framework 2.0 - Executive overview - download
    • dhtobey Tobey
       
      This is an example of how we might publish our Competency Model for Operational Security Testing.
dhtobey Tobey

Lockheed Martin hit by cyber attack - Yahoo! Finance - 0 views

  • Lolita C. Baldor, Associated Press, On Sunday May 29, 2011, 4:13 am EDT
  • Hackers launched a "significant and tenacious" cyber attack on Lockheed Martin, a major defense contractor holding highly sensitive information, but its secrets remained safe, the company said Saturday.
  • Lt. Col. April Cunningham, speaking for the Defense Department, said the impact on the Pentagon "is minimal and we don't expect any adverse effect."
  • ...1 more annotation...
  • Chris Ortman, Homeland Security spokesman, said his agency and the Pentagon were working with the company to determine the breadth of the attack and "provide recommendations to mitigate further risk."Lockheed Martin said in a statement that it detected the May 21 attack "almost immediately" and took countermeasures.
  •  
    Attack announcement that should be included in NBISE CoP library.
Steve King

Prepare for the "Advanced Persistent Threat" - 0 views

  •  
    Good round up of APT issues
dhtobey Tobey

Cyberlearning: Transforming Education (nsf10620) - 0 views

  • NSF 10-620
  • Research supported by the Cyberlearning program will explore the opportunities for learning made possible by new technologies, how to help learners capitalize on those opportunities, new practices that are made possible by learning technologies, and ways of using technology to promote deep and lasting learning of content, practices, skills, attitudes, and/or dispositions needed for engaged and productive citizenship. Cyberlearning research will marry what is known about how people learn with advances in information and communications technologies to advance understanding of how to cultivate a citizenry that engages productively in learning both in and out of school and throughout a lifetime; and that possesses the knowledge, knowledge building, collaboration and reasoning capabilities to make informed decisions and judgments about problems ranging from their immediate lives to ethics, privacy, and security concerns to global challenges such as war and peace, economics, health and wellbeing, and the environment.
  • The goals of the Cyberlearning program are: To better understand how people learn with technology and how technology can be used productively to help people learn, through individual use and/or through collaborations mediated by technology; To better use technology for collecting, analyzing, sharing, and managing data to shed light on learning, promoting learning, and designing learning environments; and To design new technologies for these purposes, and advance understanding of how to use those technologies and integrate them into learning environments so that their potential is fulfilled.
  • ...18 more annotations...
  • Every project should therefore seek to answer questions about how to better promote learning, how to promote better learning, or how learning happens in technology-rich environments (including exploring relationships between people and technology that result in productive learning and access provided with technology to learning resources, such as data and scientific information). Each project should also focus, concurrently, on innovative technology design, ways of coherently integrating technologies for learning, and/or the integration of such technology into targeted learning environments. Especially sought are projects in which technology allows the tailoring of learning experiences to special needs and interests of groups or individuals, as well as ways in which technology allows expanding education beyond classroom settings
  • It is expected that all projects will advance understanding about how people learn with technology, how to use technology to help people learn, and/or how to use technology to enhance assessment or education practices
  • These projects may be of several different types:
  • Proposals should make clear the roles of all team members (PIs, supporting investigators, advisors, and others), why the proposed team is an appropriate one, and what expertise each team member brings. Teams should include members who have experience with the learners and environments being targeted and who are expert at relevant engagement and learning issues. Proposers should make clear the challenges associated with assessment and evaluation, robustness and broader usability that they anticipate, and the team members that will help with each of these.
  • Project proposers should also include on their teams people who can help them plan towards fulfilling the transformational potential of their work, including, as appropriate, those who can help them transition their technology to broad use and those from stakeholder groups who will need to be integrated into the project as innovations move towards scalability, broad dissemination, and continuation over time.
  • Integration and Deployment Projects (INDP Projects)
  • Since successful collaborative research depends on thoughtful coordination mechanisms, a Collaboration Plan is required for all proposals involving multiple investigators. The length of and level of detail provided in the Collaboration Plan should be commensurate with the complexity of the collaboration.
  • They may advance understanding of how to productively integrate a variety of established technologies to better promote learning or promote better learning in a target population and environment. They may provide guidelines on extending the usage of some promising technology or technologies over a larger variety of learner populations, advancing understanding of how to better address learning needs of different populations. They may provide guidelines on extending the usage of some promising technology or technologies over a larger variety of learning contexts, advancing understanding of learning processes that underlie disciplinary areas or the constraints and affordances (opportunities offered) of different environments for learning. They may combine advances in two or more of these areas.
  • It is expected that technologies will be deployed and evaluated in a large variety of learning environments, that by the end of the project, the technology will be ready for technology transfer and commercialization, and that the guidelines proposed will be broadly applicable beyond the particular technology being deployed. By later years of the project, facilitation of technology use should be done by those who would naturally be the facilitators in the chosen learning environment (e.g., teachers, scout leaders, parents, peers). Formative analyses: As for DIP projects, formative analyses should answer questions about usability, learning, effective and sustained use, as well as issues associated with scale-up, sustainability, workforce development, and long-term efficacy (as appropriate).
  • It will be appropriate for many proposals to include the development of innovative curricula or educational materials in addition to proposing technological innovations.
  • A successful research project should be potentially transformative; grounded in existing learning and education research; seek to answer questions about learning with technology; measure learning gains, take into account appropriate elements of the learning ecology in designing its innovation, evaluating its innovation, and answering research questions; include team members with all necessary expertise, including expertise for outreach and dissemination; be aware of potential scalability and sustainability issues; and use appropriate methodologies to evaluate innovations and measure learning gains. Our expectation is that many grants made by this program will seed long-term research enterprises. The transformative potential of proposed projects may be many years out, so proposers should make clear what that potential is and the predicted time horizon.
  • Collaborative Proposals. All collaborative proposals submitted as separate submissions from multiple organizations must be submitted via the NSF FastLane system. Chapter II, Section D.4 of the Grant Proposal Guide provides additional information on collaborative proposals.
  • Proposal Titles: Proposal titles must begin with an acronym that indicates the categories in which proposals are being submitted, as follows Exploration Projects - EXP Design and Implementation Projects - DIP Integration and Deployment Projects - INDP
  • The acronym should be followed with a colon then the title of the proposed project. If you submit a proposal as one in a set of collaborative proposals, the title of your proposal should begin with the acronym that indicates the project category, followed by a colon, then "Collaborative Research" followed by a colon, and then the project title. For example, if you are submitting an Exploration Project, the title of each collaborative proposal would be EXP:Collaborative Research: Project Title.   Project Summary:  The Project Summary must include an explicit description of both the Intellectual Merit and Broader Impacts of the activities proposed, preferably in separate paragraphs titled "Intellectual Merit" and "Broader Impacts".   
  • Project Description: Project Descriptions should include the following sections: Vision and Goals. Describe: The theories of learning investigators are drawing from. Learning objectives: what learners are expected to learn and how the proposed innovation or its integration into the learning environment is expected to promote that learning. The population of learners, including any needs, abilities or interests relevant to achieving the learning objectives. How the proposed innovation is matched to the needs, abilities, and interests of targeted learners. Because deep understanding and facile capabilities emerge only over long periods of time, how the proposed innovation or its integration into some learning environment is expected to sustain engagement.
  • Research Plan and Outcomes. With appropriate references to the literature, describe the research questions to be answered through your research and a comprehensive research plan to answer them. Make clear the learning domain to be explored (e.g., content, subject matter, topics, skills, practices), and make a research-based case for the promise of the particular technological innovation for promoting learning in this domain. Describe the data to be gathered and analytic approaches to be taken to analyze the data.   It is anticipated that technological innovations will be iteratively refined over the course of the project based on analysis of formative data.  Describe the formative evaluation methodology you will use, including means to assess learning and engagement.  Describe the project outcomes you expect to generate, including products. Discuss how you will collect and analyze data to supply evidence of learning outcomes. Innovation Outcomes (For DIP and INDP projects ONLY). Describe how the proposed innovations and ways of integrating them into the learning environment take into account the environmental and human factors important to learner success (e.g., the cognitive, developmental, affective, and social needs of learners, the cultural milieu in which the learning technologies will be used, and the capabilities and expectations of human agents in the environment).  All claims about the appropriateness of the proposed innovation should be supported with evidence from the literature.
  • A Collaboration Plan is required for all proposals involving multiple investigators. The length of and degree of detail provided in the Collaboration Plan should be commensurate with the complexity of the proposed project.  Collaboration Plans should be included at the end of the Project Description in a section entitled "Collaboration Plan", and up to 3 additional pages are allowed for Collaboration Plans. The Collaboration Plan should describe: the specific roles of the project participants in all organizations involved; information on how the project will be managed across all the investigators, institutions, and/or disciplines; identification of the specific coordination mechanisms that will enable cross-investigator, cross-institution, and/or cross-discipline scientific integration (e.g., yearly workshops, graduate student exchange, project meetings at conferences, use of videoconferencing resources or social media technologies, software repositories, etc.); and specific references to budget line items that support collaboration and coordination mechanisms.
  • What is the intellectual merit of the proposed activity? How important is the proposed activity to advancing knowledge and understanding within its own field or across different fields? How well qualified is the proposer (individual or team) to conduct the project? (If appropriate, the reviewer will comment on the quality of the prior work.) To what extent does the proposed activity suggest and explore creative, original, or potentially transformative concepts? How well conceived and organized is the proposed activity? Is there sufficient access to resources? What are the broader impacts of the proposed activity? How well does the activity advance discovery and understanding while promoting teaching, training, and learning? How well does the proposed activity broaden the participation of underrepresented groups (e.g., gender, ethnicity, disability, geographic, etc.)? To what extent will it enhance the infrastructure for research and education, such as facilities, instrumentation, networks, and partnerships? Will the results be disseminated broadly to enhance scientific and technological understanding? What may be the benefits of the proposed activity to society?
  •  
    Checklist of sections to be addressed in the proposal
1 - 12 of 12
Showing 20 items per page