Editor's note

SOCIAL FRAUD
24
Social Engineering
by Dinesh Sheety
The idea of this article is simple and nice, though there are
plenty of good resources and books on social engineering
(Mitnick’s Art of Deception!) it’s an „informative” kind
of article, it lacks real examples, for instance a real
example of an attack, for example describe how a pt
on an organization has been done (without disclosing
sensitive Information). Author has provided a good solid
base for someone who doesnt have any clue about social
engineering and by the end of the article they will have a
decent amount of knowledge to go out and build upon.
30
When Computer Attacks
by Gabriel Marcos
There is a new type of cyber threat that is catching
more victims every day; many people know it is called
Advanced Persistent Threats, and there is a trace of high
profile victims out there to give us enough. But before
taking any action we have to bring awareness to what this
new kind of threat means: the only way to be protected
is understanding what this means for the organizations
and how it could impact their business. Undoubtedly
exceptional circumstances call for exceptional actions.
So, maybe it is time to acknowledge that computer
attacks do not always happen to others; we need to
become aware and to be prepared in advance to minimize
risk exposure at this kind of attacks, protecting both our
organizations and their leaders.
SOLUTIONS
36
An Introduction to the NIST Risk
Management Framework
by Bart Hopper
This article will introduce the NIST Risk Management
Framework. It will cover the steps of system
categorization, the selection of security controls, the
implementation of the selected controls, the assessment
of control implementation, and the system authorization
process. Creating an effective information security
program can be a daunting task. If you are lucky, you
work for a company with an existing security program,
clearly defined security mandates, and support from
senior management. But, what do you do if you are
given the task of creating a security program for your
organization? This article will guide you through the
process of creating an effective security program using
the NIST risk management framework. Even if you are not
directly responsible for creating a security program, you
starterkit 02/2011(2)
CONTENTS
may find it helpful to understand how security programs
are created and why certain items are prioritized by
auditors.
40
Why is Cyber Security Important?
by Thejendra
Until a decade ago if you had to rob a bank it was
necessary to indulge in an armed invasion, take hostages,
spill blood, use getaway cars, etc., along with all the
associated risks of botching up the operation. Or you had
to indulge in excellent forgery and duplicate paperwork to
siphon off funds. But today it is not necessary for you to
even visit a bank to loot it without raising any alarms for
weeks. So how is it now easy for criminals to loot a bank?
The simple answer is the Internet. Today, many aspects
of our life like banking, purchases, communications,
etc., and even the militaries depend on the internet and
worldwide connectivity. While the internet offers several
conveniences, it can also ruin your life in an instant
with threats like identity thefts, online scams and other
threats.
Page 5 http://pentestmag.com