Infosecurity Professional - Issue 9 - ISC

More documents

Recommendations

Info

frankly, your enemy.” The more time passes, the more information criminals can access in your systems—and the more damage they can do. As an example, Hansen describes a client he has worked with over the past several years that continues to be the target of serious efforts to break into its network by persons outside the U.S. “One of the things that I don’t think any organization anticipates, and it shows in this case, is how long this response and recovery effort really takes,” he says. “It can go on for ages if the attacker is determined, persistent and has a goal for getting in there.” Include people from key business and technology areas from the top to the bottom of the company when building the team, but for agility’s sake only include employees who have specific roles and tasks. You should also consider involving people who can manage the appropriate notification of partners, customers and law enforcement. The goal should be to simplify your response team, Baich says. Key to that is having an inventory of the appropriate skills of team members—data reporting, data collection and analysis—and multiple ways to communicate, such as e-mails, instant messaging, handheld devices, etc. Call on an outside vendor if you don’t have the appropriate skills inhouse, says Baich. As for who leads the team, Baich suggests a seasoned business executive with some operational background. “That’s not necessarily the CISO because the incident may not be a technology issue,” he says. The ChoicePoint incident is a good example of that distinction. Are you Certified? CBCA (Certified Business Continuity Auditor) CBCLA (Certified Business Continuity Lead Auditor) Special Benefits for (ISC)2 When you apply for either level of auditor certification through DRI International, your CISSP classification fulfills the requirements for experience and reference checks. (ISC)2 members receive a 10% discount on auditor and all DRI International BCP training. Just let us know that you are a member in good standing at time of registration to receive your discount. www.drii.org 866-542-3744 Become a Certified Business Continuity Auditor / Lead Auditor The workshop covers relevant standards, laws and regulations, the process of risk assessment, vulnerability analysis, loss prevention, risk mitigation, and the development, implementation, testing and maintenance of emergency management and business continuity plans and procedures. Course materials delve into existing legal and regulatory requirements, as well as standards including IX- 110-53 (PS-Prep), NFPA-1600 and BS-25999. Upon completion of the workshop and passing the unique qualifying exam, participants will be able for apply to for either designation based on practical experience. There are no prerequisites for taking the course and exam. If you are already certified, these are unique certifications and may be held together with existing certifications. Get Started Immediately. Click to Register Today! Feb 8-12 in Las Vegas, NV - OR - Apr 26-30 in Atlantic City, NJ LAW & INDUSTRY SUPPORT Businesses should tap into information from investigations and reports on trends in cybercrime from law enforcement resources. For example, the U.S. Department of Justice, the U.S. Postal Inspection Service, the U.S. Secret Service and the Federal Trade Commission collaborate on public efforts to combat cybercrime. They also work with international partners such as Interpol, an international police organization with working groups on cybercrime in Africa, the Americas, Asia, the South Pacific, Europe, the Middle East and North Africa. Equally as important, says Lee, is to know what your peers are doing. The financial services industry, for instance, has formed a variety of groups (such as the Financial Services Technology Consortium) in response to severe and frequent breaches. Other examples include the Business Software Alliance and the Software and Information Industry Association. These groups share information and ideas to help deal with and protect against data breaches. “You definitely want to get involved with other groups and hear viewpoints of other organizations, particularly when it comes to the complexities of the ethical and legal sides of this issue,” says Lee. “It’s safe to assume you’re not the only one dealing with this, and there’s a lot out there in terms of best practices that can be learned.” Marie Lingblom is a freelance technology editor and writer based in Massachusetts. 16 INFOSECURITY PROFESSIONAL ISSUE NUMBER 9
Conference photo by mammamaart/istockphoto Here’s how to convince your manager to send you to a conference—and what to do when you get there. By Chris Greco calling For many information security professionals, attending conferences and tradeshows is part of the job. These events provide opportunities to learn about new technology, practices, techniques and systems, and the chance to meet and share experiences with peers. But conferences can be tiring when there are back-to-back sessions and workshops. And if your company has limited the amount of time you can be at the event, the pressure builds to get the most out of the experience—especially if you’re expected to report back to colleagues on the latest news and trends. Here are some simple steps to get the most out of conferences and assure your manager that attending them is truly beneficial to the workplace. 4 Get Prepared Take a look at the agenda ahead of time (it’s usually on the conference Website; if not, contact the organization by phone) and highlight any sessions that interest you and/or may be of interest to your workplace. Share the agenda with your manager and explain how the sessions will enhance your contributions to the company. If possible, review the attendance list and point to other attendees in your area of specialization. Be careful—this is a double-edged sword. Your manager may decide to just get the conference notes from other attendees, which means you will need to prove why your notes will be better. 4 Get Involved If the conference is calling for individuals to present papers, submit a paper—it gives you the opportunity to show your manager that you are committed. I have submitted and presented papers on topics ranging from project management ISSUE NUMBER 9 InfoSecurity Professional 17
Page 1 and 2: issue number 9 An (ISC) 2 Digital P
Page 3 and 4: issue 9 2010 VOLUME 1 14 To view th
Page 5 and 6: executive letter From the desk of t
Page 7 and 8: (ISC) 2 MEMBER NEWS (ISC)² Hires F
Page 9 and 10: The password to your future is NSU.
Page 11: illustration by SASHIMI/theispot be
Page 14 and 15: son’s social position. “Breache
Page 16 and 17: You’ve probably developed, or are
Page 20 and 21: Each year, (ISC) 2 participates in
Page 22 and 23: global insight international inform
Page 24: The one security blanket you won’

Infosecurity Professional - Issue 9 - ISC

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?