 Security StrategiesNetwork World's Security Strategies Newsletter, 11/15/07ISACA Winnipeg's bestseller list: Build Security InBy M. E. KabayMy friend and colleague Dan Swanson, CIA, runs a useful information assurance (IA) news and discussion service and has a valuable list of useful IA resources for us. I'm impressed by the quality of the references, including some I haven’t seen before. Readers will want to keep this list for extended browsing. Today I’ll start reviewing some of the most interesting sites and documents he and his colleagues have listed in the five-page “Leading Resources to support your Information Security improvement efforts” which is available as a PDF download from the home page of the ISACA Winnipeg Chapter’s “Security Management Conference.”
“Build Security In” (BSI) from the U.S. Department of Homeland Security has some excellent white papers. The home page describes it as follows: “Build Security In (BSI) contains and links to best practices, tools, guidelines, rules, principles, and other resources that software developers, architects, and security practitioners can use to build security into software in every phase of its development. BSI content is based on the principle that software security is fundamentally a software engineering problem and must be addressed in a systematic way throughout the software development life cycle.” Here are three particularly interesting titles in the list of new BSI resources: * Software Assurance (SwA) in Acquisition: Mitigating Risks to the Enterprise by Mary Linda Polydys and Stan Wisseman. This 112-page draft version in Word format is available for comments (deadline is Nov. 20). The Executive Summary (p. ES-2) describes the report as follows: “This guide provides information on incorporating SwA throughout the acquisition process from the acquisition planning phase to contracting, implementation and acceptance, and follow-on phases. For each phase, the guide covers SwA concepts, recommended strategies, and acquisition management tips. The guide also includes recommended Request for Proposals (RFP) and/or contract language and due diligence questionnaires that may be tailored by acquisition officials to facilitate the contract evaluation process.” * Software Project Management for Software Assurance is an 86-page document by Elaine Fedchak, Thomas McGibbon and Robert Vienneau. The main sections are as follows: 1 Introduction * State-of-the-Art Report on Software Security Assurance is a collaborative report based on discussions in software assurance groups. The publication from the Information Assurance Technology Analysis Center (IATAC) is available as a PDF file with 396 pages and a tooth-jarringly garish cover. It’s also stored with a two-page-per-screen layout that you may want to change unless you use a wide screen. However, quibbles aside, this is an astonishing work that most readers are going to want to download and read. It can be used as a resource in undergraduate and graduate courses (I’m going to scuttle away and see where to fit it into the MSIA program). Here’s an outline of the just the section headings (the detailed Table of Contents is seven pages long) of this impressive achievement: Section 1: Introduction Although I am already beyond my word-count limit, I can’t resist adding the topics in Section 8 to whet your appetite: 8.1 What “Secure Software” Means Yum! Editor's note: Starting Tuesday, Nov, 20, this newsletter will be renamed "Security Strategies Alert." Subscribers to the HTML version of this newsletter will notice some enhancements that will provide access to more resources relevant to IT security. You will still receive M. E. Kabay's analysis of this topic, which you will be able to read in its entirety online at NetworkWorld.com, along with links to relevant news headlines of the day. We hope you enjoy the enhancements and we thank you for reading Network World newsletters.
|
| Contact the author: M. E. Kabay, PhD, CISSP-ISSMP is Program Director of the Master of Science in Information Assurance and CTO of the School of Graduate Studies at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site. ARCHIVEArchive of the Security Strategies Newsletter. BONUS FEATURE90% of IT Managers are leaving their company at risk for a DNS ATTACK. Get the tools and resources you need to keep your DNS healthy and secure. Run a DNSreport on your domain today - 56 critical tests run in 8 seconds. Visit www.dnsreport.com to learn more. (apply coupon NWW2007NLA for a 25% membership discount) PRINT SUBSCRIPTIONS AVAILABLE International subscribers, click here. SUBSCRIPTION SERVICESTo subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription. Advertising information: Write to Associate Publisher Online Susan Cardoza Network World, Inc., 118 Turnpike Road, Southborough, MA 01772 Copyright Network World, Inc., 2007 |
No comments:
Post a Comment