Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Submission + - CrowdStrike will be just fine, thank you. (medium.com)

benrothke writes: The bigger the data breach, the more profit the firm will make in the long-term.
Data and security breaches have zero effect on the viability of a company.
Consider Target and SolarWinds. Their stocks are more than double before the data breach.

Submission + - The big lie of millions of information security jobs (medium.com) 1

benrothke writes: My article was referenced last month here https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fit.slashdot.org%2Fstory%2F...

I wrote a follow-up piece on how the notion of millions of security jobs is preposterous.

How can you know how many security jobs there are if there’s no real statistical data available?

https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fbrothke.medium.com%2Fthe...

Comment Re: New topic, same problem (Score 1) 137

The problem is that all of the ‘millions of open security jobs’ comes from the same 1 or 2 sources.
If you look a little deeper, you see that are in fact, predictions. Based on extreme scenarios.
But no one takes the time to ask them to explain their numbers. They just take it as fact and parrot the same inflated job numbers.

Comment Re:Checking the boxes to make the sale (Score 1) 137

That’s precisely the point. See what I wrote in:
The continued fallacy of the information security skill shortage
https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fbrothke.medium.com%2Fthe...

To which I have never encountered a single company that paid market rates, that had trouble finding good information security people.

Comment FCC PR at its best (Score 1) 111

This is pure theatre and PR from the FCC. When it comes to stopping robocalls, the FCC and other state attorney generals have gone after the small bit players. Yes, they often are the address for scam robocallers. But if the FCC was serious about stopping scam robocalls, they would go up against the big telcos like Verizon, Sprint, AT&T, Comcast, and the other major players.

https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fbrothke.medium.com%2Fthe...

Submission + - Book review: Security Operations Center

benrothke writes: ol{margin:0;padding:0}.c1{orphans:2;widows:2;text-align:justify;direction:ltr}.c6{orphans:2;widows:2;direction:ltr;height:11pt}.c5{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c4{color:#1155cc;text-decoration:underline}.c0{color:inherit;text-decoration:inherit}.c2{font-size:12pt;font-style:italic}.c3{font-size:12pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.15;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}

Title:Security Operations Center: Building, Operating, and Maintaining your SOC

Author: Joseph Muniz, Gary McIntyre, Nadhem AlFardan

Pages: 448

Publisher: Cisco Press

Rating: 10/10

Reviewer: Ben Rothke

ISBN: 978-0134052014

Summary: Indispensable guide for those designing and deploying a SOC



Large enterprises have numerous information security challenges. Aside from the external threats; there's the onslaught of security data from disparate systems, platforms and applications. Getting a handle on the security output from numerous point solutions (anti-virus, routers/switches, firewalls, IDS/IPS, ERP, access control, identity management, single sign on and others), often generating tens of millions of messages and alerts daily is not a trivial endeavor. As attacks becoming more frequent and sophisticated and with regulatory compliance issues placing an increasing burden, there needs to be a better way to manage all of this.



Getting the raw hardware, software and people to create a SOC is not that difficult. The challenge, and it's a big challenge, is integrating those 3 components to ensure that a formal SOC can operate effectively. In Security Operations Center: Building, Operating, and Maintaining your SOC, authors Joseph Muniz, Gary McIntyre and Nadhem AlFardan have written an indispensable reference on the topic. The authors have significant SOC development experience, and provide the reader with a detailed plan on all the steps involved in creating a SOC.



As Mike Rothman notedabout managed services providers, and something that is relevant to a SOC, you should have no illusions about the amount of effort required to get a SOC up and running, or what it takes to keep one current and useful. Many organizations have neither the time nor the resources to implement a SOC, but do, and are then trapped on the hamster wheel of pain, reacting without sufficient visibility, but without time to invest in gaining that much-needed visibility into threats that the SOC had the potentialto provide them with, had they done it right. Those considering deploying a SOC and not wanting to be in the hamster wheel of pain will need this book.



The authors have done a great job in covering every phase and many details required to build out a SOC. After going through the book, some readers will likely reconsider deploying an internal SOC given the difficulties and challenges involved. This is especially true since SOC design and deployment is something not many people have experience with.



The book is written for an organization that is serious about building an enterprise SOC. The authors spend much of the book focusing on the myriad requirements for creation of a SOC. They constantly reiterate about details that need to be determined before moving forward.



Chapter 4 on SOC strategy is important as the way in which a firm determines their strategy will affect every aspect of the outcome. The authors wisely note that an inadequate or inaccurate SOC strategy, and the ensuing capabilities assessment exercises would produce a SOC strategy that does not properly address the actual requirements of the organization.



Ultimately, failing to adequately plan and design is a guarantee for SOC failure. That in turn will affect and impact deployment timelines, budgets and cause frustration, dissatisfaction and friction between the different teams involved in the SOC program.



The author's expertise is evident in every chapter, and their real-world expertise quite obvious in chapter 5 on facilities, which is an area often neglected in SOC design. The significant issue is that if the facility in which the SOC team operates out of does meet certain baseline requirements, the SOC effectiveness will be significantly and often detrimentally impacted. The chapter details many overlooked topics such as: acoustics, lighting, ergonomics, and more.



Staffing a SOC is another challenge, and the book dedicates chapter 8 to that. The SOC is only as good as the people inside it, and the SOC staff requires a blend of skills. If the organization wants their SOC to operate 24x7, it will obviously require a lot more manpower of these hard to find SOC analysts.



Another helpful aspect is found in chapter 10 which has a number of checklists you can use to verify that all the required pieces are in place prior to a go live data, or be able to identify area that many not be completed as expected.



With Muniz and AlFardan being Cisco employees and this being a Cisco Press title, the book has a strong emphasis towards Cisco hardware and software. Nonetheless, the book is still quite useful even for those who won't be using Cisco products.



Building a SOC is an arduous process which takes a huge amount of planning and of work. This work must be executed by people from different teams and departments, all working together. Based on these challenges, far too many SOC deployments fail. But for anyone who is serious about building out a SOC, this book should be a part of that effort.



The reason far too many, perhaps most SOC deployments fail is that firms makes the mistake of obsessing on the hardware and software, without adequately considering the security operations functions. The authors make it eminently clear that such an approach won't work, and provide you with the expert guidance to obviate that.



For anyone considering building a SOC, or wants to understand all of the details involved in building one, Security Operations Center: Building, Operating, and Maintaining your SOC, is an absolute must read.





Reviewed by Ben Rothke

Submission + - Book review: The Network Security Test Lab: A Step-by-Step Guide

benrothke writes: Title:The Network Security Test Lab: A Step-by-Step Guide

Author: Michael Gregg

Pages: 480

Publisher: Wiley

Rating: 9/10

Reviewer: Ben Rothke

ISBN: 978-1118987056

Summary: Good reference to use to build out home test lab for information security





It wasn't that long ago that building a full network security test lab was an expensive prospect. In The Network Security Test Lab: A Step-by-Step Guide, author Michael Gregg has written a helpful hands-on guide to provide the reader with an economical method to do that. The book is a step-by-step guide on how to create a security network lab, and how to use some of the most popular security and hacking tools.





The book is a straightforward guide that will help the reader in their quest to master the art of effective use of security and hacking tools. The reader that can put in the time and plow through the 400 pages will certainly come out with a strong understanding of how to run the most common set of popular security tools.





The book is written for the reader on the budget. In the introduction, Gregg writes how one can easily find inexpensive networking equipment at budget prices on eBay. While brand new hardware devices can cost in the thousands; one can find Cisco Catalyst switches, and Nokia IP and Check Point firewalls for under $50. Combined with his emphasis on open source software and tools, this is a most practical reference for those looking to increase their security skills without breaking the bank.





The book is meant for the reader with a strong technical background looking to gain experience with network security and related security tools. Other similar books will often waste paper and the reader's time by devoting the first 50 to 100 pages with unwanted introductory text. This book hits the ground running and by page 100, the reader is already analyzing network packets with Wireshark.





As to Wireshark, the book references often. The books online site includes 6 pcap files that can be downloaded and used by the tool in order to analyze various attacks.





The following are the books 11 chapters, which cover the entire range of network security and tools:



1. Building a Hardware and Software Test Platform

2. Passive Information Gathering

3. Analyzing Network Traffic

4. Detecting Live Systems and Analyzing Results

5. Enumerating Systems

6. Automating Encryption and Tunneling Techniques

7. Automated Attack and Penetration Tools

8. Securing Wireless Systems

9. An Introduction to Malware

10. Detecting Intrusions and Analyzing Malware

11. Forensic Detection





The book provides a good balance of coverage between Windows and Linux, and details the use of the many tools for each operating system. Each chapter ends with a series of exercises which can be used to help the reader put the information covered into practice. Those looking to gain experience on a wide variety of tools will enjoy the book. It covers a wide-range of tools and utilities.





Network Security Test Lab: is in the same genre as books such as Hacking Exposed 7: Network Security Secrets and Solutions. The difference is that Hacking Exposedfocuses more on the tools, while this book shows the reader how to build a lab to mimic a real world environment. In addition, this book focuses a bit more on using a holistic approach to creating a secure network, as opposed to just hacking in.





In the effort to make the test lab as inexpensive to build as possible, the book places on emphasis on using virtualization. The book focuses on using the VMware Player; a free virtualization software toolkit for Linux and Windows.





The book covers a huge amount of information and tools. If the reader puts in the time and completes everything, they will have a thorough knowledge of most of the key concepts in network security.





The book is a straightforward read for the serious reader. Those willing to put in the effort and the time, to learn through the various tools will find The Network Security Test Lab: A Step-by-Step Guidea great resource in which to build and develop their information security skills.







Reviewed by Ben Rothke

Submission + - Book review: Cloud Computing Design Patterns (amazon.com)

benrothke writes: Far too many technology books take a Hamburger Helperapproach, where the first quarter or so of the book is about an introduction to the topic, and filler at the end with numerous appendices of publicly available information. These books end up being well over 800 pages without a lot of original information, even though they are written an advanced audience.



In software engineering, a design patternis a general repeatable solution to a commonly occurring problem in software design. A design pattern isnt a finished design that can be transformed directly into code. It is a description or template for how to solve a problem that can be used in many different situations.



Using that approach for the cloud, in Cloud Computing Design Patterns, authors Thomas Erl, Robert Cope and Amin Naserpour have written a superb book that has no filler and fully stocked with excellent and invaluable content.



The authors use design patterns to refer to different aspects of cloud architectures and its design requirements. In the cloud, just as in software, design patterns can speed up the development process by providing tested, proven development paradigms.



The book contains over 100 different design pattern scenario templates that are common to a standard enterprise cloud roll-out. Each scenario uses a common template which starts with a question or specific requirement. It then details the problem, solution, application and the mechanisms used to solve the problem.



The authors build on the notion that for anyone who wants to architect a large cloud solution, they need to have a broad understanding of the many factors involved with the real-world usage of cloud services.



Because cloud services are so easy to deploy, they are often incorrectly misconfigured during roll-out and deployment. The authors write that its crucial have a strong background in cloud services before doing any sort of a rollout. Because it's often so easy to deploy cloud services, this results in far too many failed cloud projects. And when the project is poorly implemented, it can actually cause the business to be in a far worse point from where it was before the cloud rollout.



The authors deserve credit for writing a completely vendor agnostic reference, even though there are many times you would appreciate it if they could suggest a vendor for a specific solution.



The books 10 chapters discuss the following areas:

Chapter 1: Introduction

Chapter 2: Understanding Design Patterns

Chapter 3: Sharing, Scaling and Elasticity Patterns

Chapter 4: Reliability, Resiliency and Recovery Patterns

Chapter 5: Data Management and Storage Device Patterns

Chapter 6: Virtual Server and Hypervisor Connectivity and Management Patterns

Chapter 7: Monitoring, Provisioning and Administration Patterns

Chapter 8: Cloud Service and Storage Security Patterns

Chapter 9: Network Security, Identity & Access Management, and Trust Assurance Patterns

Chapter 10: Common Compound Patterns



Some of the more interesting patterns they detail are:
  • Hypervisor clustering – how can a virtual server survive the failure of its hosting hypervisor or physical server?
  • Stateless hypervisor – how can a hypervisor be deployed with a minimal amount of downtime, while allowing for quick updating and upgrading?
  • Trusted platform BIOS – how can the BIOS on a cloud-based environment be protected from malicious code?
  • Trusted cloud resource pools – how can cloud-based resource pools be secured and become trusted?
  • Detecting and mitigating user-installed VMs – how can user installed VMs from non-authorized templates be detected and secured?

The book is replete with these scenarios, and each scenario includes downloadable figures that effectively illustrate the mechanisms used to solve the problem.





Chapter 3 provides a number of first-rate architectural ideas on how to design a highly resilient cloud solution. Much of the promise of the cloud is built on scalability, elasticity and overall optimization. These chapters show how to take those possibilities from conceptual to a working implementation.





Cloud failures are inevitable and chapter 4 details how to build failover, redundancy and recovery of IT resources for the cloud environment.





Chapter 9 is particularly important, as far too many designers think that since the underlying cloud abstraction layer is highly secure, everything they build on top of that will have the same level of security. The book details a number of design patterns that are crucial to ensuring the cloud design is securing that data at rest and is resistant against specific cloud attacks.





With a list price of $49.99, the book is a bargain considering the amount of useful information the book provides. For anyone involved with cloud computing design and architecture, Cloud Computing Design Patterns, is an absolute must read.







Reviewed by Ben Rothke

Slashdot Top Deals

Parts that positively cannot be assembled in improper order will be.

Working...