Eric Goldman

Fair Information Practices: Overview and Application to the Omnibus Approach (Presentation)

The following presentation is designed to give an overview on the Fair Information Practices. This presentation was originally used in a class project on the creation of an Omnibus Privacy Law in the United States. The Fair Information Practices were originally developed in the United States, but were not actively enacted through laws and regulations there. However, the concepts took hold in the European Union…

26 Feb 2009   ::   Security   ::   #privacy #fair information practices #legal

Conducting an iPod Forensic Investigation

This report provides an overview of how to conduct a forensic investigation of an Apple iPod. The report provides an explanation of the unique features of the iPod which are important for forensic analysis. In addition, the key files which will be of primary interest to the forensic investigator will be detailed and evidence acquisition will be demonstrated. The report includes references to previous research and contributes some new discoveries not previously considered in the forensic analysis of iPods…

22 Feb 2009   ::   Security   ::   #ipod #forensics #filesystem #pda #ftk #encase #sleuthkit

Building Security into System Design

Hale argues that information systems need to be designed with security as a primary factor. He starts the article be emphasizing the number of attacks and their related costs. He notes it is relatively inexpensive to hack any given enterprise which is specifically targeted by skilled hackers, who are always a step ahead of the security researchers and patch writers. He notes that in general, systems are not designed with security in mind, and as a result…

5 Feb 2009   ::   Security   ::   #proactive security #vendor responsibility #network security #enterprise security

An Early Look at Obama's IT Security Plans

…The Obama administration is very interested in taking additional action at the federal level in order to clarify the .patchwork. of current state laws. The objectives primarily deal with strengthening protections from cyber terrorists and digital espionage. The Obama plan is based off of his objectives outlined during his campaign and is line with the recommendations from top experts. The plans will continue and likely accelerate initiatives which were previously outlined during the Bush administration…

24 Jan 2009   ::   Security   ::   #national security #Obama #cyber infrastructure #legislation

A Look at Insider Threats

…while insider attacks are not new, the proliferation of information systems increases the number of people who have access to valuable data. Thus, this significantly increases the number of individuals who may possibly steal information assets. Mr. Reilly notes that the recent economic downturn may be a strong motivator for individuals to commit information theft. White collar professionals may have access to valuable information and can easily find a black market customer via the Internet. Furthermore, there is a much higher level of risk from insiders as they do not have to be technically sophisticated hackers to steal a valuable asset…

20 Jan 2009   ::   Security   ::   #insider #employee monitoring #privacy #proactive security

Challenges and Concerns for Implementing OCTAVE Allegro in a University Environment

The following is a mock report that was developed for the implementation of OCTAVE Allegro in a university environment. Octave Allegro is a security assessment methodology developed by the SEI. It could very easily apply to any college or other organizations. This report provides a good example of how to evaluate any security tool and the challenges that need to be considered before rushing out and implementing a new methodology. The format of this example is a formal report from the IT department to the President of the university…

12 Jan 2009   ::   Security   ::   #OCTAVE allegro #risk assessment #information security

Commentary on the Seven Deadly Sins of Network Security

…to be the major mistakes or misjudgments made by IT administrators when evaluating, planning, and performing security activities. While the author focuses his 'seven deadly sins' on network security, they are certainly applicable to enterprise security in general. The first sin is…

18 Dec 2008   ::   Security   ::   #networking #firewalls #patches #human factors #verizon

Mobile Device Forensic Tool Evaluation

The following report investigates different tools used in forensic investigations of mobile devices. Mobile devices include cell phones, PDAs, and other portable electronics. Such devices can be very useful in the course of an investigation because they often contain valuable, structured data that can be used to place individuals in certain locations or reveal the existence and extent of relationships of interest…

16 Dec 2008   ::   Security   ::   #forensics #PDA #cell phone #tools #NIST #mobile

Conflicting Parties and Privacy Policies

…describes the conflicts that arise between business units, executives, and external parties during privacy policy development, as well as the difficulties in implementing a privacy policy once developed. The main example cited in the article was a conflict between the Chief Privacy Officer (CPO) and the marketing group. The CPO's goal is to protect individuals, and generally wants to maintain the least amount of data necessary for any given individual. At the same time, marketing organizations want the most information per individual possible…

8 Dec 2008   ::   Security   ::   #privacy #enterprise security

Observation of Leadership & Organizational Behavior at McDonald's

McDonald's is comprised of more than 30,000 local restaurants and serves 52 million people in more than 100 countries each day. The company is the largest food retailer in the world and is part of the American way of life. In order to remain competitive and an iconic American institution, McDonald's has developed programs and strategies for motivating employees and teaching leadership…

9 Nov 2008   ::   Non-Technical   ::   #Leadership #Organizational Behavior #McDonalds