Eric Goldman

Challenges and Concerns for Implementing OCTAVE Allegro in a University Environment

The following is a mock report that was developed for the implementation of OCTAVE Allegro in a university environment. Octave Allegro is a security assessment methodology developed by the SEI. It could very easily apply to any college or other organizations. This report provides a good example of how to evaluate any security tool and the challenges that need to be considered before rushing out and implementing a new methodology. The format of this example is a formal report from the IT department to the President of the university…

12 Jan 2009   ::   Security   ::   #OCTAVE allegro #risk assessment #information security

Commentary on the Seven Deadly Sins of Network Security

…to be the major mistakes or misjudgments made by IT administrators when evaluating, planning, and performing security activities. While the author focuses his 'seven deadly sins' on network security, they are certainly applicable to enterprise security in general. The first sin is…

18 Dec 2008   ::   Security   ::   #networking #firewalls #patches #human factors #verizon

Mobile Device Forensic Tool Evaluation

The following report investigates different tools used in forensic investigations of mobile devices. Mobile devices include cell phones, PDAs, and other portable electronics. Such devices can be very useful in the course of an investigation because they often contain valuable, structured data that can be used to place individuals in certain locations or reveal the existence and extent of relationships of interest…

16 Dec 2008   ::   Security   ::   #forensics #PDA #cell phone #tools #NIST #mobile

Conflicting Parties and Privacy Policies

…describes the conflicts that arise between business units, executives, and external parties during privacy policy development, as well as the difficulties in implementing a privacy policy once developed. The main example cited in the article was a conflict between the Chief Privacy Officer (CPO) and the marketing group. The CPO's goal is to protect individuals, and generally wants to maintain the least amount of data necessary for any given individual. At the same time, marketing organizations want the most information per individual possible…

8 Dec 2008   ::   Security   ::   #privacy #enterprise security

Web Server Auditing for HIPAA § 164.312(a)(1)

This is a presentation to help individuals become familiar with some of the technical security requirements of the HIPAA law. This presentation focuses specifically on authentication and protections (access controls) and relates technical concepts back to the legal requirements�

8 May 2008   ::   Security   ::   #hipaa #lamp #sql injection #privacy #authentication