Skip navigation
  • RSA Conference Twitter
  • RSA Conference Facebook
  • RSA Conference RSS
  • RSA Conference Youtube
  • RSA Conference Flickr
  • RSA Conference LinkedIn
  • RSA Conference iTunes
1 2 3 ... 13 Previous Next

Ben Rothke: Security Reading Room

188 Posts tagged with the rothke tag
0

When I first got a copy of Elementary Information Security, based on its title, weight and page length, I assumed it was filled with mindless screen shots of elementary information security topics, written with a large font, in order to jack up the page count.  Such an approach is typical of far too many security books.  With that, if there ever was a misnomer of title, Elementary Information Security is it.

 

For anyone looking for a comprehensive information security reference guide - Elementary Information Security is it. While the title may say elementary, for the reader who spends the time and effort to complete the book, they will come out with a complete overview of every significant information security topic.

 

The book is in fact a textbook meant to introduce the reader to the topic of information security.  But it has enough content to be of value to everyone; security notices or experienced professional.

 

Author Richard Smith notes that if you want to get a solid understanding of information security technology, you have to look closely at the underlying strengths and weakness of information technology itself, which requires a background in computer architecture, operating systems and computing networking.

 

With that, Elementary Information Security is a tour de force that covers every information security topic, large and small. The book also provides a relevant overview of the peripheral topics that are embedded into information security. 

 

In 17 chapters covering over 800 pages, the book is well organized and progressively gets more complex.  Two large chapters of the book are freely available online, with chapter 3 here and chapter 9 here.

 

The following are the chapters in the book, which shows a comprehensive overview of all of the core areas around information security:

 

  1. Security From the Ground Up
  2. Controlling a Computer
  3. Controlling Files
  4. Sharing Files
  5. Storing Files
  6. Authenticating People
  7. Encrypting Files
  8. Secret and Public Keys
  9. Encrypting Volumes
  10. Connecting Computers
  11. Networks of Networks
  12. End-to-End Networking
  13. Enterprise Computing
  14. Network Encryption
  15. Internet Services and Email
  16. The World Wide Web
  17. Governments and Secrecy

 

 

The early chapters focus on the fundamentals of computers and networking, and the core aspects of information security.  The chapters progress in complexity and deal with distributed systems and more complex security topics.  The mid-chapters deal with cryptography, starting with an introduction to the topic, into more complex topics and scenarios.  One is hard-pressed to find an information security topic not covered in the book.

 

Chapter 1 is on Security from the Ground Up and lays the groundwork for what security is.  Various topics around risk are detailed; such as identifying, prioritizing and assessing risks.

 

Chapter 2 is on Controlling a Computer and reviews the underlying architecture around computers. 

 

For some people, much of their learning about information security is based on rote memorization.  In the book, Smith eschews this and each chapter closes with a glossary of topics, and penetrating questions.   There are also problem definitions which detail practical situations with the hope that the reader can create and adequate security solution.  The reader who spends extra time reviewing the questions will find that it will significantly help in their mastering the myriad topics.

 

The goal of the questions and exercises is to make the knowledge real. Some of the exercises include watching movies with computer security related topics such as The Falcon and the Snowman, Crimson Tide, and others.  For example, in The Falcon and the Snowman, the author asks the reader to identify two types of security measure that would have helped prevent theft of the crypto keys.  In Crimson Tide, it asks the reader to consider the missile launch procedures portrayed in the film and asks if it is possible for a single person to launch a nuclear missile.  Another scenario is that under what circumstances a recipient should accept an unauthenticated message.  It also asks the reader to give an example of a circumstance in which accepting an unauthenticated message would yield the wrong result.

 

The book is not meant as a For Dummies guide to the topic, and it assumes a college-level comprehension of relevant mathematical concepts.  Note though that the requisite math is detailed in the sections on encryption and cryptography.

 

The book is also the first textbook certified by the NSA to comply with the NSTISSI 4011 standard, which is the federal training standard for information security professionals.  The author notes on his blog that in order to gain that certification, he had to map each topic required by the standard to the information as it appears in the textbook.

 

Given the value of the book, (ISC)² should consider using this title as a reference for their CISSP certification.   With all of the CISSP preparation guides available, even the Official (ISC)2 Guide to the CISSP CBK, one is hard pressed to find a comprehensive all-embracing security reference such as this.  Some may even want to simply use this book as their definitive CISSP study guide.

 

For those looking for a single encyclopedic reference on information security, they should look no further than Elementary Information Security.   Richard Smith has written a magnum opus on the topic, which will be of value for years to come.

 

 

 

 

 

Ben Rothke is the author of Computer Security: 20 Things Every Employee Should Know.

388 Views 0 Comments 0 References Permalink Tags: deployment_strategies, enterprise_defense, hackers_and_threats, identity_and_access_management, policy_and_government, wireless, data_breach, cybercrime, privacy, social_networks, cloud_computing, data_security, cissp, malware, cybersecurity, business_of_security, rothke, information_security, nsa, dark_reading, isc2, cism, 1449648207, 978-1449648206, jones, bartlett, elementary_information_security, richard_smith, nstissi, 4011, nstissi_4011, jones_, &_bartlett_learning, cryptosmith
0

One of the selling points around virtualization is about its perceived added level of security.  But virtualization, like any other piece of software can be implemented incorrectly, and itself have flaws. 

 

Last year, NIST came out with SP 800-125, Guide to Security for Full Virtualization Technologies.  The guide is intended for system administrators, security program managers, security engineers and anyone else involved in designing, deploying or maintaining full virtualization technologies.

 

NIST SP 800-125 recommends organizations do the following:

  • secure all elements of a full virtualization solution and maintain their security
  • restrict and protect administrator access to the virtualization solution
  • ensure that the hypervisor, the central program that runs the virtual environment, is properly secured
  • carefully plan the security for a full virtualization solution before installing, configuring and deploying it

 

All good items to do; but at 25 pages, SP 800-125 is clearly inadequate to cover all of the details around how to securely use virtualization.  With that, Securing the Virtual Environment: How to Defend the Enterprise Against Attack, by Davi Ottenheimer and Matthew Wallace is a great new book that that provides a comprehensive overview on how to secure systems and defend against attacks on virtualized environments.

 

The book takes a very strong approach that in order to secure virtualization effectively, one needs to understand how adversaries will attack a virtualized environment.  The authors provide numerous details on how to precisely do that.

 

The book is a highly technical guide meant for those designing, deploying and administering virtualized systems. At 400 pages, the books 10 chapters provide a wealth of information to secure virtualized systems.

 

Chapter 5 on Abusing the Hypervisor is perhaps the best chapter in the book and the most important topic regarding virtualization security.  The hypervisor is the software, also called the virtual machine manager (VMM) that manages the entire virtualization environment.  Malware will often attack the hypervisor in order to gain control. 

 

The book also contains an appendix on how to build a virtual attack test lab.  It details the components of the virtual penetration testing lab, including how to build the gateway, Xen hypervisor and KVM, and how to build the cloud stack.

 

The accompanying DVD contains code and scripts from the book and also contains a Ubuntu 6 virtual machine, pre-loaded with various network security tools.

 

Chapter 1 on virtualized environment attacks is freely available here.  After reading that, most readers will likely want to read the entire book, and they should.

 

Anyone who is serious about virtualization security should certainly make sure that Securing the Virtual Environment: How to Defend the Enterprise Against Attack is on their reading list, and that of every security administrator in their company.

728 Views 0 Comments 0 References Permalink Tags: cryptography, deployment_strategies, enterprise_defense, hackers_and_threats, policy_and_government, virtualization, data_breach, nist, cybercrime, risk_management, privacy, data_security, malware, cybersecurity, vmware, rothke, hacking, wiley, davi_ottenheimer, came, out, with, sp_800-125, securing_the_virtual_environment, ottenheimer, matthew_wallace, hypervisor, vmm, xen, kvm, 1118155483, 978-1118155486
0

Geeks are often portrayed as nerds whose diet consists of Red Bull and PowerBars.  The truth though is that many technical professionals, geek or not, do not get adequate nutrition, sleep or exercise.


An interesting new book is out in Fitness for Geeks: Real Science, Great Nutrition, and Good Health.

 

In the book, author Bruce Perry discusses the following:


  • best times of day to eat and what to eat
  • why eating carbs before exercising isn't healthy
  • why you can get a beer belly, even if you don't drink beer
  • the best exercise routines to lose weight, and maintain a healthy weight
  • what two things matter most in keeping a healthy lifestyle
  • how to find your way around the gym, especially the weight room
  • the pros and cons of yoga
  • what apps are the best for exercise, and how to use them

 

A good introduction to the book is in this video of Perry.

 

The book also shows how to use new apps with fitness equipment that can be integrated into your lifestyle and fitness routine.

 

This looks to be a really good and important book.  With obesity and diabetes reaching epidemic levels, it is hard to imagine how Fitness for Geeks: Real Science, Great Nutrition, and Good Health can’t be a valuable resource for everyone.

 

Full review (and hopefully weight loss) to follow.

 

 



928 Views 0 Comments 0 References Permalink Tags: science, rothke, o'reilly_media, ora, o'reilly, fitness_for_geeks, bruce_perry, 1449399894, 978-1449399894, exercise, nutrition, endomondo, fitbit, garmin_connect, alpine_replay, zeo, body, health, fitness
0

Documenting the heroism that was displayed on 9/11 and weeks following will eventually fills volumes.  Many gave up their lives trying to save others; and due to the toxic dust at Ground Zero, many of the rescuers are now dying a slow death.

 

While 9/11 brought out the best in many, in some limited cases, it brought out the very worst.  In The Woman Who Wasn't There: The True Story of an Incredible Deception, authors Robin Fisher and Angelo Guglielmo detail the story Tania Head, a woman who said she was a survivor of Tower 2, when in fact she was in business school in Spain on 9/11.

 

Head joined the World Trade Center Survivors' Network support group and a short while later became president of the group.

 

Now that April 15 has past and tax returns are being processed, there are many stories of tax refund fraud affecting many innocent people.  While such crimes are reprehensible, most of these victims will likely receive their money. What is so evil about what Tania Head did, is that she purloined people who were victims in need of consolation, and in her sociopathic quest for validation, lied to them.  These lies spanned the course of years.

 

The survivors of 9/11 whose faith in humanity had been shattered, but who had risked trusting again and had chosen Tania to lead them out of the abyss, were left wondering how should could do what she had done.   She deliberately chose the most vulnerable people and exploited them by making up a tale so terribly heartbreaking that they couldn’t do anything but trust her, because her story was the saddest of them all.

 

The story that Fisher and Guglielmo so eloquently tell is both fascinating and heartbreaking.

 

Most books like this would include a number of pictures of the subject at hand.  My supposition is that that author’s purposely left out pictures of Ms. Head as not to predispose the read. 

 

Head did not look like a typical conniver, but indeed was a master manipulator. Since she appeared so legitimate, so sincere, and the story she told so compelling, no one initially thought that her story, while heartbreaking, was anything less than true.  The reality is that Head’s hog-like demeanor was simply a manifestation of her utter narcissist personality. 

 

Her undoing came just days before 9/11/2007, in a New York Times story that exposed her fraud.   After that point, Head was dismissed as head of the World Trade Center Survivors' Network, and has not been heard from since.

 

In the vernacular of information security, Tania Head was a type of social engineer.  In the book Social Engineering: The Art of Human Hacking, Christopher Hadnagy details how attackers use social engineering techniques to manipulate people into performing actions or divulging confidential information.

 

While Head did not gain any financial benefit via her deception, what she was gaining was a sense of self-worth and importance, at the expense of other people’s trust and emotions.  True, she likely violated no law, but from a moral perspective, violated the very tenets of human trust.

 

The Woman Who Wasn't There: The True Story of an Incredible Deception is a fascinating book.  If you do choose to read it, and you should; block out about 4 hours of your day, as once you start it, you won’t be able to put it down.

622 Views 0 Comments 0 References Permalink Tags: social_engineering, rothke, dark_reading, hadnagy, woman_who_wasn't_there, world_trade_center, wtc, 9/11, september_11, robin-gaby_, fisher, angelo_guglielmo, touchstone, 1451652089, 978-1451652086, criminals, tania_head, world_trade_center_survivors_network
0

Just got a copy of the Cyber Security Policy Guidebook.  If you judge a book by the cover, this should be a good one, as some of the authors are major information security heavyweights such as Jennifer Bayuk, Marcus Sachs and others.

 

While policy is in the title, this is not a policy template reference like Information Security Policies Made Easy.  Rather the book attempts to create a taxonomy of the most pressing information security policy issues. 

 

Looks to be a good read.

 

Full review to follow.

638 Views 0 Comments 0 References Permalink Tags: deployment_strategies, enterprise_defense, hackers_and_threats, policy_and_government, data_breach, cybercrime, privacy, data_security, malware, cybersecurity, business_of_security, rothke, marcus_sachs, bayuk, wiley, jennifer_bayuk, 1118027809, 978-1118027806, paul_rohmeyer, jeffrey_schmidt, joseph_weiss, jason_healey
0

While Julius Caesar likely never said “Et tu, Brute?” the saying associated with his final minutes has come to symbolize the ultimate insider betrayal. 

 

In The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, authors Dawn Cappelli, Andrew Moore and Randall Trzeciak of the CERT Insider Threat Center provide incontrovertible data and an  abundance of empirical evidence, which creates an important resource on the topic of insider threats.  There are thousands of companies that have uttered modern day versions of Et tu, Brute due to insidious insider attacks and the book documents many of them.

 

The book is based on work done at the CERT Insider Threat Center, which has been researching this topic for the last decade.  The data the threat center has access to is unparalleled, which in turn makes this the definitive book on the topic.  The threat center has investigated nearly 1,000 incidents and their data sets on the topic are unrivaled.  With that, the book truly needs to be on the desktop of everyone tasked with data security and intellectual property protection.

 

The book provides a unique perspective on insider threats as the CERT Insider Threat Center pioneered the study of the topic, and has exceptional and empirical data to back up their findings.  While there are many books on important security topics such as firewalls, encryption, identity management and more; The CERT Guide to Insider Threats is the one of the first to formally and effectively tackle the extraordinary devastating problem of trusted insiders who misappropriate data.

 

In the introduction, the authors write that a common misconception is that insider threat risk management is the responsibility of IT and information security staff members exclusively.  The reality is that it is the responsibility of senior management to ensure that there is an overarching program to deal with insider threats at the enterprise level.  Surpassingly and shockingly, far too few organizations have insider threat programs in place, and the book has scores of stories and case studies on those organizations that have become victims.  While senior management created information security solutions to secure the perimeter; they were oblivious to the data leakage emanating from the interior network.

 

The authors reiterate that it is critical that all levels of management recognize and acknowledge the threat posed by insiders and take appropriate steps to mitigate malicious insiders.  While it is impossible to stop every attack, what management can certainly do is build resiliency into their organizations infrastructure and business processes.  This enables the organization to detect the attacks earlier and minimize the financial and operational impact.  The book provides the specific details on how an organization can precisely do that.

 

In 9 detailed chapters and 6 appendices, the book provides a comprehensive and exhaustive analysis of the problem and menace of insider threats. After completing the book, one is well-prepared to initiate an insider threat program.  The book provides examples of insider crimes from nearly every industry segment and ample data to share with management to convince them that the threats, both to their intellectual property and corporate profits, are very real.

 

After a high-level overview of the topic in chapter 1, the next chapter gets into the details of insider IT sabotage.  While some think that stopping IT sabotage is next to impossible, the authors detail and have identified distinct patterns in nearly every IT sabotage case.  The book details those patterns and also presents mitigation strategies, both technical and non-technical, to deal with those threats.

 

The chapter provides fascinating insights into how these crimes are carried out.  The authors note that by their very nature, these attacks require technical sophistication and privileged access and are usually carried out by sysadmins, DBA’s and programmers.  A surprising CERT finding is that the majority of the attacks occur after the insider has been terminated or quit the organization.  Part of the problem is that many organizations don’t have a process in place to immediate terminate access when a worker resigns or is fired.  In addition, 25% of the cases were carried out by full-time contractors.

 

Chapter 3 provides an intriguing look at the issue of insider theft of intellectual property (IP).  Any firm that has a sizable amount invested in their IP (i.e., anything you can put on a USB stick) needs to take this chapter to heart.  One of the many misconceptions CERT research has uncovered on this topic is that sysadmins are indeed not the biggest threat to IP, even though they have complete access to networks, systems and data.


According to the CERT data, they have not found a single case in which a sysadmin stole IP.  Rather the biggest threat to IP is insider theft by scientists, engineers, programmers or salespeople.  Also, CERT found that about a third of the IP cases were carried out for the benefit of a foreign government of organization, with China having more cases of IP theft than the other 9 countries combined.

 

Given the nature of China and its appetite for data theft, the book is surprisingly silent on specific suggestions in which to deal with threats from China.  I would have liked to have seen at least a chapter dedicated to this topic. 

 

The chapter continues and provides detailed lists of issues leading to job dissatisfaction that can lead a trusted employee or contractor to commit IP theft, and provides detailed steps on what companies can do to stop it.

 

Chapter 4 details everything you need to know about insider fraud.  A fascinating statistic detailed is that the average insider fraud crime spans about 15 months, with half of the crimes lasting 5 months or more. The authors write that insider fraud is typically a long and ingoing crime.  All of this is happening, over the course of months and years, and the organizations being pilfered are oblivious to it.

 

The book is worth reading for chapter 6 alone, which details best practices for the prevention and detection of insider threats.  The best practices in chapter 6 give the reader a framework for establishing an insider threat program.  Many of the best practices detailed are elements of a good security program, so they should not be news to anyone.  Some of the best practices include: security awareness training, physical security controls, separation of duties, and perhaps the most blatantly obvious suggestion of them all: deactivate access following termination.

 

Another fascinating fact detailed in the book is that almost all insiders involved in acts of IT sabotage displayed behavioral indicators prior to committing their crimes.  Some of those indicators include: conflicts with coworkers or supervisors, improper use of data assets, sanctions and rule violations.  Organizations that act on these precursors can prevent the insider crimes from taking place.

 

Aside from its lack of coverage on how to specifically deal with the China threat, the only other lacking in the book is that in all of the examples and case studies, even those whose breaches are publically known, organizations are not mentioned by name. 


According to author Dawn Cappelli, Technical Manager at the CERT Insider Threat Center, they took that approach based on interviews for approximately 230 of their cases, with prosecutors, investigators, victim organization, or convicted insiders.  In those interviews they guaranteed confidentiality of the information they obtained.  Therefore, CERT considers the success of their research directly related to their reputation in the community for being trustworthy for maintaining confidentiality. While there reasoning makes sense, anonymous case studies are often unsatisfying

 

Insider threats are pervasive and undisputable. Organizations such as the CERT Insider Threat Center and individuals like Antonio Rucci provide vital services evangelizing about this critical topic.  This entertaining video of Rucci from DEFCON 17 is a great primer on the topic.

 

Most of the firms who fall victim to insider threats are oblivious to them as they occur. The book details effective and operational security practices which can help every organization create an insider threat program to counterattack the majority of insider attacks.

 

When it comes to insider threats, the only way to avert them is to have a prevention program in place.  In The CERT Guide to Insider Threats: How to Prevent, Detect, and Respond to Information Technology Crimes, the authors have created an invaluable guidebook, with myriad details in which to enable the reader do that.  The facts around insider threats speak for themselves.  Anyone charged with protection of corporate data should ensure this book is on their required reading list.  If not, and they fall victim to an insider attack, they have no one to blame but themselves.

1206 Views 0 Comments 0 References Permalink Tags: business_trends_and_impact, enterprise_defense, hackers_and_threats, insider_threats, data_breach, cybercrime, china, data_security, cybersecurity, cert, business_of_security, rothke, espionage, dawn_cappelli, andrew_moore, insider_threat, randall_trzeciak, addison-wesley, 0321812573, 978-0321812575, insider_threat_center, antonio_ricci
0

Full disclosure:  While I am on the Expert Panel for Information Shield, Inc., publishers of this book, I receive no remuneration other than a review copy, nor do I have any editorial input in the book.

 

Information Security Policies Made Easy Version 12 is now out.  My review of version 11 is here.


Version 11 came out over 2 years ago, and version 12 looks to fill in the numerous policy gaps that have crept in since. 

 

To give you an idea of the breath of version 12, the Master Policy List is 53 pages in length.

 

Version 12 also includes new security policies have been added within each ISO 27002 category. 

 

What I wrote about version 11 holds true for version 12: Information Security Policies Made Easy is a valuable tool that can be utilized to create a comprehensive set of information security policies in a cost- and time-effective manner. For those building corporate or organizational security policies, Information Security Policies Made Easy Version 12 is clearly a definitive reference.

 

Full review to follow.

633 Views 0 Comments 1 References Permalink Tags: pci, fisma, hipaa, dss, rothke, security_policy, information_shield, information_security_policies_made_easy, ispme, charles_cresson_wood, david_lineman, 1881585166, 978-1881585169, 17799, cobit, dave_lineman, 1881585174, 978-1881585176, sarbanes-oxley, hitech
0

Just got a copy of Security Strategies in Web Applications and Social Networking.  Not the newest book around, but it still is quite relevant.


The book details how to securely design and deploy web applications.

 

In just under 400 pages, it covers a lot of the core aspects of web app security, including a significant emphasis on mobile devices.

 

The book is extremely detailed, very organized and provides a good balance of information, including technical details and implementation guidelines.

 

Looks to be a really good book.

 

Full review to follow.

551 Views 0 Comments 0 References Permalink Tags: enterprise_defense, risk_management, data_security, cybersecurity, security, cso, rothke, social_networking, jones, bartlett, strategies, web_applications, mike_harwood, harwood, jones_&_bartlett, 0763791954, 978-0763791957

Microsoft Manual of Style

Ben Rothke
Posted by Ben Rothke Mar 21, 2012
0

The Chicago Manual of Style (CMS), now in its 16th edition, is the de facto a style guide for American writers.  It deals with aspects of editorial practice, grammar, usage, document preparation and more. It’s just one of many style guides for writers.

 

The Microsoft Manual of Style, just released in its 4th edition, attempts to do for the technical writers what the CMS has done for journalists and other writers.

 

A style guide or style manual is a set of standards for the writing and design of documents, either for general use or for a specific publication, organization or field. The implementation of a style guide provides uniformity in style and formatting of a document.  There are hundreds of different style guides available - from the EU Interinstitutional style guide, The Elements of Style by Strunk and White, to the Associated Press Stylebook and Briefing on Media Law and many more.

 

Microsoft’s goal in creating this style manual is about standardizing, clarifying and simplifying the creation of content by providing the latest usage guidelines that apply across the genres of technical communications. The manual has over 1,000 items, so that each author does not have to make the same 1,000 decisions.

 

Anyone who has read Microsoft documentation knows it has a consistent look, feel and consistency; be it a manual for Visual C#, Forefront or Excel.  With that, the Microsoft Manual of Style is an invaluable guide to anyone who wants to better the documentation they write.

 

For example, many writers incorrectly use words such as less, fewer and under as synonymous terms. The manual notes that one should use less to refer to a mass amount, value or degree; fewer to refer to a countable measure of items, and not to use under to refer to a quantity or number.

 

Style guides by their very nature of highly subjective and no one is forced to take accept the Microsoft style as dogma.  The authors themselves (note that the book was authored by a group of senior editors and content managers at Microsoft, not a single individual) note that they don’t presume to say that the Microsoft way is the only way to write. Rather it is the guidance that they follow and are sharing it with the hope that the decisions they have made for their content professionals will help others promote consistency, clarity and accuracy.  With that, they certainly have achieved that goal.

 

The book is made up of two parts; with part 1 comprised of 11 chapters on general topics.

 

Chapter 1 is about Microsoft style and voice and has basic suggestions around consistency, precision, sentence structure and more.  The chapter also has interesting suggestions on writing bias-free text.  It notes that writers should do their best to eliminate bias and to depict diverse individuals from all walks of life in their documentation.  It’s suggested to avoid terms that may show bias with regards to gender, race, culture, ability, age and more.  Some examples are to avoid terms such as chairman, salesman and manpower; and use instead moderator, sales representative or workforce.

 

The manual also notes that writers should attempt not to stereotype people with disabilities with negative connotations.  It suggests that documentation should positively portray people with disabilities.  It emphasizes that documentation should not equate people with their disability and to use terms that refer to physical disabilities as nouns, rather than adjectives.

 

The book takes on a global focus and notes that since Microsoft sells its products and services worldwide, content must be suitable for a worldwide audience.  For those writing for a global audience, those sections of the manual should be duly considered.

 

The manual also cautions authors to avoid too many technical terms and jargon. The danger of inappropriate use of technical terms is that people who don’t think of themselves as computer professionals consider technical terms to be a major stumbling block to understanding. The manual suggests whenever possible, to use common English words to get the point across, rather than technical one.

 

The book provides thousands of suggestions on how to write better documentation, including:

  • do not use hand signs in documentation - nearly every hand sign is offensive somewhere
  • do not refer to seasons unless you have no other choice – since summer in the northern hemisphere is winter in the southern hemisphere
  • spell out names of months – as 3/11/2012 can refer to March 11, 2012 in some places and November 3, 2012 in others
  • use titles, not honorifics, to describe words such as Mr. or Ms. – not all cultures have an equivalent to some that are common in the United States, such as Ms.

 

Chapter 6 is on procedures and technical content and explains that consistent formatting of procedures and other technical content helps users find important information quickly and effectively.  In the section on security, the style guide notes not to make statements that convey the impression or promise of absolute security.  Instead, the writer should focus on technologies or features that help achieve security; and suggests to be careful when using words such as safe, private, secure, protect, and their synonyms or derivatives.  It is best to use qualifiers such as helps or can help with these words.

 

As noted earlier, the style guide is simply a guide, not an absolute. In the book Eats, Shoots & Leaves: The Zero Tolerance Approach to Punctuation, author Lynne Truss write of terms that are grammatically incorrect, but so embedded into the language, that they are what she terms a lost cause.  With that, the style guide has the pervasive use of the term all right, as opposed to alright. 

 

According to dictionary.com, although alright is a common spelling in written dialogue and in other types of informal writing, all right is used in more formal, edited writing.  My own preference is that alright is clearer and ultimately more concise. In this guide, I found that Microsoft’s preference for all right to be distracting.

 

Differences aside, part 1 provides vital assistance to any writer that is interested in writing effective content that educates the reader in the clearest manner possible.  The book is the collective experience of thousands of writers and their myriad sets of documentation.  The book provides page after pages of unique information.

 

Part 2 is a usage dictionary that is a literal A-Z of technical terms, common words and phrases.  The goal of the usage dictionary is to give the reader a predictable experience with the content and to ensure different writers usage a standard usage of the same term.  Some interesting suggestions in the usage dictionary are:

 

  • access rights – an obsolete term.  Use user rights
  • collaborator – do not use collaborator to describe a worker in a collaborative environment unless you have no other choice as it is a sensitive term in some countries.  Specifically, being a collaborator in a third-world country can get one killed.
  • email – do not use as a verb.  Use send instead. 
  • master / slave – do not use as the terminology, although standard in the IT industry, may be insulting to some users.  The manual notes that its use is prohibited in a US municipality.
  • press – differentiate between the terms press, type, enter and use, and to use press, not depress, hit or strike when pressing a key on the keyboard

Some of the terms suggested are certainly Microsoft centric, such as:

  • blue screen – they suggest not to use blue screen, either as a noun or a verb to refer to an operating system failure. Use stop or stop error instead
  • IE – never abbreviate Internet Explorer; always use the full name

 

Say what you will about Microsoft, but any technical writer who is serious about being a better writer can learn a lot from the writers at Microsoft. Microsoft is serious and passionate about documentation and it is manifest in this style guide. 

 

Microsoft has been criticized for their somewhat lukewarm embrace of open source.  With the Microsoft Manual of Style, Microsoft is nearly freely sharing a huge amount of their intellectual capital.  At $29 for the paperback and $10 for the Kindle edition, the manual has a windfall of valuable information at a bargain-basement of a price.

 

This guide is a comprehensive manual for the serious writer of technical documentation, be it a high school student or veteran author. In fact, to describe the guide as comprehensive may be an understatement, as it details nearly every facet of technical writing, including arcane verb uses. 

 

Many authors simply write in an ad-hoc manner.  This manual shows that effective writing is a discipline.  The more disciplined the writer, the more consistent and better their output.  Anyone that wants to be a better writer will undoubtedly find the Microsoft Manual of Style an exceptionally valuable resource.

 

 

 

 

 

 


1316 Views 0 Comments 0 References Permalink Tags: professional_development, microsoft, business_of_security, rothke, style, microsoft_manual, cms, microsoft_press, 0735648719, 978-0735648715, documentation, style_guide
0

In IT Security Interviews Exposed: Secrets to Landing Your Next Information Security Job, the authors cover core information security topics, and then pose various questions that may come up in the course of an interview.  Some of the areas covered are network and security fundamentals, firewalls, regulations, wireless, security tools, and more. 

 

The book is a standard interview preparation guide, with a focus on information security.

 

Last week, Gal Shpantzer, in a moment of levity, wrote a blog post We Didn't Start the Fire(wall), set to the tune of We Didn't Start the Fire by Billy Joel.

 

The highlights of Gal’s prose are as follows:

 

Hacktivism, PGP, Red China, Entropy

BlackBerry, Neuromancer, PageRank SEO.

Dan Kaminsky, Richard Nixon, Studebaker, Max Vision

Red Pill, Blue Pill, CISSP.

RADIUS, Logic Bomb, Pain Ray, Johnny Long

Gene Schultz, The King And I, when do we stop SQLi?

Robert Morris, Vaccine, England's got the same queen

DVD Jon, Liberace, Operation Bot Roast.


Chorus: We didn't start the firewall

It was always burning

Since the URL’s been turning

We didn't start the fire

No we didn't light it

But we tried to fight it.


Pirate Party, Rybolov, Nimda and CSRF

Blaster LoveBug, John The Ripper, Communist Bloc

SRI, BBN, PDF bugs round the bend,

D-N-S Fails, Synchronize the Clocks.

Stuxnet, LASER Beam, BSides’ got a winning team

Hoffacino, Xerox PARC, Kristin Paget, Bletchley Park.

Lycos, LulzSec, Altavista, Cuckoo’s Egg

Freedom Frisk, Howard Schmidt, Paris Hilton’s Sidekick.


Cyber Storm, AirCrack, Mickey Mantle, ENIAC

Mitnick, System High, It’s the year of PKI

Keyloggers, Stacheldracht, Operation ShadyRAT

BitLocker, SecuTwits, Sony-BMG Rootkit

SE Linux, @Beaker, EFF, Mafia

SIPRNET, Lamo, Ripco is a no-go.

U2, WikiLeaks, IANA and IRC

Securosis, RAND Corp, Hacker’s Manifesto


Zimmerman, LANMan, Stranger in a Strange LAN

Webcam, KLM, APT invasion

(David) Bell-Lapadula, Foursquare check-in mania

Vint Cerf, Trojans, GPUs make BitCoins

JavaScript, Active X, British Politician sex

RSA: Blown away! What else do I have to say?!?

Chorus


451, brute forcing, Kerberos is back again

Pick locks, teraflops, Captain Crunch, DevOps

Begin, Reagan, Cross Domain, hackers bringing Titan Rain

Ayatollas in Iran, US in Afghanistan

9/11, Sally Ride, Biba Model, suicide

Foreign debts, homeless vets, AIDE, Crack, iOS

Got collisions in the SHA, China's under martial law

BYOD, browser wars, I can't take it anymore!

 

Chorus (2x)

 

Most of the people I shared this with got a kick out of it.  While Shpantzer won’t be quitting his day job anytime soon in pursuit of a Grammy, I think his lyrics make a great hiring tool to be used in the interview process. 

 

While Shpantzer meant this as a comic relief vehicle, I think he might be onto something much bigger. Here is my idea, next time you are going to interview someone for an information security spot, don’t obsess on their resume; rather show them We Didn't Start the Fire(wall) and ask them to explain them.

 

The (ISC)² CBK (common body of knowledge) is a taxonomy used as a basis for the CISSP exam.  It is a collection of topics relevant to information security professionals around the world. It establishes a common framework of information security terms and principles which allows information security professionals worldwide to discuss, debate, and resolve matters pertaining to the profession with a common understanding. 

 

Shpantzer created his own CBK and if the job candidate can adequately explain We Didn't Start the Fire(wall), then they likely have a good handle on information security.  It covers everything from encryption, malware, certifications, industry personalities, to industry conferences, hacking tools, protocols, hardware, operating systems, vulnerabilities and much more.

 

Of course, if too many people take my advice, then we would see the beginning of We Didn't Start the Fire(wall) boot camps, prep guides, books, cheat sheets, seminars and more; which would obviate the efficacy of it as a testing tool. 

 

But if that would happen, Shpantzer would likely have by then written We Didn't Start the Next Generation Fire(wall).

 


944 Views 0 Comments 0 References Permalink Tags: firewall, rothke, the, wiley, interview, 0471779873, 978-0471779872, gal, shpantzer, gal_shpantzer, we, didn't, start, fire(wall), billy_joel, hr

In memory of Hal Tipton

Ben Rothke
Posted by Ben Rothke Mar 18, 2012
0

Hal Tipton passed away last week.  Some called him the father of the CISSP certification, as he was the main author of the (ISC)² CBK. 

 

In 2001, (ISC)² has given out the the Harold F. Tipton Lifetime Achievement Award. The award is given annually to those who share Hal’s tradition of passionately promoting and enhancing the information security profession.  He was the first recipient of the award.

 

I first met Hal about 15 years ago at a Computer Security Institute conference and from the outset was impressed by his character.

 

Tipton was best known as the editor of numerous information security reference guides and CISSP study guides, including the Official (ISC)2 Guide to the ISSMP CBK, Information Security Management Handbook and others.

 

While Hal was a major influence and inspiration to many people, a lot of people nonetheless didn’t know him.  Part of the reason was that he was very much a behind the scenes type of person.

 

He used his talents and influence always in a positive way, and gave many people numerous opportunities to contribute to the information security community.

 

Hal’s experience goes all the way back to the early days of information security, many decades ago. 

 

Hal was a great listener, full of good advice, humble, and just a very nice and kind person.

 

The world is a better place because of Hal, and he will be sorely missed.

1798 Views 0 Comments 0 References Permalink Tags: cissp, cybersecurity, rothke, isc2, cbk, hal, tipton, hal_tipton, harold_tipton
0

Just got a copy of Cyber Attacks: Protecting National Infrastructure by Edward Amoroso, Chief Security Officer at AT&T.


The book notes that the US lacks a coherent technical and architectural strategy for preventing cyberattacks from crippling essential critical infrastructure services.


The goal of the book is to start a dialogue amongst the general technical community around proper methods for reducing national risk.


Amoroso is one of the most pragmatic and provocative members of the information security community and this looks to be a valuable resource.


Full review to follow.

986 Views 0 Comments 0 References Permalink Tags: business_trends_and_impact, hackers_and_threats, policy_and_government, data_breach, cybercrime, privacy, data_security, cybersecurity, cyber, national, infrastructure, rothke, at&t, butterworth-heinemann, 0123918553, 978-0123918550, elsevier, attacks, protecting, edward_amoroso, amoroso
0

Just got a copy of Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software.

 

For many people, malware analysis means running an anti-virus software scan on their desktop and seeing how many threats were found.


For those that are looking for more, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software is a comprehensive guide to use to systematically understand, analyze, debug and disassemble malicious software.

 

This is a highly technical and valuable book for anyone who wants to get to the depth of truly understanding how malware works. 

 

At over 700 pages, the book covers nearly everything on the topic.


Infosec guru Richard Bejtlich wrote the forward to the book and he says it best when he writes that armed with this book, you will have the edge you need to better detect and respond to intrusions on your enterprise or that of your clients. He concludes that every piece of malware you reverse engineer and scrutinize raises the opponent cost by exposing his dark arts to the sunlight of knowledge.  I could not have said it any better.

 

For anyone looking for an authorities guide on the topic, Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software is required reading on the topic.

1087 Views 0 Comments 0 References Permalink Tags: malware, rothke, no_starch_press, malicious_software, no_starch, practical_malware_analysis, michael_sikorski, sikorski, andrew_honig, honig, 1593272901, 978-1593272906, mandiant, bejtlich, ida_pro, ollydbg, windbg
0

In the 1800s, workers who became known as Luddites protested against machinery that cut the need for their own physical labor, and the name has since become synonymous with opposition to technological progress of any kind.


Today’s Luddite would likely protest what the Internet has brought. In fact, the first 200 pages of Digital Assassination: Protecting Your Reputation, Brand, or Business Against Online Attacks has enough real-life horror stories to convince a significant number of people that the Internet’s technological prowess comes at too high a cost.


Numerous stories in the book describe how the Internet is being used to destroy brands, reputations, and people’s well-be­ing. These incidents range from inappropriate use of Facebook and blog postings to bogus Wiki­pedia entries to blatant Internet-based character assassination, and much more. The book familiarizes readers with terms such as “silent slashes,” “evil clones,” and “jihad by proxy” as the authors describe the “seven swords of digital assassination” that damage entities’ reputations.


But the book does more than scaremongering. In chapter 11, the authors write about the “seven shields of digital assassination,” or the main ways organizations can protect themselves. The authors go into great detail on how an organization should respond to online attempts at character assassination.


Other valuable topics include optimizing reputation and a strategy for digital defense. The authors list many Web sites that can be used to help discover what is being said about an organization or professional on blogs, message boards, and other locations. The authors also provide an effective overview on how entities can use social media to assist in image management.


The original Luddites couldn’t stop the industrial revolution, and no one can stop the digital one. The only logical response is to adapt. Just as any business executive would ensure that the company’s physical perimeter is secured, so too must today’s executive ensure that the company’s online presence is secured. For those serious about a way to do that, Digital Assassination: Protecting Your Reputation, Brand, or Business Against Online Attacks should be required reading.

983 Views 0 Comments 0 References Permalink Tags: rothke, brand, digital_assassination, reputation, online_attack, torrenzano, richard_torrenzano, mark_davis, st._martin's_press, 0312617917, 978-0312617912

Microsoft Manual of Style

Ben Rothke
Posted by Ben Rothke Feb 27, 2012
0

The Chicago Manual of Style (CMS), now in its 16th edition, is the de facto a style guide for American writers. It deals with aspects of editorial practice, from grammar, usage, document preparation and much more.  The Chicago guide is one of many style guides for writers.


The Microsoft Manual of Style, now just out in the 4th edition, attempts to do for the technical writing world what the CMS has done.


Anyone who has read Microsoft documentation knows it has a consistent look and feel to it. 

 

The goal of the book is to help the reading create documents that are clear and concise.

 

The book contains best practices for writing content for the web, optimizing for accessibility and communicating to a worldwide audience.

 

This looks to be a really good title with a lot of fascinating information.

 

Full review to follow

1854 Views 0 Comments 0 References Permalink Tags: microsoft, business_of_security, rothke, style, microsoft_manual, cms, microsoft_press, 0735648719, 978-0735648715, documentation, style_guide
1 2 3 ... 13 Previous Next

Ben Rothke

Ben Rothke

 Member since: Aug 28, 2009

Ben Rothke, CISSP, CISA is an Information Security Manager with Wyndham Worldwide. He is the author of "Computer Security - 20 Things Every Employee Should Know" and writes book reviews for Slashdot and Security Management magazine.

View Ben Rothke's profile

Popular Blog Posts