Wednesday Zombie Post–Zombies on Your Kitchen Table

Posted December 26th, 2007 by

What you wanted for Christmas but didn’t get: The Zombie! board game, complete with rulebook and variations.

Similar Posts:

Posted in Zombies | No Comments »

Wednesday Zombie Post–E-Zombie

Posted December 19th, 2007 by

Your favorite phrase in zombie letters. Think of the Christmas present wrapping possibilities!

Similar Posts:

Posted in Zombies | No Comments »

How I Do the “FISMA Thang”

Posted December 18th, 2007 by

No big surprise, I’m a contractor who operates outsourced government IT systems. As a result, I get assessed and audited more than anybody else in the world (yes, hyperbole added). Anyway, I’m going to talk about what I give to my customers in the spirit of “object reuse”, it might come in handy for other people in the future.

I provide the following items to our account teams:

  • Pre-sales: Document explaining how the operations group handles security that can be dropped into a proposal. This is freely-available because it doesn’t open up the cookie jar too much, and proposals to the government are available with the right requests. Modified version is included below.
  • Pre-sales: Traceability matrix to delineate controls provided as part of service. This is released only to the capture/account team.  This is a work-in-progress because it’s a big bite to chew.
  • Post-sales: Security controls document covering shared controls that can be dropped into a system security plan. You can get this in electronic form with a signed NDA.
  • Post-sales: Addendum to Security Controls Document that describes the specifics on hybrid controls for your system.
  • Post-sales: Auditor binder with all local policies and evidence for common controls. You can look but you can’t take it with you.

This is the text of the pre-sales security description, remember it’s written for a general-purpose audience:

Security of the Government IT systems and the data at the $FooCorp Operations Center requires cooperation between the Government and $FooCorp for program-specific and hybrid controls not provided by either the Government (security governance, Exhibit 53 filing) or the Operations Center (physical security, personnel security, media protection).

The hosting, monitoring, and management services provided by the state-of-the-art $FooCorp Operations Center are specially designed, configured and managed to meet the special IT security requirements of our Federal customers. The facility supports a FIPS-199 and FIPS-200 moderate control baseline and provides a common controls subset of SP 800-53 for all customers. The Data Center, NOC, and SOC have been audited numerous times by a wide variety of client agencies and their Inspectors General in support of Security Test and Evaluation, Certification and Accreditation, and annual FISMA audits.

Upon client request, $FooCorp can provide the Government with a Security Controls Document that describes the security controls, primarily physical security, in place at the Operations Center. The SCD is designed to be a “drop-in” augmentation for the customers’ system security plans. The Operations Center staff also maintains an audit binder that is for on-premises viewing by auditors, C&A staff, or security testers.

Now, taking a look at what I have, basically I’m saying the following points:

  • Security controls are a joint responsibility between the Government and $FooCorp.
  • I have common controls to save you time and money, you can get the full details after you hire us.
  • I have many other customers that are satisfied with my controls.

What I have on my wish-list for the future:

  • Being able to provide verification and validation of my common security controls. Yes, a SAS-70 properly scoped fits in here, but I don’t have the budget to make it happen and it will end up being a duplication of effort in most cases where the customer wants to do their own assessment.
  • Being able to reuse evaluation results from one customer to to share with other customers. So far, I haven’t gotten any traction to do this because everybody wants to own their assessment results even though it’s a shared control.

Similar Posts:

Posted in Outsourcing, The Guerilla CISO, What Works | 3 Comments »

Wednesday Zombie Post–The Federal Vampire and Zombie Agency

Posted December 12th, 2007 by

Interesting concept: The Federal Vampire and Zombie Agency. Something makes me think it should be part of DHS.

But check out the following bits of information:
Myth: Zombies are immortal
Source: as with vampires, victims of zombie bites arise from comas, an event often misinterpreted as some sort of resurrection.
Fact: most zombies live less than a year.

I mean, who would have thunk it? Think of all the things you can find out about our favorite pest species.

Similar Posts:

Posted in Zombies | No Comments »

Server Upgrades

Posted December 11th, 2007 by

“Paranoia” is the name of the server this blog is hosted on.  It’s a very “modest” box, probably a dinosaur at this point.   Some quick specs:

  • VA Linux (remember them?) 2240
  • 2 x PIII-650 processors
  • 1GB RAM
  • 3 x 18GB drives in a RAID-5

And yet, it does everything I want it to:  mail and web for a handful of domains.  =)

A couple of  months ago, paranoia hung on me.  A quick hardware reboot and it came back up, but I was short a processor.

So last night I swapped out processors, added a new UPS and apcupsd, and while I was physically in the same room, upgraded the kernel.

One last word of advice for older hardware and upgrades:  Check out stress, which is a program to put a load on your machine so you can test the processors, RAM, etc.

Similar Posts:

Posted in Technical, The Guerilla CISO | 2 Comments »

The End is Near–FISMA to cost $29B!

Posted December 11th, 2007 by

OK, so it’s about as sensationalist as government news gets (but still way sedate when compared to Brit-nay news), but check out this article on reauthorization of FISMA.
Let’s do some numbers:

  • Assuming a $64B IT budget for the federal government (budget request for FY 2007)
  • Assuming $29B for 4 years (OK, so we conveniently clipped that out of the headline)
  • That is $7.25B/year (29/4)
  • That is 8.83% of the total IT budget. (64/7.25)

Now before everybody shows up outside the Capitol with their torches and pitchforks because we’re spending $29B on FISMA (which doesn’t work, and SANS will attest to it), let’s think about that number.

The 9% of the total IT budget is about right on track (some say less, some say more) with large companies. The problem is, the CBO reports don’t tell us what exactly is behind the numbers. IE, $29B could be any combination of the following:

  • Direct FISMA costs such as quarterly reporting
  • Semi-direct FISMA costs such as C&A, contingency planning, and risk assessments
  • Direct security costs such as policy, procedures, firewalls and IDS
  • Indirect security costs such as processes taking longer because you have the security layer of abstraction

If it only includes the first point, then I’m shocked but it figures that the study would only include the direct costs. If it includes points 1, 2, and 3, then it’s inline with what I think the budget should be. If it includes all 4 points, then I think it’s a little bit on the light side for a number.

Thing is, the contractors are looking at $29B and thinking it’s a huge market. The FISMA critics will look at FISMA and say it’s horribly expensive.

It’s all different sides of the same coin: does anybody really know what FISMA means?

Similar Posts:

Posted in FISMA | 3 Comments »

« Previous Entries

Visitor Geolocationing Widget: