As things around us rapidly unfold in the cybersecurity realm, many “experts” are sprouting out of the woodwork. How do we distinguish between the real deal and the phonies? Some questions to ask every “CISO” – How do you ensure security policies, procedures, baselines, standards, and guidelines are written to address the information security needs…
QuickGuide: ISO/IEC 17789 Cloud Computing Reference Architecture (CCRA)
ISO/IEC describes cloud computing systems from four distinct viewpoints: User view: The system context, the parties, the roles, the sub-roles, and the cloud computing activities Functional view: The functions necessary for the support of cloud computing activities Implementation view: The functions necessary for the implementation of a cloud service within service parts and/or infrastructure parts Deployment…
Weapons of Mass Disruption
Moonlight Maze In 1996, in the infancy of the Internet, someone was rummaging through military, research, and university networks primarily in the United States, stealing sensitive information on a massive scale. Victims included the Pentagon, NASA, and the Department of Energy, to name a very limited few. The scale of the theft was literally monumental,…
Oracle Data Safe and Consumer Privacy Acts
New consumer data privacy laws are cropping up through out the US. Just like the European Union’s General Data Protection Regulation (GDPR), these Acts force the hand of many (but not all) organizations to protect consumers’ data privacy rights. Privacy Acts aim to safeguard consumer privacy and it doesn’t just mean names and addresses, but also…
Installing Kali Linux on OCI
What is Kali Linux? Kali Linux is a Debian-based Linux distribution aimed at advanced Penetration Testing and Security Auditing. Kali Linux contains several hundred tools which are geared towards various information security tasks, such as Penetration Testing, Security research, Computer Forensics and Reverse Engineering. Kali Linux is developed, funded and maintained by Offensive Security, a leading information security training company. Installing Kali…
Installing Debian on OCI
Download Debian – Go to https://cloud.debian.org/images/cloud/OpenStack/9.13.7-20201108/ Download debian-9.13.7-20201108-openstack-amd64.qcow2 Upload Debian to Oracle Cloud Infrastructure – Login to your OCI Console, for instance, https://console.us-ashburn-1.oraclecloud.com/ Go to Object Storage and pick or create a bucket Upload debian-9.13.7-20201108-openstack-amd64.qcow2 to the bucket Import Debian Custom Image – Login to your OCI Console, for instance, https://console.us-ashburn-1.oraclecloud.com/ Go to Compute -> Custom Images and click on Import Image Select Import from Object Storage…
QuickGuide: PCI Guidelines at a glance
PCI DSS (Payment Card Industry Data Security Standard) is an industry mandate. If your enterprise accepts credit card payments or handles payment card data, it must comply with PCI DSS. Here are the 12 key requirements set by PCI DSS – Install and maintain a firewall configuration to protect data Do not use vendor-supplied defaults…
PCI: Are you a merchant or a service provider or both?
I was recently asked by one of my clients going through a PCI compliance assessment, if they were a merchant or a service provider? Sounds like a simple question. So, let’s dig deeper. The PCI Security Standards Council (SSC) defines a merchant this way: For the purposes of the PCI DSS, a merchant is defined…
The Inevitability of Cloud
Cloud is here to stay. There are no two ways about it. The question to ask is whether or not you are ready for it. Here’s a quick primer on how to stay on top of your cloud game – Build your cloud skills – if you want to be in the fast lane on your…
Best Practices on OCI Part 3: Logging & Monitoring
Here are some key recommendations for configuring logging and monitoring on Oracle Cloud Infrastructure – Ensure audit log retention period is set to 365 days – Log retention controls how long activity logs should be retained. Studies have shown that The Mean Time to Detect(MTTD) a cyber breach is anywhere from 30 days in some sectors to up…