Skip to main content

The malwarewolf*

Search This Blog

InfoSec Policy flows

on March 31, 2020

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

A simplified flow diagram for typical, on-premise, non-DevSecOps, not shifted left, flow of policy from creation to implementation.

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

Post a Comment

Popular Posts

OSQuery, Splunk and PCI

A couple of years ago over at Facebook, OSQuery was open sourced. This tool allows you to make SQL-Lite queries against tables containing information about a running Linux or OSX host. One massive advantage of this is a wide range of system attributes can be queried using a universal syntax; just imagine building (and maintaining!) even a modest sized bank of queries using native Linux tools, as well as trying to get their collective outputs into a universal format. You can check out the tables available here: https://osquery.io/docs/tables/ and you'll notice the file_events table, which if you are faced with PCI requirement 11.5, you'll probably find your interest starting to get piqued... PCI 11.5: "Deploy file-integrity monitoring software to alert personnel to unauthorized modification of critical system files, configuration files, or content files, and configure the software to perform critical file comparisons at least weekly." Previously, this invo

On (film) photography

I've been into photography for many years. My first camera was an Olympus OM10, bought from a local second hand store, with the standard 50mm lens. From those humble beginnings, I embarked on a journey through the remarkable Olympus OM system, into my first job at a photo store which gave me a chance to use pretty much every camera, accessory, and film available at the time. I photographed family, friends, landscapes, objects, random people, taking up the reins of digital when it became feasible on my tiny salary... And that's kinda where things began going a little bit awry, allow me to explain from the perspective of where I am today: I recently pulled a couple of rolls of Tri-X from some of my film cameras, most had been in there at least 4 years, and developed them. The first roll was a bit of failure, my developer solution was too weak. The second and third rolls much better, if suffering a little from over-agitation. But what really struck me, was how thoroughly enj

VPN, vs a different implementation of VPN, vs secure web services... a question of trust?

Often, a VPN is seen a security panacea; a cure for all remote-access security ills. Let's assume we have to deliver a service with providing super secret information outside of the safety of our LAN. That's a need for a VPN... or is it? Here are my rambling thoughts on the subject, read them, enjoy them... I'm taking a devil's advocate view here somewhat, and this is not intended as a fully encompassing paper on the subject either. I expect I may have left gaps and you may have your own thoughts, feel free to add them. Lets get going and explore this idea a little, starting with the traditional... ...VPN delivered to the fully managed corporate laptop. This is the method often seen as the most secure; you manage the assets, their patching, their hardening. You have a record of the assets in your CMDB, you know what operating system they're running. The users are managed via your global directory. They connect using strong IPsec or TLS, authenticate using 2F

Powered by Blogger