InfoSecMinds

For like-minded people

Archive for category Information Security

Classification and labeling – A double edged sword?

May 5

Posted by Vinod Puthuseeri in Information Security, Information Security Risk Assessment | No Comments

I use a public transport to commute between office and home. Recently, I had one gentleman sitting next to me reading a document. I just peeped into the document and all I could instantly read is the document name and it was labeled as “Confidential”.

Now why would somebody read a confidential document during his commute to office on a public transport? Did the classification serve any purpose..? I was getting curious about this and asked him “any urgent review going on…?” He said, “No, why”..? I said, I could see the document classified “Confidential”. He has his explanation as “It is just an old document, maybe sometime in 2006”. Well why the document not re-classified if it was old…?

Read the rest of this entry »

Tags: , , , ,

SSL – How it works

Mar 16

Posted by Vinod Puthuseeri in Information Security, Technical | 1 Comment

Trying to simplify and explain how SSL works. Hope I have not complicated it further.  

Let us consider that someone is trying to call me over the phone and he/she is going to talk to me for the first time. In this case, how does he/she understand that I am the person on the other side of the phone OR is he/she connecting to the right person? Not possible.  

Now if you are in a large organization and the organization maintains an updated directory which lists the contact person, his office location, extension number etc, this is one place for validation and you can be sure that you are reaching the person that you intended too.  

But still there is a chance that someone else might pick up the extension instead of the person you are looking for. Once you have reached the intended person, you will now require to be sure that your conversation is not heard or interpreted by a third party.

Read the rest of this entry »

Tags: , , , , , ,

Parkerian Hexad

Aug 16

Posted by Vinod Puthuseeri in CIA Triad, ISMS, ISO 27001:2005, Information Security, Information Security Risk Assessment, Information Security Risk Management, Risk Assessment | 2 Comments

The Parkerian hexad is a set of six elements of information security proposed by Donn B. Parker, renowned security consultant and writer. The term was coined by M. E. Kabay. The Parkerian hexad adds three additional attributes to the three classic security attributes of the CIA triad (confidentiality, integrity, availability).

The Parkerian Hexad attributes are the following:

  • Confidentiality
  • Possession or Control
  • Integrity
  • Authenticity
  • Availability
  • Utility

These attributes of information are atomic in that they are not broken down into further constituents; they are non-overlapping in that they refer to unique aspects of information. Any information security breach can be described as affecting one or more of these fundamental attributes of information.

I think I don’t require to provide the explanation of C-I-A here. Let’s look at the other attributes.

Read the rest of this entry »

Tags: ,

CISF Security at Infosys

Jul 31

Posted by Vinod Puthuseeri in Information Security, Information Security Management System, Information Security Risk Assessment, Information Security Risk Management, Physical Security, Risk Assessment | 2 Comments

In the recent news Infosys becomes the first private company to get CISF security. I have also been reading in yet another blog about a organization conducting mocks drills for terrorist’s attacks. It is quite interesting to see that organizations are now taking security as a prime concern. As mentioned in my previous blog about frisking of VIP’s at airports, the exception mentioned there is an age old rule that was implemented when terrorism was a not major concern.

Read the rest of this entry »

Tags: , , , ,

Security Breach – Who's responsible?

Jan 27

Posted by Vinod Puthuseeri in ISMS, ISO 27001:2005, Information Security, Information Security Risk Assessment, Risk Assessment | 2 Comments

The very first lesson taught to me in my computer classes where “A computer is as smart as you are” and this statement holds good even today. For the computer would do only that a person would want it to do. The only advantage a computer has over human is that of speed and storage capacity.

While looking at various aspects of data loss, the end reason always point to “PEOPLE”. The above statement holds good not only because there are data loss (which is now the high rated security risks), even if you look at any frauds that has happened in the recent past, everything has been manipulated by “HUMAN”. No matters what standards are adopted, what stringent rules are set in an organization, frauds still happen.

Read the rest of this entry »

Tags: , ,