Tag: Compliances (1300)

Creating Customer Service

Everyone seems to agree customer service is critical but few practice what they preach.  The industry needs more than fancy rhetoric and catchy slogans to keep customers happy. What are needed is adequate service staffing, training, and supervision to make sure every effort is made to keep your customer’s satisfied.  If you fail to take… Continue reading Creating Customer Service

Keeping Operating Systems and Applications up to date

Develop and maintain a list of sources of information about security problems and software updates for your system and application software. The most common sources of current information include Web sites of vendors and computer- and network-security organizations. Lists and Web sites appear, disappear, and change frequently. You need to ensure that the sources you… Continue reading Keeping Operating Systems and Applications up to date

PC Preventive Maintenance Suggestions

Here’s a checklist of 27 things you can do to keep your users happy and online. 1) E-mail your computer users. Let your clients know in advance what will be happening on the preventive maintenance visit. Users get attached to their systems, and seeing something change can be upsetting to them. In the e-mail, ask them… Continue reading PC Preventive Maintenance Suggestions

Project Management Methodology Summary

The “Program Office” is a project management methodology that provides a process for managing projects. As organizations continues to grow, so does the need for new projects that will provide new and exciting services to the end –user. The Project Management Methodology will assist project team leads and team members in their ability to balance… Continue reading Project Management Methodology Summary

System Configuration Guidelines and Considerations

Hardware Inventory Complete evaluation of all existing hardware o   Configuration o   Date purchased o   Depreciated value o   Replacement cost o   Appropriateness of work Report by hardware item o   Present Cost o   Life expectancy o   New cost o   Depreciated value o   Repair costs o   Planned replacement date Software inventory o   Type of usage (are the right… Continue reading System Configuration Guidelines and Considerations

What is a DoS Attack

A specific directed attempt by individuals to cripple or deny access to technology resources. Most Dos attacks are directed to Internet online services. Techniques: Resource Exhaustion Attacks Flood the victim (server) with packets Bandwidth Consumption Attacks Overload packet processing capacity Saturate network bandwidth Result of the attack Network starvation Network connectivity Bandwidth consumption Consumption of… Continue reading What is a DoS Attack

Anatomy of a hack

1. Acquire target 2. Footprint the system 3. Gain entry to system 4. Escalate privileges 5. Exploit system resources 6. Leave backdoor for later 7. Clean up, get out, cover tracks Risk management · It’s not a matter of if a computer security breach will happen, it’s a matter of when, and how prepared will you be… · Risk = (Cost of Asset)… Continue reading Anatomy of a hack

Isn’t Traditional Anti-Virus Protection Enough

If your desktops and file servers are protected with quality anti-virus software, why bother applying an additional tier of protection at your Notes or Exchange servers, and at your Internet SMTP mail server? Isn’t traditional anti-virus protection enough? In the vast majority of cases, the answer to this question is a resounding “NO”. Notes and… Continue reading Isn’t Traditional Anti-Virus Protection Enough

Useful SQL Commands

SQL Commands Begin Statements that make up the block. Built In functions Most SQL data functions are supported within PL/SQL blocks. Code storage Blocks may be stored within an Oracle database as procedures, functions, packages (a group of blocks) and triggers. Composite Datatypes Records allow groups of fields to be defined and manipulated in PL/SQL… Continue reading Useful SQL Commands

SQL Design Considerations

In order to assist us in designing your database, please have your applications and dba review and answer the following questions. SQL: • Has SQL been explained/optimized? • Have ‘bind variables’ been used? ie select * from my.table where name = :b1; Bind variables are not actually substituted until the statement has been successfully parsed.… Continue reading SQL Design Considerations

Planning a Backup Strategy

Planning a Backup Strategy You should have a solid backup plan in place before any application is ever moved from a development/test environment into a production environment. In addition, just as you would never put an untested application into production, you should never go into production without testing your backup strategy. It is always a… Continue reading Planning a Backup Strategy

SQL Security Overview

SQL, maintains it own internal security umbrella including password encryption, password aging, minimum length restrictions on passwords and user account management resources. Integrated security relies on trusted connections, which are only available with both named pipes protocol and MS new RPC based multi-protocol net library. Because SQL Server supports many different network options simultaneously, clients… Continue reading SQL Security Overview

Hotel Room Security

Security in your own hotel room should be a top priority, whether you are traveling for business or pleasure. In an attempt to make your valuables more secure, many hotels are tightening security by installing small safes in every room and issuing coded insert cards instead of numbered keys to open room doors. The best… Continue reading Hotel Room Security

Websense Web Filtering Software Overview

How Websense Works Websense is based on pass-through filtering technology, the most accurate, reliable and scalable method of Internet filtering. Pass-through filtering requires all requests for Web pages to pass through an Internet control point such as a firewall, proxy server or caching device. Websense is integrated with these control points and checks each request… Continue reading Websense Web Filtering Software Overview

Database Security Assessment Overview

Oracle Security Assessment Checklist 1. Is the Oracle software owner account locked to prevent remote logins? 2. Are the Audit database user activities – logins and failures – logged? 3. Where is the Audit information stored? 4. Does the Oracle user own all of the files in $Oracle_root$/bin? 5. Are there any help and sample data installed (files and directories)?… Continue reading Database Security Assessment Overview

IT Auditing Standards Guidance

Guidelines provide guidance in applying IT Auditing Standards. The IT auditor should consider them in determining how to achieve Implementation of the standards, use professional judgment in their application and be prepared to justify any departure. The objective of the IS Auditing Guidelines is to provide further information on how to comply with the IT… Continue reading IT Auditing Standards Guidance

Email Retention Policy – Scope

Email A primary communication vehicle • An enterprise collaboration tool • A personal filing cabinet • An electronic record repository • A storage glutton • A legal and data management liability To start with most companies make when creating an email retention policy is not involving all areas of the company in the construction/review process. An email retention policy… Continue reading Email Retention Policy – Scope

IT Auditing Cobit Mapping

Linkage to COBIT COBIT Framework states, “It is management’s responsibility to safeguard all the assets of the enterprise. To discharge this responsibility as well as to achieve its expectations, management should establish an adequate system of internal control.” COBIT Management Guidelines provides a management-oriented framework for continuous and proactive control self assessment specifically focused on:… Continue reading IT Auditing Cobit Mapping

Sample Cisco Options Matrix

  Networking Devices Description Type Comments Firewall (Internal) Embedded into internal switch   Load Balancer (Internal) Cisco CSS 11500 With SSL Termination/Fiber GigE Load Balancer (Perimeter) Cisco CSS 11500 With SSL Termination/Fiber GigE Router (Border) Cisco 7600 Router Fiber GigE Interface Switch (BOso) Cisco 2900   Switch (Internal) Cisco Catalyst 6513   Switch (Perimeter) Cisco Catalyst… Continue reading Sample Cisco Options Matrix

Vendor Management Considerations

Critical Vendors Are they critical to your organization continued viability? Do they capture, house, process, store or dispose of member or organization s confidential information? Are there regulatory requirements? What is our dependence on the vendor? Would they be difficult to replace? Contract Owner Responsibilities Critical Vendor Reviews Performance and SLA Financial Status Internal Controls… Continue reading Vendor Management Considerations

Email Archiving Concepts

 (Author unknown) • Journaling email creates a real-time copy of all email flowing between the mail server and the secure email boundary, writing this copy to a journaling mailbox within the mail server • Archiving email empties the journaling mailbox at configurable intervals, moving the data to an archive container which may support configurable encryption and/or… Continue reading Email Archiving Concepts

Directx, Java and Activex runtime errors and diagnostics

52 Runtime Error This is a “bad file name or number” error in JavaScript. It means that the script cannot find a file it is looking for (web-page, course component) and is most likely a connectivity problem. Try to clear your temporary internet files which should resolve any further problems… If this does not then… Continue reading Directx, Java and Activex runtime errors and diagnostics

Email Spam and Attachments

What is Spam? Spam is unsolicited email. From the sender’s point-of-view, it’s a form of bulk mail, often to a list culled from subscribers to a discussion group or obtained by companies that specialize in creating email distribution lists. To the receiver, it usually seems like junk email. In general, it’s not considered good netiquette… Continue reading Email Spam and Attachments

The eMail Threat

Security Policy Item  Mail– SMTP (25/tcp) to all machines, which are not external mail relays, POP (109/tcp and 110/tcp), IMAP (143/tcp) Vulnerability  Mail vulnerabilities occupy two spots in the SANS Top Ten:  (sendmail) and (IMAP/POP), and the most common version, sendmail, has sent a constant stream of reports and exploits through services like Bugtraq over… Continue reading The eMail Threat

Sample eMail Disclaimers

Sample: Notice: The information contained in this email and in any attachments is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material.  If you have received this email in error, please notify us immediately by replying to the message and delete the email from your… Continue reading Sample eMail Disclaimers

Why do Software Development Projects fail?

For the same reason any other project fails wrong requirements, wrong expectations, wrong outcome. No time to re-use and learn from lessons learned. Worse case scenarios is your project plan just not detailed enough. Below is an example of failed project attempt. Sample software development project Initiation phase Project activities Project plan approved Manage communications… Continue reading Why do Software Development Projects fail?

How to Develop a Network Security Policy

An Overview of Internetworking Site Security Introduction This document is for business executives, and others, who want to know more about Internet and internetworking security, and what measures you can take to protect your site. Presented is a high-level overview of the issues, realities, and technologies available to protect your business from unwanted intrusions and… Continue reading How to Develop a Network Security Policy

Disaster Recovery Planning Checklist

1. Does your firm have the ability to recreate and service the product throughout its life cycle? a. If so, during a disaster would is the cycle to do this? b. Is the cycle short enough to not risk the potential market share loss? c. If not, how long is the cycle, and how much you could afford… Continue reading Disaster Recovery Planning Checklist