Journal of Information Systems Security最新文献_第6页

Vulnerability Disclosure: The Strange Case of Bret McDanel 漏洞披露:Bret McDanel的奇怪案例

Journal of Information Systems Security Pub Date : 2007-01-01 DOI: 10.1080/10658980601144915

Edward H. Freeman

{"title":"Vulnerability Disclosure: The Strange Case of Bret McDanel","authors":"Edward H. Freeman","doi":"10.1080/10658980601144915","DOIUrl":"https://doi.org/10.1080/10658980601144915","url":null,"abstract":"Responsible developers work hard to produce secure, reliable, and efficient software packages. No company wants its integrity compromised by hackers, employees, or legitimate users. Negative publicity damages a firm’s reputation. Legal proceedings can cost an organization millions and destroy any chance of long-term success. Realistically, few products are released without security flaws. Programmers and system designers strive to find security bugs during the development cycle or at worse during beta testing, when bugs can be fixed easily. Careful testing will allow internal programmers to debug the software without publicity or industry notice. The outcome may differ if outsiders discover a security breach. Malicious hackers may exploit the breach to obtain classified information, to destroy the integrity of the information, or simply for the challenge. Even self-described “ethical hackers” may share this information with no discretion. Given the speed of the Internet, security breaches can be transmitted worldwide in hours. This article deals with vulnerability disclosure, where the details of a security breach are freely available. It also deals with the bizarre case of Bret McDanel, a young computer expert who spent 16 months in federal prison after he exposed a security breach in his former employer’s software package.","PeriodicalId":36738,"journal":{"name":"Journal of Information Systems Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2007-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"75233202","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 5

Implicit Trust Can Lead to Data Loss 隐式信任可能导致数据丢失

Journal of Information Systems Security Pub Date : 2007-01-01 DOI: 10.1080/10658980701260520

S. Fleming

引用次数: 7

Effective Change Management: Ensuring Alignment of IT and Business Functions 有效的变更管理:确保IT和业务功能的一致性

Journal of Information Systems Security Pub Date : 2007-01-01 DOI: 10.1080/10658980601144899

W. Yarberry

引用次数: 5

Do Information Security Professionals and Business Managers View Information Security Issues Differently? 信息安全专业人员和业务经理对信息安全问题的看法不同吗?

Journal of Information Systems Security Pub Date : 2007-01-01 DOI: 10.1080/10658980701260579

R. Rainer, T. Marshall, Kenneth J. Knapp, Gina H. Montgomery

{"title":"Do Information Security Professionals and Business Managers View Information Security Issues Differently?","authors":"R. Rainer, T. Marshall, Kenneth J. Knapp, Gina H. Montgomery","doi":"10.1080/10658980701260579","DOIUrl":"https://doi.org/10.1080/10658980701260579","url":null,"abstract":"Organizations today know that information technology is essential not only for daily operations but also for gaining strategic advantage in the marketplace. The importance of information technology means that information security has also become important. Breaches in information security can result in litigation, financial losses, damage to brands, loss of customer confidence, loss of business partner confidence, and can even cause the organization to go out of business. A recent study (Knapp, Marshall, Rainer, & Morrow 2006) surveyed 874 certified information system security professionals (CISSPs) to determine and rank the top 25 information security issues. Of the 18 highest-ranked issues, 10 were more managerial in nature rather than technical. Table 1 shows these ten issues with their ranks in parentheses. As we consider these ten issues as a whole, we see how critically important it is for information security professionals to have strong business, management, and organizational skills. As we look at each issue individually, we see a list of specific areas where information security professionals should have competence in order to effectively operate in an organizational context. The list of issues in Table 1 represents the issues with which information security professionals often have the most difficulty addressing. For example, three of these issues emphasize the need for excellent communication between information security professionals and business managers. The issues of “top management support,” “low funding and inadequate budgets,” and “justifying security expenditures” are closely related. The support of organizational executives is clearly needed to obtain the necessary funding for the information security function. To obtain this funding, information security professionals must present a coherent business case for information security needs. Information security professionals must also communicate with the entire user community to raise their awareness of information security issues through training and education, thereby promoting an organizational culture attuned to information security. Information security professionals must also work with business managers and the user community during the risk Address correspondence to R. Kelly Rainer, Jr., Ph.D., George Phillips Privett Professor of Management Information Systems at Auburn University, Auburn, Alabama. E-mail: rainerk@auburn.edu Do Information Security Professionals and Business Managers View Information Security Issues Differently?","PeriodicalId":36738,"journal":{"name":"Journal of Information Systems Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2007-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"78954859","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 35

Service of Process by Email 以电子邮件送达程序

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601051979

Edward H. Freeman

引用次数: 0

Honeynet Learning: Discovering Information Security 蜜网学习:发现信息安全

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601052019

M. Talabis

引用次数: 0

Year of the Rootkit Rootkit之年

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601051797

Ken Dunham

引用次数: 0

Maximizing the Return on Investment on Information Security Programs: Program Governance and Metrics 最大化信息安全项目的投资回报:项目治理和度量

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601051482

Cezar Drugescu, Rafael Etges

引用次数: 10

Risk Conductors 风险导体

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601051409

T. Macaulay

{"title":"Risk Conductors","authors":"T. Macaulay","doi":"10.1080/10658980601051409","DOIUrl":"https://doi.org/10.1080/10658980601051409","url":null,"abstract":"Abstract Akin to sound resonating through a piano wire, impacts from both physical (flood, vandalism/sabotage, explosions, pandemics, etc.) and logical (network/software/data) incidents resonate between and through enterprises and business hierarchies via “risk conductors.” There are two orders of risk conductor: Critical Infrastructure (CI) as the industrial risk conductors, and intra-organizational operational risk conductors in the form of Human Factors (HF) and Information and Communication Technology (ICT). Risk conductors, either industrial or operational, are the dispersal agents of geographically centered, physical, or logical impacts. Critical infrastructures may transmit an impact from one enterprise to another throughout an economy. Operational risk conductors—HF and ICT—transmit horizontally within an enterprise from one business unit to another, potentially amplifying internal incidents from manageable to crisis/disaster proportions. Operational risk conductors may also transmit vertically, away from the enterprise up to the client base and downwards into the supply chain, transmitting impacts to both customers and partners/suppliers. Operational risk conductors are not necessarily a new phenomena, but they have taken on considerably greater significance under the rapid convergence of information and communication assets to Internet Protocol (IP), which has catalyzed a feedback-loop between HF and ICT. As an incident typically possesses both HF and ICT impacts, HF and ICT in turn impact each other, multiplying the scope and scale of the impact. In addition to presenting a framework for understanding and managing operational risks and resiliency, this paper proposes a cause-and-effect relationship between IP convergence and the materialization of operational risk conductors.","PeriodicalId":36738,"journal":{"name":"Journal of Information Systems Security","volume":null,"pages":null},"PeriodicalIF":0.0,"publicationDate":"2006-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82497971","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 3

Seven Highly Successful Habits of Enterprise Email Managers: Ensuring that your employees' email usage is not putting your company at risk 企业电子邮件管理者的七个非常成功的习惯:确保你的员工使用电子邮件不会给你的公司带来风险

Journal of Information Systems Security Pub Date : 2006-12-01 DOI: 10.1080/10658980601051359

J. Vandermeer

引用次数: 8