Archive, Volume 1: conference talks and papers on security and risk, 2010 to 2018. Zola 2013-06-18T00:00:00+00:00 https://blog.itys.net/vol1/tags/risk-management/atom.xml 2013-06-18T00:00:00+00:00 2013-06-18T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/cloudsecurity-isc2tc/ <h2 id="summary">Summary</h2> <p>The (ISC)2 Twin Cities Area Chapter presentation Cloud Security by Matthew J. Harmon at the 2013 Annual Meeting introduces the fundamentals of virtualization and cloud computing, emphasizing both their transformative potential and the security considerations they entail.</p> <h2 id="cloud-technology">Cloud Technology</h2> <p>First, Harmon unpacks virtualization basics like defining hypervisors (Type 1 and Type 2), guests, and core virtualization architecturesand maps these concepts onto cloud service models such as Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Anything-as-a-Service. He highlights key benefits including server consolidation, rapid provisioning and decommissioning of resources, auto-patching and silent upgrades, reduced operational overhead, and the ability to harvest processing power on demand. This framing positions cloud computing as a natural extension of traditional virtualization that delivers scale, flexibility, and cost efficiency.</p> <h2 id="security-and-privacy-risks">Security and Privacy Risks</h2> <p>Second, the presentation shifts to the security and privacy risks inherent in cloud environments. Harmon details confidentiality challenges in multi-tenant platformswhere co-located data often lacks provider-managed encryption and availability threats stemming from service outages, contractual lock-in, or disputes with providers. He also addresses integrity risks due to limited transparency into vendor operations and the potential for insider threats. To mitigate these issues, he advocates a trust but verify approach: enforce end-to-end encryption (in transit, processing, and at rest), conduct rigorous vendor audits, codify security requirements in contracts, and maintain continuous risk assessments to ensure that cloud-hosted assets remain under organizational control and resilient against data breaches.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56461_2013-06-18_CloudSecurity-ISC2TC.pdf">Cloud Security</a></p> 2012-03-16T00:00:00+00:00 2012-03-16T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/security-on-a-shoestring-budget/ <h2 id="summary">Summary</h2> <p>The Minnesota Council for Non Profits presentation Security on a Shoestring Budget by Matthew J. Harmon and Natascha E. Shawver delivers practical guidance for nonprofit organizations to improve their security posture without large investments. It frames security as a mission enabler rather than a cost center and stresses that common-sense controls can dramatically reduce risk.</p> <h2 id="security-concepts">Security Concepts</h2> <p>The presenters begin by defining core information-security concepts: impact, risk, threats, vulnerabilities, and controlsto build a shared vocabulary. They emphasize why nonprofits must care about security, listing potential losses (reputation, funding, productivity, legal liability) that imperil organizational missions. By demystifying terms and highlighting that security is more than just computer stuff, they prepare attendees to tackle specific, budget-friendly measures.</p> <h2 id="actions">Actions</h2> <p>The heart of the talk is a prioritized bare necessities checklist of seventeen actions tailored for resource-constrained environments. Starting with secure password management and asset inventories, it moves through network hardening (firewalls, patching, wireless security), malware defenses, automated backups, and principle-of-least-privilege user controls. It rounds out with training, policies, disaster-recovery planning, and vendor oversight. Each step is designed to be actionable with free or low-cost tools, enabling nonprofits to take incremental, sustainable strides toward resilience.</p> <h2 id="presentation">Presentation</h2> <p><a href="/attachments/56002_2012-03-16_Security_on_a_Shoestring_Budget-MNCNP.pdf">Security on a Shoestring Budget</a></p> 2010-04-01T00:00:00+00:00 2010-04-01T00:00:00+00:00 Unknown https://blog.itys.net/vol1/posts/iso-focus-plus/ <p>The attached article examines the explosive adoption of radio-frequency identification (RFID) technology across industries and the emerging security concerns that threaten its continued growth. As organizationsfrom the U.S. Department of Defense to livestock ranchers and healthcare providersincreasingly rely on RFID for tracking assets, the industry must confront vulnerabilities that could undermine both privacy and trust in this pervasive technology.</p> <h2 id="attacks">Attacks</h2> <p>In the face of demonstrated attackssuch as drive-by cloning of passport tagsRFID systems are exposed to a spectrum of threats at multiple points: the tag itself, the reader (interrogator), and the air interface. Common attack vectors include mimicking (spoofing, cloning, malicious code), information gathering (skimming, eavesdropping, data tampering), and denial-of-service tactics (reader jamming, tag blocking or killing). Each of these can compromise confidentiality, integrity, or availability, potentially disrupting business operations and eroding user confidence.</p> <h3 id="defense">Defense</h3> <p>To address these challenges, international standards bodies have moved to embed security into RFID deployments. ISO/IEC TR 24729-4 lays out guidelines for tag data securitycovering encryption, authentication, and secure data transmissionwhile balancing cost, storage constraints, and read-performance requirements. The report recommends leveraging a suite of countermeasures (e.g., unique tag identifiers per ISO 15963, password protection, and cryptographic controls) and employs the OWASP DREAD model to assess and prioritize risks. Ongoing work by ISO/IEC SC 31s WG 7 seeks to harmonize these efforts into a coherent framework that ensures interoperability, efficiency, and privacy as RFID becomes ever more ubiquitous.</p> <h3 id="presentation">Presentation</h3> <p><a href="/attachments/55287_2010-04-01_Plugging_Security_Gaps-ISOFP.pdf">ISO Focus+ April 2010</a></p>