Updated CISSP Domains


The CISSP Domains (Effective April 15, 2015) will be changing:

  1. Security and Risk Management (Security, Risk, Compliance, Law, Regulations, Business Continuity)
  2. Asset Security (Protecting Security of Assets)
  3. Security Engineering (Engineering and Management of Security)
  4. Communications and Network Security (Designing and Protecting Network Security)
  5. Identity and Access Management (Controlling Access and Managing Identity)
  6. Security Assessment and Testing (Designing, Performing, and Analyzing Security Testing)
  7. Security Operations (Foundational Concepts, Investigations, Incident Management, Disaster Recovery)
  8. Software Development Security (Understanding, Applying, and Enforcing Software Security) 

Tracking News Related To TrueCrypt

Here are some links to stories about TrueCrypt shutting down:

TrueCrypt is a key tool in our toolkit for protecting data and we use it everyday.  If it is actually going to go away then it will leave a big whole in end-user security options for data encryption.


DEFCON 21 (and 20 oops!)

Defcon-21-badge+stuffDEFCON 21 was in Las Vegas, NV from August 02-04, 2013 and we were there.  Our real-time posts, references, and links are available over on @Technewsradio on Twitter.  

We have a detailed report (PDF) from the sessions attended if you are interested.  Just drop us an email to get the full report or a request via message on Twitter.  A podcast summary is planned but not promised at this time.

Things that we are "worried about" from an Enterprise computing perspective:

  • Social Engineering against users is like a hot knife cutting butter. Only defense seems to be training and awareness. Traditional information assurance (IA) protections: virus scanning, IDS, firewall, etc are not effective.
  • You can't secure what you don't manage.
  • Basic system administration tools and infrastructure services in the Microsoft Windows world can be used for evil: PowerShell, .NET, DNS, browsers, PKI, and SCOM.
  • USB is not your friend.
  • Mobile computing and Bring Your Own Device (BYOD) are really not your friend.
  • Cloud computing could be your friend but probably won't.
  • Developers writing code for an organization without a security focus is just asking for trouble.
  • If you think your stuff is secure just because you have it behind a lock and a key you are in denial.
  • In a year or less, penetration testing is going to include inexpensive mobile assault options via semi-autonomous very-small drones and robots.

P.S. x 1: We were also at DEFCON 20 and have that report available if you are interested. Just drop us an email or message on Twitter for a link.

P.S. x 2: There are also DEFCON 18 and DEFCON 19 reports.  They are surprisingly still relevant IMHO -- same bat channel.

This Week's Tech Podcasts Worth A Listen

Tech-podcasts-01 Here is a pointer to some recent technology related podcasts that might be of interest:

If you have a suggestion or a link to a good technology podcast to let others know about then drop us an email, message @technewsradio, or leave a comment below.

Twitter Updates - ePub, TurboCash, iPad, Windows, Box.net, Evernote, etc

The following is a summary of tweets posted to TechNewsRadio@Twitter over the last week:

  • OpenBook Specification for ePub (xhtml, css, etc) - some tools: Calibre & Adobe InDesign http://bit.ly/bGryk8
  • TurboCASH has released the 4301 Update (5/5/2010) - this is an interesting open source financial mgmt application http://bit.ly/cwBVEP
  • Just posted on my personal blog "An Apple iPad ~2 Month Later Review & Update" http://bit.ly/dAl3ml
  • MacWorld has good references on on ePub & iPad http://bit.ly/ckDgSy
  • Celina Jacobson has an interesting post examining "100 Excellent Lifehacks for Your Long Commute" http://bit.ly/bjsLuS
  • Mark Minasi's TechNewsletter#89 Secrets of Creating Default User in Windows 7, Cleaning Up Setup's Little Security Hole http://bit.ly/cQBbEV
  • Box.net is now beta testing drag-n-drop functions to the cloud using HTML5, Firefox 3.6, and Google Chrome
  • Possible Evernote User Group Meeting in San Diego being discussed http://bit.ly/ble1sk

Friends In Tech - Original Geek Christmas Story Released

AlbumArt-AGCS Members of FriendsInTech.com have created an "Original Geek Christmas Story" audio program for this holiday season:

“Mattie Stevens, a young boy of the early 80’s, dreams of owning a Commodore 64. He sets out to convince everyone this is the perfect gift. But, along the way runs into opposition from his parents and everyone around him including old Santa Claus.”

Listen! (Size 43.3 MBs, Running Time 31m23s)

Twitter Updates - InfoSec, Tech & Kids, Storage, Tips, Research

Over the last week the following were post to TechNewsRadio @ Twitter.com:

TECH NEWS RADIO PODCAST #331 | 070501 | Biggest Attendee Take Aways From Manager-Tools.com Effective Manager Conference

Today's podcast brings listeners some great audio interviews of attendees at the recent Manager-Tools Effective Manager Conference

The collective wisdom of this podcast is based on the answers to the question: "What is your biggest take away from attending this conference?"

You can also get my complete personal impressions of the conference via an interview I did with Douglas E. Welch on his Career Opportunities podcast.

This podcast is sponsored by: SCOTTEVEST (SeV) - makers of fine tech clothing. And thanks to Zimbra for sponsoring our recent attendance at eTech 2007 (podcast review).

 (Size 11.6 MBs, Running Time 25m14s)

Manager-Tools Conference Summary Live Show Annoucement

I'd like to announced that I am going to be joining fellow FriendsInTech.com member Douglas E. Welch, host of the excellent Career Opportunities podcast, for a Talkshoe Talkcast on Tuesday, April 24, 2007 at 9PM EDT/6 PM PDT.

The subject of the Talkcast will be a re-cap from my recent attendance at the Manager-Tools.com's Effective Manager Conference held last week in Washington, DC.