Subscribe for NewsLetters
Email: *
 
First Name: *
 
Last Name:
 
Organization:
 
Position:
 
Country:
Enter Captcha:*
captcha
Icon_menu_down
Search_btn
Wk Audit Net 468x60 Ad 1
Workiva Auditors Playbook 468x60 1

AuditNet® Audit-library::Auditnet-information-security

Layer Seven Security -Layer Seven Security specialize in SAP security. The company serves customers across the globe to protect SAP systems against internal and external threats and comply with industry and statutory reporting requirements. We fuse technical expertise with business acumen to deliver unparalleled implementation, consulting & audit services targeted at managing risks in contemporary SAP systems.

NIST Security Guides

Guide to NIST Information Security Documents

Guide for Assessing the Security Controls in Federal Information Systems

Guidelines on Cell Phone Forensics  provides general principles and technical information to aid organizations in developing appropriate policies and procedures for preserving, acquiring, and examining digital evidence found on cell phones, and for reporting the results. Cell phones are an emerging but rapidly growing area of computer forensics. The publication also explains the relationship between key aspects of cell phone technology and the operation and use of available forensic tools.

Cell Phone Forensics Cell Phone Forensic Tools: An Overview and Analysis Update, provides an overview of current forensic software tools designed for the acquisition, examination, and reporting of data residing on cellular handheld devices. It is a follow-on publication to NISTIR 7250, which originally reported on the topic, and includes several additional tools. The publication reviews the capabilities and limitations of each tool in detail through a scenario-based methodology.

Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.3 describes XCCDF, which is a standardized XML format that can be used to hold structured collections of security configuration rules for a set of target systems. The XCCDF specification is designed to provide automated testing and scoring that can support FISMA compliance and other efforts. NIST IR 7275 specifies the data model and Extensible Markup Language (XML) representation for version 1.1.3 of XCCDF; the previous revision of NIST IR 7275 addressed version 1.1 of XCCDF

Draft SP 800-44 version 2, Guidelines on Securing Public Web Servers

Draft SP 800-46 version 2, User's Guide to Securing External Devices for Telework and Remote Access

Prioritizing IT Controls for Effective, Measurable Security

Information Security Handbook: A Guide for Managers , October 2006 from NIST - This Information Security Handbook provides a broad overview of information security program elements to assist managers in understanding how to establish and implement an information security program.

National Security Institute

N.I.S.T. Computer Security Institute

CSO Online - magazine for Chief Security Officers

Security Risk Management Guide from Microsoft

Articles on Security

From NII Consulting

MS Office Security SecurityFocus Infocus article, August 2006
This article discusses Microsoft Office's OLE Structured Storage and the nature of recent dropper programs and other exploit agents, in an effort to scrutinize the workings of some of the recent MS Office exploits. The second part of this article then collates some forensic investigation avenues through different MS Office features. Parts of the article sample different MS Office vulnerabilities to discuss their nature and the method of exploitation.

Dissecting NTFS Hidden Streams Forensic Focus article, July 2006
This article discusses Alternate Data Streams feature of the NTFS filesystem. It underlines the importance of this feature from a hacker's perspective and a forensic investigator's perspective.

Five Common Web Application Vulnerabilites SecurityFocus Infocus article, May 2006
This article looks at five common Web application attacks, primarily for PHP applications, and then presents a short case study of a vulnerable Website that was found using Google and was easily exploited.

Key Strategies for Implementing ISO 27001 The IIA's ITAudit article, February 2006
This article brings to light various strategies involved in implementing ISO 27001 - from identifying business objectives to preparing for the final audit.

Evading NIDS, revisited SecurityFocus Infocus article, December 2005
This article discusses IDS evasion techniques in addition to the frag3 preprocessor and fragment reassembly in a multihost environment.

SQL Server Security The IIA's ITAudit article, March 2005
This is the first part of a two-part article that discusses securing the SQL Server. It covers secured SQL Server installation from an IT Auditor's perspective.

Penetration Testing of IPSec VPNs SecurityFocus Infocus article, Feb 2005
This article discusses a methodology to assess the security posture of an organization's IPsec based VPN architecture. It discusses blackbox penetration testing of a VPN server, and then a full configuration and architecture review.

Metasploit Framework - 3 parts SecurityFocus Infocus article, 12th July 2004
This is a three part article that talks in-depth about the Metasploit Framework - installation, configuration, and development of custom exploits using the framework.

Common security vulnerabilities in e-commerce systems SecurityFocus Infocus article, 27th April 2004
This article discusses common attacks and vulnerabilities in e-commerce shopping cart systems, with reference to SecurityFocus vulnerability reports where relevant.

Auditing Oracle Security The IT Audit, Vol. 7, April 15, 2004
This article discusses various aspects of Oracle security that must be considered, including secured installation, initialization parameters, users and profiles, roles, object and system privileges, logging, listener security, etc.

Detection of SQL Injection and Cross-site Scripting Attacks SecurityFocus Infocus article, 18th March 2004
This article discusses techniques to detect SQL Injection and Cross Site Scripting (CSS) attacks against your web applications using regular expressions with the open-source IDS, Snort

Audit and Penetration testing links

Lotus Notes Security

Wireless Security