Simple defenses are sometimes the best

Evaluating the actual attacks in the wild can pinpoint a few simple security measures that can dramatically reduce the likelihood of a successful attack.

If companies had turned on a security measure known as data-execution protection in Windows systems, they would have been immune to 14 of the 19 attacks based on memory corruption vulnerabilities.
That's one of the data points that led security consultant Daniel Guido of iSec Partners to recommend that corporate defenders focus on the vulnerabilities exploited by current attacks, rather than attempting to give all vulnerabilities equal weight. In a presentation at last week's SOURCE Boston conference, Guido noted that there are some 8,000 vulnerabilities found every year, yet only 27 flaws were massively exploited by malicious software in 2009 and 2010.
That's because, similar to defenders, attackers like to be efficient and don't have unlimited time, Guido says.
"Attackers are better at certain things than they are at others -- they have capabilities that they exercise and they prefer certain tactics, they prefer certain techniques," he says. "If we can inform our defenses to focus on those capabilities, those tactics, and those techniques, then we can make much more effective defenses than just going from top to bottom and patching vulnerabilities from zero to 8,000 every year."
Guido analyzed the most popular exploit kits and malicious software and found that the attackers increasingly use exploitation techniques that first appeared in targeted attacks. Memory corruption vulnerabilities accounted for 19 of the vulnerabilities exploited by such kits, while 11 of the 15 exploit packs also targeted Java flaws.
The lesson, says Guido, is to focus on countermeasures that foil these attacks, rather than focus on compliance and patching every vulnerability. In fact, all the memory corruption vulnerabilities were in five targets: Microsoft's Internet Explorer, Mozilla's Firefox, Sun's Java, and Adobe's Flash and Acrobat Reader applications. Turning on data-execution protection (DEP) -- a technology that prevents attackers from writing code to memory and then executing it -- in those applications can prevent the majority of the flaws from being exploited.
Also see: Does patch management need patching?
"Everybody said you should apply DEP because it is a good thing to do, and that is not a great selling point," he says. "But now that we know what we are getting out of it. I can take this and sell it to my upper management."
Of course, DEP and other protections can be bypassed, but attackers focused on massive compromises are not attempting to circumvent the countermeasures, he says.
In the end, companies should use intelligence on attackers, whether through their own analysis of attack tools or through a security service provider, to determine their defensive focus, he says. The efforts should augment efforts to increase the overall security of the company and should be part of a defense-in-depth strategy, not a replacement, he says.
"I am not advocating just going to get a couple of vaccines and then stop washing your hands," Guido says. "You need to patch the vulnerabilities that are out there, but there are ways to go about it more effectively, to reorder your priorities, to look at different mitigations in the absence of patching, ... because there may be easier ways of dealing with things that are causing you pain."

Cloud security: The basics

The Cloud Security Alliance and others are working to define security requirements for SaaS, IaaS, and PaaS cloud computing models.

Cloud computing is one of the most-discussed topics among IT professionals today. And not too long into any conversation about the most highly touted cloud models—software as a service (SaaS), infrastructure as a service (IaaS) or platform as a service (PaaS)—the talk often turns to cloud security.
According to Milind Govekar, an analyst at Gartner, cloud has rocketed up the list from number 16 to number two in Gartner's annual CIO survey of key technology investments. "Like with anything new, the primary concern is security," he says. In fact, the vast majority of clients who inquire about cloud, he says, would rather create a virtualized data center on their own premises—what some call a private cloud—because they're uncomfortable with the security issues raised by cloud computing and the industry's ability to address them.

Read the companion article "Cloud security in the real world: 4 examples"

"We are in the early stages of a fascinating journey into a new computing model that, for all its purported advantages, from a security and risk point of view, is a difficult thing to deal with," agrees Jay Heiser, an analyst at Gartner. "The things that make it easy and appealing—like the immediate plug-and-play productivity—also make it impossible to conclusively assess your relative risks." Current certifications, such as SAS 70 and ISO 27001 and 27002, are not sufficient, he says, leading to frustration for both buyers and sellers.
For this reason, securing cloud computing environments will be a major focus of vendor efforts over the next year, says Jonathan Penn, an analyst at Forrester Research. In the short term, he sees users having to do a lot of the legwork, but over time, "cloud providers themselves will see the opportunity to differentiate themselves by integrating security," he says. Security vendors accustomed to selling directly to the enterprise will find that they need these cloud providers as a way to reach the market, Penn says, and as the market matures, customers will want this stuff baked into the services they're buying. "That will be quite a radical change and a disruption," he adds.
In the meantime, organizations such as the Cloud Security Alliance (CSA) are working to put some shape around the security issues and the ways to address them. The CSA recently released a summary of the strategic and tactical security pain points within a cloud environment, along with recommendations on how to address them. The organization divided the domains into two broad areas: governance and operations.
Domains grouped under governance include:

• governance and ERM
• legal and electronic discovery
• compliance and audit
• information lifecycle management
• portability and interoperability

Domains grouped under operations include:

• traditional security, business continuity and disaster recovery
• data center operations
• incident response, notification and remediation
• application security
• encryption and key management
• identity and access management
• virtualization

The CSA also summarized the top threats of cloud computing, along with the cloud models each threat most pertains to and guidance for remediation.
The categories of tools that can help address these threats include XML, SOA and application security; encryption tools for data in transit and at rest; smart key management; log management; identity and access management; virtual firewalls and other virtualization-management tools; data-loss prevention; and more. "You're translating the existing security architecture into the cloud, so there are a lot of different tools you'll need, some of which already exist and other cases where you need new technology," Reiser says.
For instance, malware scanning tools will need to look specifically for emerging malware that targets virtual platforms; identity management systems will need to authenticate not just users but also devices and applications; and security information management (SIM) systems will need to log billions of events and analytics.
Forrester also released a list of questions that enterprises should ask to secure their cloud implementation, covering the areas of security and privacy, compliance, and other legal and contractual issues.
Cloud layers
Experts also emphasize that the level of exposure and risk for the three cloud models are very different, and the way of addressing security also differs, depending on which layer you're engaging with. "The security requirements are really the same, but as you go from SaaS to PaaS and IaaS, the level of control you have over security changes," says Mike Kavis, founder of Kavis Technology Consulting and CTO at a startup company. "From a logical view, nothing has really changed, but how you physically do it changes dramatically."

SaaS.

As the CSA explains, with SaaS, the provider's applications run on a cloud infrastructure and are accessible through a Web browser. The consumer does not manage or control the network, servers, operating systems, storage or even individual application capabilities. For this reason, the SaaS model integrates the most functionality directly into the offering, with the least consumer extensibility, and "security responsibilities are almost entirely up to the vendor," Reiser says. "If the vendor doesn't encrypt data, it's not encrypted. If there isn't activity monitoring, you won't get any."

PaaS.

With PaaS, consumers create applications using programming languages and tools supported by the vendor and then deploy these onto the cloud infrastructure, the CSA explains. As with SaaS, the consumer does not manage or control the infrastructure—the network, servers, operating systems or storage—but does have control over the deployed applications and possibly the application-hosting environment configurations. There are fewer customer-ready or built-in security features with PaaS than with SaaS, the CSA says, and those that do exist are less complete, but there is more flexibility to layer on additional security. This means users need to pay attention to application security, as well as security issues surrounding the management APIs, such as authentication, authorization and auditing.

IaaS.

Here, consumers can provision processing, storage, networks and other fundamental computing resources, as well as deploy and run operating systems and applications, according to the CSA. While they don't manage or control the underlying cloud infrastructure, they do have control over operating systems, storage and deployed applications, and possibly limited control of select networking components, such as host firewalls, the CSA says. With IaaS, there are few integrated security capabilities beyond protecting the infrastructure itself, but there's enormous extensibility, according to the CSA. This means users need to manage and secure operating systems, applications and content, typically through an API.

Also see "How to avoid the stormier implications of the cloud"

"A lot of the perimeter security is handled by the vendor, but they're giving you access to virtual machines, so you still have to build the application and provide the infrastructure control," Kavis says.
With IaaS, virtualization management is a big concern, says Heiser, particularly when it comes to intrusion detection and the integrity of partitioning virtual machines. "You need to mediate separation and make sure they don't interact with each other," he says.
Chris Barber, CIO at Wescorp, says he is concerned about multitenancy and hypervisor vulnerabilities. "Since you have multiple users on a single physical box, there may be a security vulnerability that one user could somehow access another user's virtual machine," he says.

Five cloud security trends experts see for 2011

What do IT security practitioners expect to be major cloud security issues in 2011? Here are five things to watch for.

What do CSOs and other IT security experts expect to be top-of-mind cloud security issues in 2011? Here are five things to watch for in the coming year:
1. Smart phone data slinging . More users will be accessing large amounts of data on the devices of their choice, says Randy Barr, CSO at Qualys Inc. and member of the Cloud Security Alliance (CSA). "This comes with a lot of unaddressed security issues," Barr says. "We can expect new solutions to address mobile devices, but could see a large data breach to expose the issue of mobile security before we see a solution." Among the possible scenarios, Barr says, are insecure cloud-based backup and highly confidential data on mobile devices."There are some interesting inter-dependencies when using multiple cloud services on mobile devices, with possibly different security models and assumptions," he says. A hacked cloud provider could provide mass access to confidential mobile device data when mobile users are using cloud-based mobile device support, he says. In addition, loss or theft of mobile device could provide root-level access to cloud services and data. Mobile apps are often providing direct and automated access to cloud services and data, he says. If an admin-level person's mobile device is stolen, this could be a major threat to highly confidential data or even cloud services administered by such a person from an insecure mobile device.
2. Need for better access control and identity management."The cloud by nature is highly virtualized and highly federated, and you need an approach to establish control and manage identities across your cloud and other peoples' clouds," says Alan Boehme, senior vice president of IT strategy and architecture at financial services firm ING. "There are some third parties that have delivered products and services that will address these issues, but they might not be adequate for large enterprises that have a mix of legacy and cloud components."
3. Ongoing compliance concerns."I think that compliance, especially PCI, is likely to continue to be a security issue," says Andy Ellis, CSO at Akamai. "Organizations still often need to come to grips with completely different processes that they have for managing data and apps in the cloud. And I think we will hear more rumblings about healthcare data in the cloud."
4. Risk of multiple cloud tenants. Given that most cloud services make heavy use of virtualization technology, the risks associated with multiple organizations' data housed on a single physical hypervisor platform exist, and will continue to unless specific segmentation measures are enacted, says Dave Shackleford, director of security assessments and risk & compliance at Sword & Shield Enterprise Security, and a member of the faculty of research firm IANS. Although it is assumed that virtual machines and virtual network components are 'separated by default', flaws and potential weaknesses in hypervisor platforms have been documented that could cause segmentation issues.
The most well-documented flaw was the one noted last year by Kostya Korchinsky of Immunity, where he "broke out" of a VMware Virtual Machine and executed a program on the underlying hypervisor system with a proof-of-concept tool called CloudBurst, Shackleford says. And in 2008 Core Security found a directory flaw that could allow an attacker to access files on the hypervisor from the virtual machine, he says.

5. Emergence of cloud standards and certifications. Because security will be evaluated when choosing cloud services, standards and certifications will be extremely important to help customers gauge how secure their data will be kept, Barr says. Cloud users will continue to leverage their existing processes for evaluating the security postures of cloud providers, but will begin looking at some of the more popular organizations developing guidance and standards, he says.

Seven Deadly Sins of Social Networking Security

To users of LinkedIn, Facebook, Myspace, Twitter or other social networking sites: Are you guilty of one of these security mistakes?

Admit it: You are currently addicted to social networking. Your drug of choice might be Facebook or Twitter, or maybe Myspace or LinkedIn. Some of you are using all of the above, and using them hard, even IT security practitioners who know better.
While it's impossible to escape every social networking security threat out there, there are steps one can take to significantly reduce the risks. CSOonline recently checked in with dozens of IT security professionals (ironically, using more than one social networking platform to do so) to pinpoint seven typical mistakes people make, and how to avoid them.
Over-sharing company activities
This is a sin of pride, when someone gets excited about something their company is working on and simply must tell everyone about it. Maybe you work for a drug company that is on the verge of developing the cure for cancer. Maybe the company is developing a new car that runs on curbside trash -- in other words, something everyone will want. (See also: Intellectual Property Security: Don't Lose Your Head)
By sharing too much about your employer's intellectual property on social networks, you threaten to put it out of business by tipping off a competitor who could then find a way to duplicate the effort or find a way to spoil what they can't have by hiring a hacker to penetrate the network or by sneaking a spy into the building.
Then there are hackers controlling legions of botnets that could be programmed to scour a company's defenses and, upon finding a weakness, exploit it to access data on the intellectual property. With the data in hand, the hacker can then sell what they have to the highest bidder, which just might be your biggest competitor.
"Sharing this kind of information could lead to targeted attacks on specific technology-producing enterprises," says Souheil Mouhammad, a senior security expert at Altran Technologies.
This social networking security sin has sparked a debate in the industry about whether companies need to revise their employee computer use policies with more specific language on what is/isn't allowed in the social networking arena (see also: Debate: Does Social Networking Require User Policy Changes?).
To rein in the urge to share too much, it might be useful to repeat this saying, which has started to appear in the public domain: "Loose Tweets Sink Fleets."
Mixing personal with professional
This sin is closely related to the first, but extends beyond the mere disclosure of company data. This is the case where someone uses a social network for both business and pleasure, most commonly on Facebook, where one's friends include business associates, family members and friends.
The problem is that the language and images one shares with friends and family may be entirely inappropriate on the professional side. A prospective employer may choose to skip to the next candidate after seeing pictures of you drunk or showing off a little too much leg at someone's birthday party. In sharing such things, you also stand a good chance of making the company you represent look bad.
"In my view one of the major rules when engaging in social networking is to be aware that your words belong in the public domain," says Paul V. de Souza, chief security engineer at AT&T. "You may be quoted all over the Internet, so make sure to choose your words carefully. Be diplomatic and extremely professional."
In some cases, it's nearly impossible to separate business from the personal on a social networking site. Those who work for media companies, for example, are sometimes required to use all their social networking portals to proliferate content in an effort to boost page views which, in turn, attract potential advertisers. But wherever and whenever possible, security practitioners work to keep each locked in their respective boxes.
"You have to understand very clearly what the objective of your presence on any given social network is. If it is for work, keep it for work only. If it is for personal/fun use, keep it for personal use only," says Benjamin Fellows, a senior IT security and risk consultant at Ernst & Young. "I can't tell you how many times I have been invited to Facebook by a work colleague only to find things on their wall or profile that are definitely not politically correct or are downright offensive. I keep all my work friends in LinkedIn and my personal friends in Facebook. Even then, I am very careful what I say on either site. I guess you could also put this under the heading of know your audience."
Engaging in Tweet (or Facebook/LinkedIn/Myspace) rage
For the person who has just been laid off or had their professional integrity called into question online, the urge to fire back with a stream of vitriol can be irresistible. Call this a sin of wrath.
"You don't want to get into a flame war," says John Bruggeman, a Cincinnati-based IT director. "Be mindful of what you say and imagine you are at a party where everyone is listening, including your boss, spouse or future employer."
Scott Hayes, president and CEO of Database-Brothers Inc., agrees, saying, "Posting any content when angry is about as dangerous as sending flaming emails, if not more so. Think twice about clicking 'submit' because the world may be looking at your angry, immature rant for years."
Believing he/she who dies with the most connections wins
For some social networkers, it's all about accumulating as many connections as possible. Folks on LinkedIn are notorious for doing this, especially those in such LinkedIn groups as TopLinked and LION. This may seem harmless enough or, at the worst, just annoying. But when the name of the game is quantity over quality, it's easy to link or "friend" a scam artist, terrorist or identity thief.
"Always verify the person who wants to get in contact with you," says Ruud van den Bercken, a security specialist at XS4ALL Internet in the Netherlands. "Do you know him or her? If not, why is the person trying to connect with you? Check if the profile of the other person is secured. If you can't retrieve a list of that person's connections, you have to ask yourself" if you really want to go down that road.
As San Francisco-based network and security architect/engineer Jatinder Thukral puts it: "I'd rather have 50 relevant contacts than 500 unknowns."
Password sloth
Another common sin is one of laziness, in this case picking passwords for your social networks that you're least likely to forget. In many cases, that means using the same password for LinkedIn and Facebook that you're using for your online bank account or work machine. If someone with malicious intent figures out the password for one social network, that person can now go and access everything else.
"Using the same password on several sites is like trusting the weakest link in a chain to carry the same weight. Every site has vulnerabilities, plan for them to be exploited," says Daniel Philpott, information security engineer at OnPoint Consulting Inc.
Trigger finger (clicking everything, especially on Facebook)
Facebook in particular is notorious as a place where inboxes are stuffed with everything from drink requests to cause requests. For some social networkers, clicking on such requests is as natural as breathing. Unfortunately, the bad guys know this and will send you links that appear to be from legitimate friends. Open the link and you're inviting a piece of malware to infect your machine. Christophe Veltsos, president of Prudent Security, describes this as being "click-happy" and warns, "Don't click unless you're ready to deal with drive-by downloads and zero-day attacks."
Endangering yourself and others
All of the above tie into the seventh and perhaps most serious sin, which is that reckless social networking can literally put someone's life in danger. It could be a relative or co-worker. Or it could be yourself.
Security experts advise extreme caution when posting birthday information, too much detail on your spouse and children, etc. Otherwise, they could become the target of an identity thief or even a kidnapper.

Is it possible to erase your Digital Footprint ?

In a world where we share more information online than ever before, it might seem impossible to disappear completely. But Frank Ahearn can help. A professional skip tracer for many years, he tracked down 'missing' persons for clients who were searching for them for legal or financial reasons. His arsenal included use of public records, credit reports, utility bills, criminal background checks, tax information and other revealing documents.

But these days, Ahearn assists people who want to go the other way--those who want to disappear and erase evidence of their existence. In his book How to Disappear: Erase Your Digital Footprint, Leave False Trails, and Vanish without a Trace, Ahearn details some of the tricks he uses when helping clients "get off the grid," as he refers to it, and shares tips for those concerned about information and privacy in this digital-sharing era. And while he refuses to assist people looking to get lost for illegal purposes, he says they often do come looking for help and advice on strategically manipulating information in the wrong direction.
CSO: How did you first become interested in helping people disappear?
Frank Ahearn: Originally, I had a skiptracing company for over 20 years where l located people. Most of my clients were investigators, insurance companies and attorneys. So I've always been good at accessing information. Then, a couple of years back, I was in book store and there was this guy buying all these books about privacy, offshore banking and Costa Rica. He ended up getting in line in front of me and paying for it with a credit card. I thought: "That's kind of dumb. You're buying these books that are about discretion and you're using a credit card."
I saw him in the bookstore's café and started shooting the breeze with him. I told him I was a skip tracer and that I could find him with that credit card transaction he just had to purchase the books. I gave him a breakdown of how I would find him.
It turned out he was a corporate whistle blower and had some money he wanted to take off shore. He asked if I could help him disappear. That was kind of the genesis of the idea.
Who comes to you looking for help with disappearing?
Clients typically come from two kinds of scenarios: Money or violence. Violence is usually a victim of stalker or in a domestic situation with an abusive ex and not sure how to get away. Then there is the money end of it. People who have come into some money and want to leave the world behind.
Recently things have kind of changed. Clients come to me now saying they are concerned about their information. That has definitely become a more prominent issue.
How do you hide people who actually want to disappear? Do you change their identity?
You can't legally change an identity. Identities are kind of this myth. Where do you get one from? And how do you know where it's from and that it hasnt been given to fifty other people? Who knows if it's on the Megan's Law list or if it belongs to someone who owes the IRS $100,000?
When someone comes to me in violent situation is I ask "Where are you going to go and how are you going to earn money?" You can't be Joe the Bus Driver in Chicago and then be Joe the Bus Driver in Seattle. You can be traced through your driver's license. But sometimes you can open a corporation, depending on what you do, and work on a 1099.
So, what we do in a nutshell, is make you a virtual entity where you work for this corporation. You lease your apartment through this corporation, your electricity, your phone. Everything about you exists under the corporation. The address doesn't have to be in the same city you're in. The goal is to make you virtual and have you communicate virtually through this corporation.
Do any of your clients pose an ethical dilemma for you?
I have people contact me all the time and I can tell there is something shady going on. But I know how to screen my clients well. People who come to me and are sincere will say "I have this problem. How can I solve it?" Where as individuals who want to do something shady, such as wire money off shore, or who are facing law enforcement issues, always have an agenda. They'll say "I want to do this, and then I want to do that." There is a difference between that kind of person and the people who have a real problem and want help solving it.
Now that there is so much push to share information through social networking and other digital venues, does it make your job more difficult?
It's kind of a double edge sword. You have to remember just because its online doesn't mean it's correct. Just like you can use social networking to find information about people, I can use social networking information to create disinformation about my clients. It's all a matter of who is better at something.
Have you actually used the web and social networks as a tool to create a false profile?
What we use it for is to create confusion.
About a year back, a client of mine was in Africa and he was in a hotel bar. He struck up conversation with someone and that person ended up saying something that they shouldn't have known about my client. The client just went to his room, got his bags and left without even checking out.
We were able to find out that someone in that hotel had accessed a real estate web site like Trulia or Zillow and put his address in. It revealed his home was valued at $4 million or $5 million. The problem international travelers are facing now is you go somewhere where you assume no one really knows who you are. But in a hostile environment, someone can now look at your information and realize you're worth the trouble of a potential abduction.
So, we create bogus individuals around client names. One person could be a photographer, one person could be a chauffeur, or whatever. We develop about 15 to 20 web sites and create all these social media sites around you. Now if you are traveling somewhere and someone puts your name in, they are going to locate those 20 other people before they get to you, depending on how much information is known about you. And when you travel, you'll have information about your photography business in your hotel room. That way, if someone is going through your room, they will realize you are Joe Blow the Photographer instead of Joe Blow the CEO. That is how we are starting to use misinformation online.
As another example, I worked with a woman who, if you entered her name online, the only thing that was known about her was that her father was selling his company for $45 million. That was a big threat. We took her name and took similar slices of information about her and built all these characters, fake individuals around her. Thats becoming something more in demand with clients.
What kind of recommendations do you give to people who aren't necessarily wanting to disappear, but are concerned about their privacy?
Social networking has become a huge issue when it comes to privacy. You wouldn't put a billboard on the side of the road that says "Look! Here's my wife, here's my kids! Take a look at these pictures of my backyard barbeque!" But people do put that stuff on social networking sites. I can understand wanting to use social networking from a business point of view. But keep in mind every time you put something out there, you are creating this digital DNA.
Take Facebook, for example. Facebook will delete your information online (if you close your account), but anything you share is not deleted. And Facebook has in their terms of service that they keep the information in their system for an undetermined amount of time. That could be 500 years.
Do you know the 7 deadly sins of social networking?
I think that is one of the problems; people not realizing where this is going to bring us and that the information can be used against you. Companies now are searching people's social media. What are they like? Are there pictures of them drinking at tail-gating parties? Is there someone who has an outspoken web site that may impact a hiring decision? People dont even think that their bosses may search this stuff out. And if the wrong person gets hold of your information, they really can wreak havoc on you.
When you do something online, ask yourself "Can this affect me negatively in the future?" Think about if you really need pictures of your kids online. If you wouldn't show them to a stranger sitting next to you on a plane, why put them online for everyone to see?
Ask yourself: What is the definition your own privacy? With the internet, we dont have a choice; we have to be a part of it whether we like it or not. So we have to decide what is important to us in terms of privacy and start doing things about that. Whether it's to reduce what is out there about us, or just control some of the information.

10 tips for smarter, more efficient Internet searching

Takeaway: These days, everyone is expected to be up to speed on Internet search techniques. But there are still a few tricks that some users — and even savvy searchers — may not be aware of.

Did you hate memorizing seemingly insignificant facts for tests at school? No photographic memory? Good news! Life is now an open-book exam — assuming you have a computer, browser, and Internet access. If you know how to use a good search engine, you don’t have to stuff your mind with facts that are useful only when playing Jeopardy! and Trivial Pursuit.
Chances are, you aren’t the first person to run across the problem you are experiencing. Chances are also good that an answer is awaiting your discovery on the Internet — you just have to remove the irrelevant pages and the unhelpful/incorrect results to find that needle in the haystack.
Google has been fanatical about speed. There is little doubt that it has built an incredibly fast and thorough search engine. Unfortunately, the human element of the Internet search equation is often overlooked. These 10 tips are designed to improve that human element and better your Internet search skills. (Note: All examples below refer to the Google search engine.)
This article is also available as a PDF download.

1: Use unique, specific terms

It is simply amazing how many Web pages are returned when performing a search. You might guess that the terms blue dolphin are relatively specialized. A Google search of those terms returned 2,440,000 results! To reduce the number of pages returned, use unique terms that are specific to the subject you are researching.

2: Use the minus operator (-) to narrow the search

How many times have you searched for a term and had the search engine return something totally unexpected? Terms with multiple meanings can return a lot of unwanted results. The rarely used but powerful minus operator, equivalent to a Boolean NOT, can remove many unwanted results. For example, when searching for the insect caterpillar, references to the company Caterpillar, Inc. will also be returned. Use Caterpillar -Inc to exclude references to the company or Caterpillar -Inc -Cat to further refine the search.

3: Use quotation marks for exact phrases

I often remember parts of phrases I have seen on a Web page or part of a quotation I want to track down. Using quotation marks around a phrase will return only those exact words in that order. It’s one of the best ways to limit the pages returned. Example: “Be nice to nerds”.Of course, you must have the phrase exactly right — and if your memory is as good as mine, that can be problematic.

4: Don’t use common words and punctuation

Common terms like a and the are called stop words and are usually ignored. Punctuation is also typically ignored. But there are exceptions. Common words and punctuation marks should be used when searching for a specific phrase inside quotes. There are cases when common words like the are significant. For instance, Raven and The Raven return entirely different results.

5: Capitalization

Most search engines do not distinguish between uppercase and lowercase, even within quotation marks. The following are all equivalent:

• technology
• Technology
• TECHNOLOGY
• “technology”
• “Technology”

6: Drop the suffixes

It’s usually best to enter the base word so that you don’t exclude relevant pages. For example, bird and not birds, walk and not walked. One exception is if you are looking for sites that focus on the act of walking, enter the whole term walking.

7: Maximize AutoComplete

Ordering search terms from general to specific in the search box will display helpful results in a drop-down list and is the most efficient way to use AutoComplete. Selecting the appropriate item as it appears will save time typing. You have several choices for how the AutoComplete feature works: Use Google AutoComplete. The standard Google start page will display a drop-down list of suggestions supplied by the Google search engine. This option can be a handy way to discover similar, related searches. For example, typing in Tucson fast will not only bring up the suggestion Tucson fast food but also Tucson fast food coupons.
Use browser AutoComplete. Use this Google start page to disable the Google AutoComplete feature and display a list of your previous searches in a drop-down box. I find this particularly useful when I’ve made dozens of searches in the past for a particular item. The browser’s AutoComplete feature must be turned on for this option to work. Click one of these links for instructions detailing how to turn AutoComplete on or off in I.E. and Firefox.
Examples:

• Visual Basic statement case
• Visual Basic statement for
• Visual Basic call

8: Customize your searches

There are several other less well known ways to limit the number of results returned and reduce your search time:

• The plus operator (+): As mentioned above, stop words are typically ignored by the search engine. The plus operator tells the search engine to include those words in the result set. Example: tall +and short will return results that include the word and.
• The tide operator (~): Include a tilde in front of a word to return results that include synonyms. The tilde operator does not work well for all terms and sometimes not at all. A search for ~CSS includes the synonym style and returns fashion related style pages –not exactly what someone searching for CSS wants. Examples: ~HTML to get results for HTML with synonyms; ~HTML -HTML to get synonyms only for HTML.
• The wildcard operator (*): Google calls it the fill in the blank operator. For example, amusement * will return pages with amusement and any other term(s) the Google search engine deems relevant. You can’t use wildcards for parts of words. So for example, amusement p* is invalid.
• The OR operator (OR) or (|): Use this operator to return results with either of two terms. For example happy joy will return pages with both happy and joy, while happy | joy will return pages with either happy or joy.
• Numeric ranges: You can refine searches that use numeric terms by returning a specific range, but you must supply the unit of measurement. Examples: Windows XP 2003..2005, PC $700 $800.
• Site search: Many Web sites have their own site search feature, but you may find that Google site search will return more pages. When doing research, it’s best to go directly to the source, and site search is a great way to do that. Example: site:www.intel.com rapid storage technology.
• Related sites: For example, related:www.youtube.com can be used to find sites similar to YouTube.
• Change your preferences: Search preferences can be set globally by clicking on the gear icon in the upper-right corner and selecting Search Settings. I like to change the Number Of Results option to 100 to reduce total search time.
• Forums-only search: Under the Google logo on the left side of the search result page, click More | Discussions or go to Google Groups. Forums are great places to look for solutions to technical problems.
• Advanced searches: Click the Advanced Search button by the search box on the Google start or results page to refine your search by date, country, amount, language, or other criteria.
• Wonder Wheel: The Google Wonder Wheel can visually assist you as you refine your search from general to specific. Here’s how to use this tool:

1. Click on More Search Tools | Wonder Wheel in the lower-left section of the screen (Figure A) to load the Wonder Wheel page.
2. Click on dbms tutorial (Figure B).

Figure A

Figure B

As you can see in Figure C, Google now displays two wheels showing the DBMS and dbms tutorial Wonder Wheels, with the results for dbms tutorial on the right side of the page. You can continue drilling down the tree to further narrow your search. Click the Close button at the top of the results to remove the Wonder Wheel(s).

Figure C

9: Use browser history

Many times, I will be researching an item and scanning through dozens of pages when I suddenly remember something I had originally dismissed as being irrelevant. How do you quickly go back to that Web site? You can try to remember the exact words used for the search and then scan the results for the right site, but there is an easier way. If you can remember the general date and time of the search you can look through the browser history to find the Web page.

10: Set a time limit — then change tactics

Sometimes, you never can find what you are looking for. Start an internal clock, and when a certain amount of time has elapsed without results, stop beating your head against the wall. It’s time to try something else:

• Use a different search engine, like Yahoo!, Bing, Startpage, or Lycos.
• Ask a peer.
• Call support.
• Ask a question in the appropriate forum.
• Use search experts who can find the answer for you.

The bottom line

A tool is only as useful as the typing fingers wielding it. Remember that old acronym GIGO, garbage in, garbage out? Search engines will try to place the most relevant results at the top of the list, but if your search terms are too broad or ambiguous, the results will not be helpful. It is your responsibility to learn how to make your searches both fast and effective.
The Internet is the great equalizer for those who know how to use it efficiently. Anyone can now easily find facts using a search engine instead of dredging them from the gray matter dungeon — assuming they know a few basic tricks. Never underestimate the power of a skilled search expert.

5 Considerations When Evaluating ISRM Programs and Capabilities

The following are 5 key items to consider when evaluating information security and risk management (ISRM) programs and capabilities:

1. Does a defined and business-endorsed strategy exist? It is important to assess whether an organization has developed and implemented a formal strategy for the ISRM program, that associated capabilities exist, and that the strategy has been documented and approved within the organization. A comprehensive strategy will include, at minimum, the following key elements:
   • Comprehension and acknowledgement of current business conditions
   • Governance models that will be utilized
   • Alignment with the organizational risk profile and appetite
   • Budget considerations and sourcing plans
   • Metrics and measures
   • Communication and awareness plans
2. How effective are the methods and practices for threat, vulnerability and risk assessment? The methods and practices that are used as part of ISRM programs and capabilities to evaluate threats, vulnerabilities and risks should be consistent, repeatable and easily understood by their target audiences. These methods and practices should minimally include the following components:
   • Business process mapping
   • Asset inventory and classification
   • Threat and vulnerability analysis methodology
   • Risk assessment methodology
   • Intelligence gathering, processing and reporting capabilities
3. What is the approach to compliance? Compliance has quickly become an integrated part of any ISRM program or capability within an organization. There are numerous external regulatory, legal and industry standards and internal policies with which organizations need to be compliant to meet their compliance goals. Ideally, compliance should be considered a starting point and not an end point of ISRM capabilities. Unfortunately, many organizations have adopted an approach called “security by compliance,” which is not only a sign of immaturity, but also may make them vulnerable to a significant number of business-impacting threats and may expose them to a wide range of risks for which they may not properly account.
4. How are metrics and measures utilized? Metrics and measures are often used by organizations to evaluate the capabilities of their business units and functions. ISRM programs and capabilities have become more engrained within organizations as independent business functions and business units, instead of as elements within technology programs. The need for these programs and capabilities to demonstrate and monitor their business value to their constituencies, including the organizations that they serve, has become a critical consideration in organizations’ operating strategy. The metrics and measures associated with ISRM capabilities should demonstrate a focus on the value provided and the efficiency of their functional capabilities.
   
   Each key metric or measure (collections of multiple metrics and measures or are considered critical to the success of the organization) should also include thresholds with associated actions or activities. Metrics and measures without thresholds do not provide insights into the values they produce. Thresholds can be as simple as a notification or as complex as a trigger for a series of actions and activities that will be executed once met. The intended audiences that will be required to take an action or will be impacted by an action once the threshold is achieved should be able to easily understand the business need or justification for the action and understand the value provided to the organization.
5. Does the program use an operational or consultative approach? Information security and risk management programs can include operational components as part of their core capabilities or can operate in an advisory and consulting capacity to the organization. If operational components are included, there should be a clear definition of expectations of the operational responsibilities and how they differentiate from other operational capabilities within the organization. There also should be documented processes and procedures for sharing information related to operational effectiveness, requirements, intelligence and incident-response activities.
   
   If the approach is purely an advisory and consultative approach, the services that are provided to the organization should be clearly documented, as should the level of effort and interactions with the business that will be required for the services to be successful. Providing guidance and advice without operational responsibilities often allows an ISRM organization to be viewed positively from within the organization since it is limited in its ability to prevent the organization from implementing operational capabilities to which it may not agree.