Brian Zaugg Information Technology Consultant

Intrusion detection systems (IDS) seek to identify malicious network traffic. Intrusion prevention systems (IPS) advance IDS technology with the ability to dynamically adjust network and systems configurations to block malicious traffic as it is detected. As Gonzalez, Paxson, and Weaver (2007) state, “stateful, in-depth, inline traffic analysis for intrusion detection and prevention is growing increasingly more difficult as the data rates of modern networks rise.” In order to better understand the technical challenges and associated innovations associated with IDS and IPS, the author proposes to conduct a review of the literature on the subject of next-generation intrusion prevention systems.

Continue Reading

Secure information systems design theory is an area of information security that continues to need additional research. Models such as Siponen et al. provide a theoretical framework for SIS design that organizations and security practitioners can implement and utilize. However, further research and development is needed to continue to meet modern threats.

Continue Reading

Many organizations are implementing biometric access controls to help ensure security policies are effective. By incorporating a biometric into authentication and identity verification procedures, an extra measure of precaution is taken that improves the certainty that the person is who they say they are. Biometrics utilize physical, behavioral, a combination of both physical and behavioral characteristics to identify a person (Zorkadis and Donos, 2004). Of the many biometrics available for use, fingerprinting is one of the oldest and most widely used.

Continue Reading

When using company assets, employees generally do not have a reasonable expectation of privacy. As shown by the case of Smyth v. Pillsbury, even in cases where a private e-mail account interfaces with a monitored business e-mail system, the employee should not have an expectation of privacy.

Continue Reading

Aerospace and defense contractors that work with the US Department of Defense are required to comply with one or more regulations governing security and the handling of classified information. The National Industrial Security Program (NISP) provides compliance requirements for private industry handling classified information on behalf of the US government. Specifically, the NISP publishes the National Industrial Security Program Operating Manual (NISPOM). NISPOM Chapter 8 provides certification and accreditation requirements for facilities processing or handling classified information. Similarly, the Director of Central Intelligence Directive 6/3 (DCID 6/3) defines the certification and accreditation processes for information technology projects that require Top Secret (TS) or Secure Compartmentalized Information (SCI) clearances.

Continue Reading

As more and more of the world’s financial transactions occur online, criminals and criminal organizations will seek to leverage technology to commit their crimes. Unfortunately, just as computers and the Internet enable incredible productivity for legal pursuits, illegal pursuits are similarly amplified. Security of information and systems becomes an essential feature under these conditions.

Continue Reading

The modern organization must balance the information security risks against the costs to the business. The perfectly secure information system is neither affordable nor usable. When faced with scarce resources, in this case a fixed budget, the implementation of Ameri’s five pillars must be undertaken in a prioritized and phased approach that aligns with the cost constraints imposed by the business.

Continue Reading

Wireless networks are a key enabling technology for the modern information age. The proliferation of Wi-Fi hotspots, cellular data networks, and generally ubiquitous and pervasive networks, combined with mobile devices that support the global positioning system and the varied wireless standards, has led to an access anywhere paradigm that transforms the delivery of services. One of the transformative, emerging uses of wireless technologies is the mobile banking application. Mobile banking applications that utilize wireless networks provide a secure and convenient means for customers to access financial services.

Continue Reading

Peer-to-peer networks provide novel features compared to traditional networks. The One Laptop per Child project has leveraged P2P in the design and implementation of a mesh network that provides Internet connectivity to children in the poorest, most remote places of the Earth. By utilizing the P2P model, OLPC hopes to connect the world’s neediest children to the vast educational resources available on the Internet.

Continue Reading

Cloud computing, also known as grid or utility computing, is a disruptive technological model for delivering information technology services. By providing elastic, scalable, pay-as-you-go services, cloud computing providers enable organizations and individuals to develop and deploy information systems without the costs associated with traditional information technology. However, the utilization of cloud computing services introduces unique security risks. A literature review is performed to survey current research regarding cloud computing security threats and technologies that may mitigate the risks.

Continue Reading