New CLAS Scheme

23 Friday Dec 2011

Posted by in Education & Certification

≈ Leave a Comment

Tags

, ,

The new CESG Listed Advisor Scheme (CLAS) scheme will be started in January 2012 and a pre-requisit will be the new CESG Certified Professional (CCP) accreditation in at least one IA role.

Below is an extract from an eMail from the CLAS Admin team at CESG:

Applications for membership of the old version of CLAS have now closed. To obtain membership of a forthcoming, new version of CLAS you must first obtain certification of competence in at least one IA role from one of the 3 Certification Bodies appointed by CESG:

- APMG; http://www.apmg-international.com/APMG-UK/Qualifications/CESGCertProfessionalQuals.aspx

- BCS, the Chartered Institute for IT, http://www.bcs.org/

- IISP; https://www.instisp.org

The three CBs are preparing their new certification arrangements before they fully open in early 2012.

The defined IA roles are Accreditor, Security Architect, Security & Information Risk Advisor, IA Auditor, Communications Security Officer and IT Security Officer.  Each role is defined at 3 levels of responsibility. Full details of the IA roles are at http://www.cesg.gov.uk/products_services/training/certification_for_ia_specialists.pdf.

To become a CLAS member you must subsequently apply for membership.  The application process is expected to open in early 2012.  You will need to:

- be a UK Citizen (dual nationality considered);

- be employed in the private sector;

- have a UK sponsoring company who will sign up to the CLAS Contract;

CLAS membership is only open to individuals, there is no corporate membership.

A membership fee for new CLAS has not been agreed as yet but as a guide, the annual membership fee for the old scheme was £1250 + VAT.

Please confirm that you wish your email address to be added to our CLAS distribution list. You will then be informed by email when the scheme is open for applications and the process for application.”

This may be subject to change.

CESG Certified Professional Scheme (HMG IA)

04 Sunday Dec 2011

Posted by in Education & Certification

≈ Leave a Comment

Tags

,

I’m still catching up on putting news up on the blog, so this is a few weeks later than planned..

For those of you, like myself, that work in the field of HMG IA, the Government has released a new certification scheme via CESG (GCHQ) that will assist with certifying your skills within defined roles that can enable you to show new employees or contracts that you have the right skills for the job.

From the IISP website, who are one of three bodies accredited by CESG to certify people:

As part of the Government’s investment in cyber security, the IISP consortium has been appointed by CESG to provide certification for UK Government Information Assurance (IA) professionals. The consortium has been awarded a licence to issue the CESG Certified Professional (CCP) Mark based on the IISP Skills Framework, as part of a certification scheme driven by CESG, the IA arm of GCHQ.

The certification process is designed to increase levels of professionalism in Information Assurance and uses the established IISP Skills Framework to define the competencies, knowledge and skills required for specialist IA roles. Developed through public and private sector collaboration by world-renowned academics and security experts, the Framework has been adopted by GCHQ as the basis for its CESG Certified Professional specification.

This builds on the IISP’s existing competency based membership programmes, so not only will an individual be certified, but their areas of specialism will be recognised, offering the individual and their customers’ greater confidence that an individual has the right skills and experience for a role. The consortium comprises the Institute of Information Security Professionals (IISP), the Council of Registered Ethical Security Testers (CREST), and Royal Holloway’s Information Security Group (RHUL), with the IISP certifying competency, CREST providing examination for the more technical roles and RHUL supporting with their experience in setting rigorous and consistent assessment processes.

Timings

This programme will be launch in “pilot” phase during the autumn of 2011, with a predetermined number of roles/individuals being certified. The full programme will launch in early 2012 and be open to all who wish to apply.

Certified Roles

This certification will develop further, and the initial roles identified are detailed below. All roles have 3 levels of certification, at practitioner level, at senior practitioner level and at lead level.

The roles are:

  • Accreditor
  • IA Auditor
  •  Communications Security Officer/Crypto Custodian
  • Information Security Officer
  • Security & Information Risk Advisor
  • Security Architect

News release: https://www.instisp.org/SSLPage.aspx?pid=457

Visit the IISP for more details: https://www.instisp.org/SSLPage.aspx?pid=456

HMG Security Policy Framework (SPF) v7 Released

01 Thursday Dec 2011

Posted by in HMG Policy

≈ Leave a Comment

HMG have released the next version of the SPF (ver 7) last week.

  • Basically SPF v7 has reduced MR’s down from 68 (officially 70, but two were unused) to 20.
  • The new 20 MR’s have expanded scope, so (almost all) the requirements from within SPF v6 are still covered.
  • There is a ‘mapping’ between v6 and v7 – this can be seen in the appendic of the SPF
  • From v6 – MR 30 (reporting security vetting controls) and MR 63 (use of CCTV in accordance with DPA) have been removed. These are covered under other policies/procedures.

Get your copy here

UK Cyber Security Strategy Released

01 Thursday Dec 2011

Posted by in HMG Policy

≈ Leave a Comment

Tags

On Friday 25th November, the eagerly awaited UK Cyber Security strategy was released by HMG.

In my opinion it is a good clear statement, but lacking the finer details on implementation. I guess we will see over the coming months how its picked up and taken forward. I think it needs further detailed discussion with the public and private sector key (technical) players to develop in to an implementation programme to cover various government departments through to industry. I dont think there is going to be a one fits all method… might be wrong though… its definitely a big step in the right direction!

Additionally its nice to see the push on qualified/certified IA specialists, and I believe the HMG IA certification programme starting 2012 will definitely help.

Interesting times ahead!

A couple of links to the release:

The UK Cyber Security Strategy can be downloaded from here

Malware & Cybercrime: Detection, Prevention and Impact

01 Thursday Dec 2011

Posted by in University

≈ Leave a Comment

Tags

,

As part of my university coursework I recently had to write a two page paper as part of our group project on Malware & Cybercrime, entitled ’Detection, Prevention and Impact’. In addition the paper had to be presented to the group. As a DL student I had to provide voice over on the presentation slides.

In the hope it might help others, I’ve attached the two documents (power point presentation and a PDF of my paper) to this post.

Paper: Malware and Cybercrime – Detection, Prevention and Impact of Malware

Presentation: Malware and Cybercrime – Detection, Prevention and Impact of Malware

Decision on IL3 Traffic Transiting the PSN

20 Thursday Oct 2011

Posted by in ComSec, PSN & GCN

≈ Leave a Comment

Tags

, , ,

Looks like the PSN (Public Services Network) body is having trouble defining the method to be used for IL3 (for confidentiality) data transiting the PSN.

The PSN is accredited to IL2 (for confidentiality), storage and processing of data up to and including a protective marking of PROTECT, but is capable of carrying traffic at higher confidentiality levels via encryption.

With the high number of inter-site interactions expected that would be working with IL3 data and the complexity of the method for managing discovery of these endpoints increases, an approach based on manual configuration becomes too costly, demanding automation. The only problem is at the moment there is no automated method available that CESG will approve.

The current proposal by CESG is to use a commercially implemented IPSec solution known as PRIME with certificate based key management. This approach however may require some degree of manual work and at scale also becomes a costly overhead. CESG are working with industry to review this overhead and move to an automated process.

It has been decided that until a cost effective automated discovery method is available, the interim solution will be to ensure the number of IL3 inter-active endpoints remains at a level acceptable for manual discovery.

The approved method is for PSN service providers to create a Transit layer which connects the security domains witha  static PRIME-compliant IPSec tunnel. At the moment, as long as the threat and risk mitigations are met from the pan-PSN and pan-government transition requirements, domain owners can utilise and appropriate solution including encryption such as TLS.

Link: http://www.cabinetoffice.gov.uk/sites/default/files/resources/il3decision.pdf

GPG Listing

01 Saturday Oct 2011

Posted by in HMG IA (General)

≈ Leave a Comment

The following is a list of the GPG’s available (or superseded).

  • No. 1   – Superseded with parts of IS4 *
  • No. 2   – Superseded with parts of IS4 *
  • No. 3   – Securing Bulk Data Transfers *
  • No. 4   – Remote Access to PROTECT Data *
  • No. 5   – Securing Data At Rest On Laptops *
  • No. 6   – Off-shoring: Managing the Security Risks
  • No. 7   – Protection from Malicious Code
  • No. 8   – Protecting External Connections to the Internet
  • No. 9   – Taking Account of the Aggregation of Information
  • No. 10 – Remote Working * 
  • No. 11 – KVM Switches
  • No. 12 – Use of Virtualisation for Data Separation: Managing the Security Risks
  • No. 13 – Protective Monitoring for HMG ICT Systems
  • No. 14 – UK Requirements for TEMPEST Countermeasures *
  • No. 15 – Auditing Compliance with HMG IAS No. 6
  • No. 16 – Taking Cryptographic Items overseas *
  • No. 17 – Client System Security
  • No. 18 – Forensic Readiness
  • No. 19 – Managing Accreditation – Governance, Structure & Culture
  • No. 20 – ICT Service Management – Security Considerations
  • No. 21 – Video Conferencing
  • No. 23 – Assessing the Threat of Technical Attack Against ICT Systems
  • No. 24 – Security Incident Management
  • No. 27 – Online Social Networking
  • No. 28 – Improving Information Assurance at the Enterprise Level
  • No. 29 – ICT Security Aspects of Collaborative Working
  • No. 35 – Protecting an Internal ICT Network

* denotes controlled material.

IA Standards

01 Saturday Oct 2011

Posted by in General Security

≈ Leave a Comment

Below are the list of HMG IA Standards.

  • HMG IA/IS 1 (pt 1)    Technical Risk Assessment
  • HMG IA/IS 1 (pt 2)    Technical Risk Assessment
  • HMG IA/IS 2              Risk Management and Accreditation of Information Systems
  • HMG IA/IS 3              Connecting Business Domains (No longer Current)
  • HMG IA/IS 4              Communications Security and Cryptography
  • HMG IA/IS 5              Secure Sanitisation of Protectively Marked Information
  • HMG IA/IS 6              Protecting Personal Data and Managing Information Risk

McAfee Launches Additional Certification Exams & Virtual Instructor Led Training Programs

07 Wednesday Sep 2011

Posted by in Education & Certification

≈ Leave a Comment

Tags

, ,

News article I’d like to share with other McAfee engineers on the release of the Host IPS (HIPS) product specialist certification and a new training program..

SANTA CLARA, Calif.–(BUSINESS WIRE)–McAfee today announced the global availability of two new certification exams in support of the McAfee Security Certification Program. These exams have been released under the McAfee Certified Product Specialist track which is designed to allow the users of McAfee technologies to demonstrate competency around the effective installation, configuration and administration of key McAfee products.

The two new exams focus on the McAfee Network Security Platform and McAfee Host Intrusion Prevention solution. Those who pass the exam and become certified demonstrate the highest levels of technical competency and productivity, helping to lower operating cost and improve levels of service and security. The McAfee Security Certification program is open to all McAfee product users, customers, and partners.

Along with the exam releases, McAfee is announcing the availability of a program logo. This logo can be used by certified individuals as a visual representation of having successfully achieved the McAfee Certified Product or Assessment Specialist benchmark on business cards, email signature lines, etc. The logo will be made available via the McAfee certification candidate system.

Lastly, McAfee is announcing the addition of virtual instructor-led training (VILT) classes to complement the current in-person, instructor-led training and certification preparation capabilities. VILT allows students to attend full training classes over the Internet. These live, instructor-led classes allow McAfee to reach geographically dispersed students while minimizing student and instructor travel time and related expenses.

“McAfee is very pleased to deliver these additional certifications and supporting program elements to the market place,” said Ray Komar, senior director of Global Education Services at McAfee. “Our customers, users and partners have responded extremely favorably to the McAfee certification program and these new additions are in direct response to requests from our community.”

Visit the McAfee University page to find complete instructions on how to register.

Combating FakeAlert

17 Friday Jun 2011

Posted by in General Security

≈ Leave a Comment

Tags

With the numeber of new FakeAlert variants have been reported recently McAfee have released a couple of documents detailing information about the characteristics, symptoms, prevention and mitigation of this threat.

PD23178 – Threat Advisory: Combating FakeAlerts
https://kc.mcafee.com/corporate/index?page=content&id=PD23178

PD23177 – Threat Advisory: FakeAlert System Defender
https://kc.mcafee.com/corporate/index?page=content&id=PD23177

Follow

Get every new post delivered to your Inbox.