我觉得COCO很好听，呵呵~~~
BOBO有BOBO头，COCO有很多啦，DODO有化妆粉。。。我打算再看看有没有EOEO,FOFO等等。。。
言归正传，首先名词解释：
COSO：Committee of Sponsoring Organizations of the Treadway Commission
COCO：CICA's Criteria of Control Board
COSO框架可能大家耳熟能详了，而COCO却比较生僻，所以还是多介绍下COCO吧。
COCO的目的也是控制，使得资源、系统、过程、文化、结构和任务等能够整合来支撑人们实现企业目标，它的控制框架更像个戴明环：
首先是purpose，然后是commitment，然后到capability，最后到monitring and learning，当结束后，可以建立新的purpose然后继续此环。有些像PDCA，但是含义不同。
1. Purpose：
指明组织方向，像目标、风险、机遇、策略和计划还有指示等；
2. Commitment：
即组织的道德价值、人力资源策略、授权、责任和义务等；
3. Capability:
告知组织能力，像知识、技能、工具、沟通过程等；
4. Monitoring and Learning:
包括复查内部和外部环境，监控执行目标、信息系统的重评估还有有效性控制的评估等等；
仔细看看，其实可以和COSO框架进行一定得结合。
比如，COSO框架的第一点就是环境，而环境因素在COCO中体现在第四步中。当然，像人力资源策略、组织方向等都属于COSO框架的控制环境点中。
可以认为二者是横纵交叉的。
刚刚接触COCO，未完待续......
2009年4月9日星期四
2009年3月6日星期五
ITIL v3 与 v2 的特征对比(转)
ITIL v3 是一个巩固和提高ITIL最佳实践的过程,引入了部分概念,尤其是"生命周期"的概念, V3相比 V2特征在以下5个方面的主要区别
1、 V2关注诸如服务台、事件、问题、变更、配置和风险管理流程，V3关注服务，因为流程是服务的附属物；
2、 V2关注的是业务与IT的结合，V3则强调业务与IT的整合
3、 V2关注的是价值链管理 ，V3 则强调价值网络
4、 V2关注的是线性的服务目录，V3则强调动态的服务投资组合
5、 V2关注的是流程一体化的集成，V3则强调全面服务管理的生命周期
总体而言，V3更有战略意义。
ITIL V2的完整知识体系，该体系包括以下9本核心读物：
2本IT服务管理核心读物：《服务支持》和《服务交付》。
5本运营指南：《ICT基础架构管理》、《安全管理》、《业务视角》、《应用管理》和《软件资产管理》。
1本实施指南：《服务管理实施规划》。
1本小规模IT组织指南：《小规模IT组织ITIL实施指南》。
2007 年5月30日，OGC在全球发布了ITIL最新版本---ITIL V3。该次更新起源于OGC在全球发起的一个名为“ITIL Refresh Project”的项目。新的ITIL知识体系包含了由《服务战略》、《服务设计》、《服务转移》、《服务运营》和《持续服务改进》5本核心出版物所构成的一个涵盖整个服务生命周期的完整的知识体系。
1、 V2关注诸如服务台、事件、问题、变更、配置和风险管理流程，V3关注服务，因为流程是服务的附属物；
2、 V2关注的是业务与IT的结合，V3则强调业务与IT的整合
3、 V2关注的是价值链管理 ，V3 则强调价值网络
4、 V2关注的是线性的服务目录，V3则强调动态的服务投资组合
5、 V2关注的是流程一体化的集成，V3则强调全面服务管理的生命周期
总体而言，V3更有战略意义。
ITIL V2的完整知识体系，该体系包括以下9本核心读物：
2本IT服务管理核心读物：《服务支持》和《服务交付》。
5本运营指南：《ICT基础架构管理》、《安全管理》、《业务视角》、《应用管理》和《软件资产管理》。
1本实施指南：《服务管理实施规划》。
1本小规模IT组织指南：《小规模IT组织ITIL实施指南》。
2007 年5月30日，OGC在全球发布了ITIL最新版本---ITIL V3。该次更新起源于OGC在全球发起的一个名为“ITIL Refresh Project”的项目。新的ITIL知识体系包含了由《服务战略》、《服务设计》、《服务转移》、《服务运营》和《持续服务改进》5本核心出版物所构成的一个涵盖整个服务生命周期的完整的知识体系。
2009年1月5日星期一
FISMA
这些日子学习了下FISMA。
记下来想到的吧。
FISMA的经典图如下，看了这个你就知道什么是FISMA了
FISMA的全称是The Federal Information Security Management Act，联邦信息安全管理法案。
FISMA把责任分配到各种各样的机构上来确保联邦政府的数据安全。法案需要程序员和每个机构的头目对信息安全计划执行年度评论，目的是为了以一种低开销，及时和有效的方式来把风险控制在可接受的范围之内。国家标准和技术研究所(NIST)强调了要遵循FISMA的九步：
记下来想到的吧。
FISMA的经典图如下，看了这个你就知道什么是FISMA了
“摘自Daniel Wood的文档”
FISMA的全称是The Federal Information Security Management Act，联邦信息安全管理法案。
FISMA把责任分配到各种各样的机构上来确保联邦政府的数据安全。法案需要程序员和每个机构的头目对信息安全计划执行年度评论，目的是为了以一种低开销，及时和有效的方式来把风险控制在可接受的范围之内。国家标准和技术研究所(NIST)强调了要遵循FISMA的九步：
- 把要保护的信息进行分类
- 选择最小的底线控制
- 使用风险评估过程来重新修改控制
- 在系统安全计划中用文档把怎样控制描述出来
- 在合适的信息系统实施安全控制
- 一旦安全控制付诸于实施，评估安全控制的有效性
- 决定任务和商业案例的风险等级
- 赋予信息系统处理的权力
- 在一个持续的基础上监视安全控制
以下是昨天翻译的FISMA讲解资料，贴出来。
FISMA使得一直忽视计算机安全的联邦政府开始关注计算机安全。在2005年2月，许多政府机构都在公务报告卡上收到了极低的评价，而2004年是67.3%，只比2003年高出2.3个百分点。这就显示了联邦机构在如何处置计算机安全的优先级中已经处于边缘增长，但是专家警告说这个平均水平必须增加以切实保护政府自身。
一个信息系统的FISMA遵从过程
FISMA使用强制过程系列，美国政府联邦机构或代表美国政府机构的合约商使用或运营的所有信息系统必须遵从这些过程。这些过程必须遵循Information Processing standards (FIPS)文档集合、NIST的SP-800系列和其他联邦信息系统立法相关的，如Privacy Act of 1974和HIPAA。
定义系统的边界
第一步是确定什么组成了“信息系统”。这不是直接将计算机映射到信息系统，而是说信息系统可以是单个计算机放入同一个目标的集合，并由同一个系统拥有着管理。NIST SP 800-18提供了确定系统边界的指导。
定义并分类系统中的信息类型
下一步是决定系统中存在的信息类型，并依据系统遭到C、I、A的破坏时，造成的损害将每个信息分类。NIST SP 800-60提供了信息类型的目录，FIPS-199提供了分类的方法论及三个标准的定义。全部FIPS-199系统的分类是所有信息类型的所有标准中影响分级的上限。
为系统选择并实施安全控制措施
如果问题系统处于设计或实施的生命周期阶段，必须选择并实施一系列安全控制。NIST SP 800-53提供了目录。
系统文档
系统相关信息，如系统边界、信息类型、组成部分、责任人、用户组织描述、与其他系统的交互及每个安全控制的实施细节都需要在系统安全计划中记录成文档。NIST SP 800-18 Rev 1提供了文档标准指引。附加文档，如系统的应急计划同样需要在此阶段准备。关于应急计划的指导可以在NIST SP 800-34中找到。
执行风险评估
一旦文档记录了控制执行，就需要执行风险评估。一个风险评估从从识别潜在风险和弱点开始，并将执行的控制映射到单个弱点中。再通过被攻击弱点的可能性和影响计算出风险，考虑存在的控制。风险评估的顶点显示所有弱点计算出的风险，并描述风险是被接受还是削减。如果削减，那么需要描述SP 800-53中添加的控制。NIST SP 800-30提供了风险评估过程的指导。
认证一个系统
一旦完成了系统文档和风险评估，那么需要对系统的控制进行功能性适当的评估并认证。对一个FIPS-199低分类的系统来说，认证只需要一个自评估。对分在FIPS-199中更高级别的系统来说，需要一个独立的第三方来执行认证。NIST SP 800-26提供了自评估过程的指引。NIST SP 800-53A提供了对单独控制的评估方法指引。
认可一个系统
一旦一个系统认证结束后，那么安全文档包就可以由官方认可，官方如果对文档和认证结果满意，就通过生成运行许可来认可该系统。这个认可过程一般经历三个阶段，而且可能随时执行添加控制或过程。NIST SP 800-37提供了认证和认可系统的指引。
持续监控
所有授权系统都需要监控选择的安全控制系列的功效，系统文档的更新以适应更改和对系统的修正。系统安全概要的重大更改都应触发新的风险评估，并且重大更改的安全控制也需要重新授权。对持续监控的指引可以在NIST SP800-37和SP 800-53A中找到。
FISMA还是一个让我很感兴趣的话题，继续关注中！
2008年12月29日星期一
CNCI plan for President
12 “discreet initiatives”, the first time I heard of it was on a meeting, Professor Zhaocheng Lv, and I look up for it the whole day. Oh yeah~~I got it!
Remark: DHS___department of homeland security (国土安全局)
Do not refer to 'Don Self', hiahia~~~
CNCI___Comprehensive National Cyber Initiative
write it down, may be others need it.
1. Move towards managing a single federal enterprise network.
The cornerstone to this effort is the TrustedInternet Connections program, initiated by the Office of Management and Budget in November 2007 that aimsto reduce the number of connections from federal agencies to external computer networks to 100 or fewer, frommore than 4,300 connections identified in January of this year. But it would also rely heavily on Federal DesktopCore Configuration standards, initiated by OMB, which prescribe specific requirements to access and use federalnetworks.
2. Deploy intrinsic detection systems.
These systems would build on current software tools—notably a programcalled Einstein, and an enhanced version called Einstein 2, developed by the Department of Homeland Security.These tools monitor and identify information streams at network access points, but currently lack the ability todo more than report potential problems.
3. Develop and deploy intrusion prevention tools.
DHS teams are now working on the development ofEinstein 3, which would be designed to block and mitigate malicious patterns in the code surroundinginformation in transit, before they can do harm on federal networks.
4. Review and potentially redirect research and funding.
Efforts are underway to take stock of cyberresearch and related programs and to look for overlaps and gaps, in order to channel resources more effectively.
5. Connect current government cyber operation centers.
In particular, increase the effectiveness thesecenters by standardizing operating procedures and improving shared awareness of threats.
6. Develop a government-wide cyber intelligence plan.
Because several civilian, intelligence and defenseDetails emerge about President’s Cyber Plan
have varying responsibilities to address cyber threats, the government has had a difficult time crafting asingle, coherent approach.
7. Increase the security of classified networks.
The escalating volume of attacks, and the increasingpenetration into supposedly secure networks makes it imperative that work be done to further security classifiednetworks and the information on them.
8. Expand cyber education.
There is a significant need for creating a career pipeline to train cyber securityexperts—with offensive as well as defensive skills--and to institutionalize the knowledge surrounding securitythreats. Cyber education needs to include developing a broader base of candidates with scientific knowledge anda cyber-savvy workforce, as well as network specialists who can work in law enforcement, military, homelandsecurity, health and other specialty areas.
9. Define enduring leap-ahead technologies.
The government needs to provide direction for “game-changing”technologies that would provide a more stable environment and supplant some of the fundamental design ofexisting technologies--and the current patchwork approach to fixing them.
10. Define enduring deterrent technologies and programs.
The government has an opportunity to tap broadergroups of scientists, strategists and policy makers – similar to the way it did a half-century ago in crafting anuclear weapons deterrent strategy—to develop new and lasting approaches to address cyber threats in thiscentury.
11. Develop multi-pronged approaches to supply chain risk management.
The reality of global supply chainspresents significant challenges in thwarting counterfeit--or maliciously designed—hardware and softwareproducts which must be addressed.
12. Define the role of cyber security in private sector domains.
Experts agree, the government must do moreto get its cyber security house in order. But with so much of the nation’s infrastructure in the hands of theprivate sector, more must be done to quantify the financial and economic risks associated with cyber securitythreats in order to provide better investment direction.
Remark: DHS___department of homeland security (国土安全局)
Do not refer to 'Don Self', hiahia~~~
CNCI___Comprehensive National Cyber Initiative
write it down, may be others need it.
1. Move towards managing a single federal enterprise network.
The cornerstone to this effort is the TrustedInternet Connections program, initiated by the Office of Management and Budget in November 2007 that aimsto reduce the number of connections from federal agencies to external computer networks to 100 or fewer, frommore than 4,300 connections identified in January of this year. But it would also rely heavily on Federal DesktopCore Configuration standards, initiated by OMB, which prescribe specific requirements to access and use federalnetworks.
2. Deploy intrinsic detection systems.
These systems would build on current software tools—notably a programcalled Einstein, and an enhanced version called Einstein 2, developed by the Department of Homeland Security.These tools monitor and identify information streams at network access points, but currently lack the ability todo more than report potential problems.
3. Develop and deploy intrusion prevention tools.
DHS teams are now working on the development ofEinstein 3, which would be designed to block and mitigate malicious patterns in the code surroundinginformation in transit, before they can do harm on federal networks.
4. Review and potentially redirect research and funding.
Efforts are underway to take stock of cyberresearch and related programs and to look for overlaps and gaps, in order to channel resources more effectively.
5. Connect current government cyber operation centers.
In particular, increase the effectiveness thesecenters by standardizing operating procedures and improving shared awareness of threats.
6. Develop a government-wide cyber intelligence plan.
Because several civilian, intelligence and defenseDetails emerge about President’s Cyber Plan
have varying responsibilities to address cyber threats, the government has had a difficult time crafting asingle, coherent approach.
7. Increase the security of classified networks.
The escalating volume of attacks, and the increasingpenetration into supposedly secure networks makes it imperative that work be done to further security classifiednetworks and the information on them.
8. Expand cyber education.
There is a significant need for creating a career pipeline to train cyber securityexperts—with offensive as well as defensive skills--and to institutionalize the knowledge surrounding securitythreats. Cyber education needs to include developing a broader base of candidates with scientific knowledge anda cyber-savvy workforce, as well as network specialists who can work in law enforcement, military, homelandsecurity, health and other specialty areas.
9. Define enduring leap-ahead technologies.
The government needs to provide direction for “game-changing”technologies that would provide a more stable environment and supplant some of the fundamental design ofexisting technologies--and the current patchwork approach to fixing them.
10. Define enduring deterrent technologies and programs.
The government has an opportunity to tap broadergroups of scientists, strategists and policy makers – similar to the way it did a half-century ago in crafting anuclear weapons deterrent strategy—to develop new and lasting approaches to address cyber threats in thiscentury.
11. Develop multi-pronged approaches to supply chain risk management.
The reality of global supply chainspresents significant challenges in thwarting counterfeit--or maliciously designed—hardware and softwareproducts which must be addressed.
12. Define the role of cyber security in private sector domains.
Experts agree, the government must do moreto get its cyber security house in order. But with so much of the nation’s infrastructure in the hands of theprivate sector, more must be done to quantify the financial and economic risks associated with cyber securitythreats in order to provide better investment direction.
订阅：
博文 (Atom)
