All About Infosec

10 Scams to Screen from Your Email

Mentioned below are some of the most deadly Scams for which the people have been lured into in recent times.

Highest paying IT certifications for 2009

According to latest survey by ZDNET, the certifications below are highest paying tech certifications in technology industry.

ISO 27001

ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 - Information technology -- Security techniques -- Information security management systems -- Requirements but it is commonly known as "ISO 27001".
Risk assessment is the core competence of information security management. This book provides clear, practical and comprehensive guidance on developing a risk management methodology that meets the requirements of ISO27001, the information security management standard, and how to carry out a risk assessment that will help achieve corporate risk management objectives.

Here is a very good link for templates, study materials and many more things related to ISO 27001.

Follow the link : ISO 27001 Security

Google: The Art of Googling

Google is God. :). That is what i believe. At least of the information age. I read  Johnny Long's Google Hacking for Penetration Testers and became his instant fan. Is Google so comprehensive that one can write a book on it. Absolutely. And the book is a thriller. You cannot wait to finish it. This is an attempt to familiarize you with Google. However for details go to Google's website ang google it. :) Its Fun...
Just try these tricks and you will find a wonderful horizon and a lot of surprises just like the adjacent picture.


Lets begin then...



General Guidelines


Repetition Matters. Entering a particular search term multiple times will, at the very least, change the order of your results. In general, the term with multiple instances (and therefore more "weight") will be more represented in the search results.Word Order Matters. Put the most pertinent search terms first.
Case does NOT matter. Don't spend extra effort capitalizing; it's ignored by Google completely.
Make use of quotes when searching for phrases. To Google, there is a significant difference between using them and not -- especially when the phrase is not a very common one. You can also use an asterisk "*" as a wildcard wihin a quoted phrase search. This is great for remembering famous quotes and finding song lyrics.
"to be or not to *"
"a * for sore eyes*"
"* doesn't grow on *"
" * dictate our course of action"
Don't bother including words like "a", "to", "or", "are", "the", etc. in your searches. These words are too common to be used by Google in a standard query and they'll be disregarded if you enter them. Directly under the search box at the top of your results page you'll find information on any terms that were omitted.
If you want to make these common words a part of your search, put them inside of quotes when they are used in a phrase, or add a "+" sign in front of it if it's a standalone word.
"cat and the cradle"
music +is nice
You can use the tilda "~" character before terms to include results related to the terms synonyms as well as the term itself.
~stupid laws

Combining Search Items


You can search for one term or the other by joining the two terms with OR (capitals). You can also use the pipe character " | " as a replacement for OR.By default, Google uses the boolean AND operator on all non-quoted, multi-termed queries. In other words, if you enter "cat dog" (without the quotes) into Google, it'll return results that have both terms in them, not just one or the other.
cat OR dog cat | dog
Grouping special features is extremely powerful, and it's done with the parenthesis. Consider a search where you are trying to find out about ilnesses related to cats or dogs and pregnant women. You could get good results with just entering those terms haphazzardly, but you get incredible results with something like this:
"pregnant women" (sick | illness) (cats | dogs)
This query will find anything with "pregnant women", AND the word sick or illness, AND the word cats or dogs. That is utterly powerful. If you actually try that query you'll find that hot dogs are evidently
dangerous to pregnant women too. :) That can be trimmed nicely by appending the following to the search:
-"hot dogs"
That cleans it up nicely and gives us a set of results that are likely to give us precisely what we are looking for. Try applying this the next time you need to do some hardcore research; it's nothing short of godlike.

Special Prefixes


intitle: Google will return results only from the title portion of sites in its database.You can further tweak your searches by using the following prefixes. They can be combined with regular search terms to form queries that return eerily precise results.
intitle:org california
inurl: Google will return results only from the urls of sites in its database.
inurl:amazon
intext: Google will return results only from the body portion of sites in its database.
intext:sleeping disorders
inanchor: Google will return results only from the anchors within sites in its database. An anchor is text that gives information and/or identifies a hyperlink within a page.
inanchor:dog
site: Google will return information on the site or domain given.
site:slashdot.org
link: Google will return results that link to the site given.
link:wired.com
cache: Google will return its cached version of the site given.
cache:cnn.com

filetype: Google will return results that have certain extensions. You can use this to find powerpoints, word documents, or pdfs. It's utterly powerful.
filetype:ppt ipsec
related: Google will return sites that are related to the site you give it.
related:securiteam.com

info: Get all Google related information (cache, stocks, links, related, etc) about a given site.
info:google.com

Phonebook


phonebook: This is the generic lookup for a person or business, and it's a good starting point when searching for either. You can give just the last name and state abbreviation, the last name and first name with state, or you can add the city to it.One lesser-known feature of Google is its ability to find people and businesses. There are other ways to do this online, but as you are probably getting used to - they don't compare to Google. Not only does Google have uncanny abilities when it comes to finding people, but it'll also give you a link to a map of their city as well.

phonebook:jones, ca
phonebook:john smith, ca
Using "phonebook:" gives you both residential and business results. If you want to only search for one or the other, use "rphonebook:" or "bphonebook:".

Specialized Searches


Images - The single largest image archive in the world.Local - This new feature allows you to search for things in your local area. If your results have a location associated with them, Google will put them on a map and label them for you!
local.google.com
images.google.com
News - The news aggregator of doom. An absolute must for the avid news junkie.
news.google.com
Directory - A different way to search the web, the Directory version of Google focuses on categories of information.
directory.google.com
Catalogs - This feature allows you to peruse thousands of regularly updated catalogs as if they were right in front of you.
catalogs.google.com
Google Maps - This is what Yahoo Maps and MapQuest wish they were. Try it out next time you need to go somewhere; it's excellent.
maps.google.com
Froogle - Froogle lets you do price comparisons between millions of products in a blink of an eye. This is a must-use tool for die-hard Internet shoppers.
froogle.google.com


Subject Focussed


GovernmentGoogle also has specific sites set up for pre-focused results pertaining to the following areas:
google.com/unclesam
Linux
google.com/linux
Mac
google.com/mac
BSD
google.com/bsd
Microsoft
google.com/microsoft


Languages

It'll come as no suprise that you can search Google using dozens of languages, but what few people know is that they have a few languages that you probably wouldn't expect.. :)
Here is the amazon link for Johnny long's book: http://www.amazon.com/Google-Hacking-Penetration-Testers-1/dp/1931836361

Just google the book title and see the beauty. It spares Nobody.

Keep Googling.

Microsoft Security Essentials

Microsoft Security Essentials (MSE) (previously codenamed Morro) is an antivirus software created by Microsoft that provides protection against viruses, spyware, rootkits, and trojans for Windows XP (x86), Windows Vista (x86 and x64), and Windows 7 (both x86 and x64), free of charge. MSE replaces Windows Live OneCare, a commercial subscription-based antivirus service and the free Windows Defender, which only protected users from adware and spyware. It is geared for consumer use, unlike Microsoft's upcoming enterprise-oriented product Microsoft Forefront.

Orkut Safety

People all around the world have been using social networking sites. However the very popularity of these have made it prone to attack from the "bad guys". Please Please Please do not click on those scripts!!!
Please have a look at the safety guidelines.  http://en.wikipedia.org/wiki/Orkut#Security_and_safety

10 Firefox extensions that enhance security

The Internet has become a dangerous place of Convergence. With sophisticated attacks being developed and launched everyday the life is not very easy for us.

Norton Safe Web

Some Information Security Certifications...

Mentioned below is an useful list of InfoSec certifications along with their respective url's.

   Brainbench Internet Security (BIS) Certification.This credential identifies individuals with a good working knowledge of Internet security practices, principles, and technologies. (Source: Brainbench) For more information, see www.brainbench.com/xml/bb/common/testcenter/taketest.xml?testId=110
    *

      Brainbench Network Security (BNS) Certification. This program identifies individuals with a good working knowledge of network security practices, principles, and technologies. (Source: Brainbench) For more information, see www.brainbench.com/xml/bb/common/testcenter/taketest.xml?testId=30
    *

      CCO—Certified Confidentiality Officer. This credential identifies individuals who possess management-level expertise in information security, individuals who can direct security implementations and deployments, and security professionals who perform such tasks. (Source: Business Espionage Controls Countermeasures Association [BECCA]) For more information, see www.BECCA-online.org
    *

      CCSA—Certification in Control Self-Assessment. This credential identifies individuals with knowledge of internal control and related security self-assessment procedures. (Source: Institute of Internal Auditors) For more information, see http://www.theiia.org/ecm/certification.cfm?doc_id=12
    *

      Certified Network Security Associate (CNSA). This program is an entry-level credential designed as a "stepping-stones to GIAC and CISSP" training and cert programs. It aims to certify general IT security knowledge and ability. This certification also serves as the first rung on a well-defined ladder of CCTI certifications. (Source: Colorado Computer Training Institute [CCTI]) For more information, see www.ccti.com/certifications/security/securityoverview.asp
    *

      Certified Network Security Expert (CNSE). This credential identifies competent, practicing security professionals with strong technical knowledge and specific industry experience. It's also the top rung in the CCTI security certification ladder. This path requires CNSP and CNSM, plus two elective exams, and written and hands-on lab exams. (Source: Colorado Computer Training Institute [CCTI]) For more information, see www.ccti.com/certifications/security/securityoverview.asp
    *

      Certified Network Security Manager (CNSM). This credential identifies individuals who manage security professionals, with an understanding of technical security fundamentals and related topics in security forensics, law, or incident response handling. This is the middle (management) rung in the CCTI security certification ladder. (Source: Colorado Computer Training Institute [CCTI]). For more information, see www.ccti.com/certifications/security/securityoverview.asp
    *

      Certified Network Security Professional (CNSP). This credential identifies individuals who have moved from security fundamentals to coverage of advanced, complex security topics and technologies. It is the middle (technical) rung in the CCTI security certification ladder. (Source: Colorado Computer Training Institute [CCTI]) For more information, see www.ccti.com/certifications/security/securityoverview.asp
    *

      CFE—Certified Fraud Examiner. This credential identifies individuals who are able to detect financial fraud and other security-related white-collar crimes. (Source: Association of Certified Fraud Examiners) For more information, see www.cfenet.com/
    *

      CIA—Certified Internal Auditor. This credential identifies individuals with working knowledge of professional financial auditing practices, including related security practices, procedures, and auditing techniques. (Source: Institute of Internal Auditors) For more information, see http://www.theiia.org/ecm/certification.cfm?doc_id=12
    *

      CISA—Certified Information Systems Auditor. This credential identifies individuals who can perform IS audits for control and security purposes. (Source: Information Systems Audit and Control Association) For more information, see www.isaca.org/cert1.htm
    *

      CISSP—Certified Information Systems Security Professional. This senior-level security certification identifies individuals with knowledge of network and system security principles, safeguards and practices. (Source: International Information Systems Security Certifications Consortium [a.k.a. (ICS)2, pronounced "ICS-squared"]) For more information, see www.isc2.org/
    *

      Certified Internet Webmaster–Security Professional Exam (CIW-SP). Passing this exam demonstrates a working knowledge of Web- and e-commerce–related security principles and practices. (Source: Prosoft Training, Inc.) For more information, see www.ciwcertified.com/exams/1d0470.asp
    *

      CPP—Certified Protection Professional. This credential identifies individuals with a thorough understanding of physical, human, and information security principles and practices. (Source: American Society for Industrial Security [ASIS]) For more information, see www.asisonline.org/cpp.html
    *

      GIAC—Global Information Assurance Certification. This credential identifies individuals who possess a thorough knowledge of and the ability to manage and protect important information systems and networks. (Source: The System Administration, Networking, and Security [SANS] Institute) For more information, see www.sans.org/giactc.htm
    *

      ICSA—ICSA Certified Security Associate. This credential, to be released in Q3, 2001, identifies individuals who possess basic familiarity with vendor-neutral system and network security principles, practices, and technologies. (Source: TruSecure Corporation) For more information, see www.trusecure.com/html/secsol/peoplecert01.shtml
    *

      ICSE—ICSA Certified Security Engineer. This credential, expected to be released in Q4, 2001, identifies individuals who possess a deep and serious knowledge of vendor-neutral system and network security principles, practices, and technologies. ICSA is a prerequisite. (Source: TruSecure Corporation) For more information, see www.trusecure.com/html/secsol/practitioner.shtml
    *

      ICSP—ICSA Certified Security Professional Trainer. Obtaining this senior-level certification enables qualified individuals to teach ICSA and ICSE classes. (Source: TruSecure Corporation) For more information, see www.trusecure.com/html/secsol/practitioner.shtml
    *

      SSCP—Systems Security Certified Professional Administrator. This is an entry-level certification that identifies individuals who can implement and maintain system and network security, but not necessarily someone who can be made responsible for designing and deploying security policies and procedures. (Source: [ICS]2]) For more information, see https://www.isc2.org/cgi-bin/request_studyguide.cgi
    *

      System and Network Security Certified Professional (SNSCP). This credential identifies individuals who can design and implement organizational security strategies and secure the network perimeter and component systems. (Source: Learning Tree International) For more information, see www.learningtree.com

Job Roles for Information Security Pros

There are various profiles available for Infosec Professionals, both in India and abroad.With the various incidents  the need for information security has increased exponentially over the past decade. SANS has compiled a list of roles and responsibilties for various infosec positions...