The Growing Trend of Security Whitelists

My esteemed colleague here at 360is, Nick Hutton, has written a great article about security whitelisting.

In case you're not familiar with the phrase, security whitelisting takes the opposite (and some would say far more sensible) approach to security than we do today.

Go have a read of the article to get in the know.

Looking for some Sunshine

Here at 360is we're big fans of UNIX. Predominantly we use Sun Solaris, with some FreeBSD and Linux for specific tasks. Our desktop of choice is Mac OS X - founded on UNIX. We prefer UNIX over Microsoft's offering because of the flexibility and accountability of the systems. You can always get to the bottom of a problem.

There are plenty of other reasons too, but here's a good enough reason alone to be considering Sun - the mentality of their CEO, Jonathan Schwartz...

Free advice for the litigious

In a time when some vendors are intent on keeping their share of the market by peddling FUD (fear, uncertainty and doubt) Sun are going from strength to strength by doing what they do best, and going about it in a professional, congenial, way.

We share Schwartz's attitude - we don't like to sell security by using FUD either (the traditional way to make somebody invest in security - scare them!). Security is a vital part of any business, and building your infrastructure on UNIX is a really good start. We'll be publishing our Solaris 10 hardening guide soon, along with some information about our favourite open source tools for looking after your business.

Methods and tactics for avoiding failure in large SEM implementations

Most of the work we undertake is a mixture of penetration testing, audits, post-incident clean-up, and secure infrastructure deployment. However, over the last 12 months we have repeatedly been called upon to rescue failed or failing projects around the area of Security Event and Information Management (SEM/SIEM). We've collected all the knowledge gained in these "rescue projects" and have packaged it in a short whitepaper for download. For those of you that like to know what they have been given before it is unwrapped, here is the abstract:

"Many will be familiar with the English proverb “more haste, less speed”, or to put it another way, finishing a task quickly is not about rushing. This advice could have been tailor made for complex IT projects. In this paper we learn how to mitigate some of the risks and reduce the costs associated with implementation of Security Event Management systems, arguably among the most complex and highest profile information security projects undertaken today."

If you are considering one of these systems then we think you should spend 9 pages and 15 minutes in this vendor-free hype-free document.

Q2/06 Edition of "Executive Intelligence" Published

360is would like to announce a new edition of "Executive Intelligence" the digest for CIO, Chief Security Officer, and IT managers. It features news, world events, and conclusions intended to help security conscious executives prepare for the future. Managed Security Service Providers use this to add value and uniqueness to their existing infrastructure-based offerings. Easily re-branded, it can be tailored to a specific geography, vertical market sector, or class of reader. It is brief, meaningful, and instantly adds unique value to your services. 360 Executive Intelligence is available via our website in PDF or HTML format.

360is completes make over

Three Sixty Information Security today announced the completion of its web site re-design located at www.360is.com. The new site is optimised to be quicker and easier to use, while offering more detailed information on our individual services. As a supporter of Open Source software, 360is have ensured that the site is compatible with all major browsers.

About Three Sixty Information Security Ltd
Founded in February 2002, 360is is a first class independent provider of Information Security professional services and project management to the public and private sector. Their consultants are experts, having worked previously in senior security roles for the worlds largest and most successful ISP. 360is is trusted by top 5 Investment Banks, Telcos, Security vendors and ISVs.