How is that Assurance Evidence?

AU-6, AU-7 and AU-9 On the Cheap

SIEM or SEIM or Log Correlation tools are generally considered expensive. I won’t get into the particulars of what is or is not expensive for you or your customer. It also depends on system size and what your enterprise may or may not already have in place. So do check…

This is still a Thing

It’s been over 2 years since I’ve last vented about FISMA / FedRAMP. 

I am now committing to doing more posts. I’m thinking biweekly (one every other week). Not just venting and therapy, but actual process and analysis. Look for an example later this week.

Moving

I am intending to do more blogging. However, I am packing and moving with twins. The move is short, but a huge event nonetheless.

So that’s it.

More Annoyance

Back again.

Yesterday, I said that the recent survey about FISMA failure is horse shit. I stand by that claim and will now add more.

The only thing this report says is that their process is too focused on compliance and they wish they had more money…

Annoyed

I find myself being annoyed yet again by an article. It’s here if you want to read it.

The essence of it being that FISMA is a failure (still) and government doesn’t know how to secure a rowboat let alone the vast number of systems in existence. Also that

Not Quite Dead Yet

Things are still extremely busy with day jobs, side projects and foster kids. However, I will be at ShmooCon 2012! So hit me up on twitter if you want to have some beers.

See you there!

Just So You Know I’m Not Dead

Items I am working on:

• Review of 800–30, Rev 1;
• RedSpartan

So in the meantime, a guitar god: http://www.youtube.com/watch?v=hkz7wUg1L1o

Wim Remes for ISC(2) Board of Directors

I support Wim Remes for ISC(2) Board of Directors. I agree with his vision for the organization and his views on infosec in general. If you do too, follow the directions on his page to have him placed on the ballot for election.

Feds and Amazon Web Services

Hi. I’m Chris and I’m an AWS addict. Hi Chris

That’s right, I am using an EC2 as a development platform for RedSpartan as a code repository, wiki and issue tracker (in the form of a RedMine instance). I am also using a Windows instance to host the…