Week 3 State of my Experiences Address

This week we focused on the Threat Process Modeling Tools. I discovered that the benevolent overlords at Microsoft actually offer a tool for FREE! Imagine my surprise. Apologies if this comes of as cynical, it is meant to be. Looking into the functionality of this tool I discovered that there is a lot more to learn in regards to threat modeling.  During weeks 1 and 2 I struggled to grasp the gist of what was being asked of me for the assignments. Looking back at that assignment now, I kick myself after finally understanding what was needed to be turned in. I guess that is why they say hindsight is 20/20. Regardless, threat modeling is a process that is vital in the security development cycle. Proper threat modeling not only serves to put the best and most secure product out there but also saves the organization money in the long run. Threat modeling does so by helping engineers and programmers identify security flaws during development. It is this feature that serves to be a money-saver for companies. Imagine putting out a product that was not properly assessed just to turn around and spend more capital on patches and updates just to make sure that your customers are not hacked by malicious actors. It doesn't make sense right? Cheers!

Week 2 Credible Sources of Information

     The Internet holds vast amounts of information. Some of that information may not always be as accurate as we would hope it to. Inaccurate information serves to mislead the reader and make us doubt most other types of information as well. This leads to a self-perpetuating cycle of doubt which if the savvy security professional is unable to break away from can cause a form of security paralysis in where no action is taken for fear that it is the wrong action.     This week I will include sources of credible information in regarding cyber-threats, vulnerabilities, updates, and any and all security news.
     First we have https://ics-cert.us-cert.gov/content/cyber-threat-source-descriptions. This is the website for the National Cybersecurity and Communications Integration Center (NCCIC) whose mission is to reduce the risk of systemic cybersecurity and communications challenges in their role as the Nation’s flagship cyber defense, incident response, and operational integration center. The NCCIC offers a myriad of information regarding cyber threat sources such as national governments. terrorist organizations, industrial spies and organized crime groups, "hacktivists', hackers, and the Government Accountability Office (GAO) Threat Table.
     Next is CSO Online. CSO is a resource that serves enterprise security decision-makers and users with critical information needed to stay ahead of evolving threats and defend against criminal cyber attacks. Their incisive content addresses all security disciplines from risk management to network defense to fraud and data loss prevention, CSO offers unparalleled depth and insight to support key decisions and investments for IT security professionals.
     There are many more good resources out there, all of which should be sought out and examined.  Eventually you will come to discover that two sources may have conflicting information. In the event that this does happen I caution diligence. If you are securing government systems then I personally would go with the information from sources directly relating to the government, such as the NCCIC site. For private industry I would follow best practices from other like-enterprises ensuring that any and all security implementations I perform are within industry standards.  Cheers!

Wk1 Greetings and salutations

Week 1

Welcome everyone. I hope that we have an opportunity  to collaborate together this term and learn as much as we can. A little bit about myself first though. I'm a 41 year old retired Navy vet of 20 years. While I was on active duty I managed to grind out a Bachelor's Degree in Information Systems Security in-between deployments, being a husband, and father.  I thought at that point I would have been done with school but wait there's more!

Fast-forward to present day.  I find myself gainfully employed as a government contractor at Edwards AFB in California.  I work on the F-35 as a data analyst which essentially is a glorified way of saying I download data into a form that they guys with the 50# brains can read. It's not hard work and it's 180 degrees from what i did in the military (which was survival equipment maintenance). Needless to say, there was a bit of a learning curve which was easily climbed thanks to work ethic and a littl bit of grey matter.

Starting next year I will be moving into an ISSO position with the Air Force. I'd be lying if I said I wasn't a bit apprehensive about it. This position will be so far out of my comfort zone but I welcome the challenge.  I know that as with my current position this new one will have a learning curve. It is my sincere hope that this degree and course will help me overcome that learning curve as quickly as possible.

Not only is the purpose of this blog to meet assignment requirements but to allow me to explore concepts and ideas that I would not normally explore on my own.  Not because of lack of interest but more of a lack of knowing of what to look for.  I will say this though, this program has opened my eyes to the true state of the internet.  I had always had an inkling that things were not all unicorns and rainbows and while things aren't a doom day scenario waiting to happen, there are a lot areas that the professional security expert and home user need to be aware of.  A goal of my blog is to shed light on these areas and highlight the cybersecurity trends which when properly implemented will foster a "safer" online experience.  Oh and I also hope to not bore my readers to deat ;).

Cheers!