The OSXCrypt.org TrueCrypt for OS X project is live and available as an alpha release - you can grab the first release on the site. Remember, this is an alpha, so treat it as a useful test, but it is a sign of good things to come.
Readers may recall that this is a community funded effort using Fundable.com, and that I had posted about this before in October and December.
Most Mac users don't worry about viruses - in fact, a lot of the time you'll hear statements like "Macs don't get viruses.". As the popularity of OS X grows, and as more and more people buy Macs, they are becoming more attractive targets, and they're working side by side with PCs. That means files are exchanged, email is received, and a whole host of entry vectors open up. Macs also see use as file servers, mail servers, and in other capacities where they might not be at risk, but the clients connecting to them may be.
Those risks mean that antivirus software for the Mac is getting more attention now than it was a year ago.
Last year saw OS X viruses starting to get attention - viruses such as OSX.Leap.A brought attention to the fact that Macs weren't invulnerable bastions of security. While we still haven't seen a major OS X worm, antivirus for the Mac is looking more attractive.
If you'd like to cover your bases, but don't want to invest in a commercial product, ClamXav may be a great option for you. It is based on the ClamAV open source antivirus package that most Linux users are used to, and it has a GUI that makes it more attractive to most OS X users.
A small dose of preparedness can help, and I'll be using AV on my Mac. Is that a belt and suspenders approach to security? Not for much longer, I believe.
On a recent trip to my SANS portal I noticed that the number of GIAC certified professionals had marched past the 20,000 mark. Congratulations to the folks at SANS and GIAC on this tremendous achievement. I can remember, just a few years ago, when I obtained the GCWN that it stood at slightly more than half that number.
So what makes for the doubling in size? Awesome training, and flourishing brand recognition. As with any program that strives to stay on top, the certifying body GIAC has also fortified their credential offerings by now boasting ISO/ANSI 17024 accreditation. Both of these achievements make for a bright outlook for these organizations.
Take the time to include SANS in your research for training opportunities in '08 whether it's for you or your staff. You are planning on training for '08 right?
Many higher education institutions will be preparing their lists of "chemicals of interest" for the Department of Homeland Security early next year. The rule stipulates that listings be delivered 60 days after the release of the final rule meaning lists will have to be provided by January 19th unless you request and receive a 60 day extension. Chemicals range from chlorine to aluminum chloride to propane, meaning that many departments on campus will likely have to report their totals.
If you haven't thought about what the chemicals on your campus could be used for, take a look. Each chemical lists what it would be potentially useful for, providing a convenient overview of what risks your campus might face.
The Chemical Facility Anti-Terrorism Standards require a variety of things, ranging from risk assessments to reporting of chemical amounts on hand . These apply to many higher education institutions, and responsibility for detailing may have fallen to risk management or facilities staff. If you're an information security staffer, you may want to check with the appropriate department at your school to see how that data is being stored and secured.
Where did all of this come from? It is part of the Department of Homeland Security Appropriations Act of 2007, which President Bush signed in October, 2006. Section 550 of the Act gave DHS the authority to enact the rules above. The Act defines the covered entities as "chemical facilities that, in the discretion of the Secretary, present high levels of security risk." More details can be found in the final rule here.
Frequent readers may recall me posting about a donation funded port of TrueCrypt for OS X. The group just published their first update.
It sounds like they're taking on a bit more than a simple TrueCrypt port, as the post notes that:
...we realized that this project will not be a simple port of truecrypt to Mac OS X, but this will provide a multiple enciphered disks support encryption platform for the Apple operating system.Right now the project has a simple XOR'ing kernel module, but progress is being made. I continue to hope that TrueCrypt support of OS X becomes a practical endeavor through this project.
Soft-R, maker of "Self Recordable Media Technology" is looking for OEM and industry customers for it's latest ware - the CD Cryptex. The CD Cryptex is a CD-R that aims to bridge the gap between users' knowledge of encryption software and the need for data on CD-R's to be encrypted. Soft-R claims that the device, loaded with it's own burning and encryption engine can be used without mastering complicated encryption software. Perfect since they are only supported on Windows 2000 and greater platforms.
On the technical side, AES256 in CBC mode is used to encrypt a container that houses all of the data files/folders sent to the disk via the on board burning engine. Keys are managed via pass phrases (limit 64 bytes) using SHA-256 hashes - which after the fact are needed to access, edit or view the files. Interestingly, Soft-R has included a virtual keyboard that one assumes is for use on machines that cannot be trusted. To aid in lingering copies of data, all temp files are wiped
I can't wait to play with one of these to see if they live up to the claims. Would you trust one of these with your data versus PGP encrypted files burned to a CD?
The group I work with has a simple rule that pays off in spades.
Any time a security recommendation is made, we check it against another team member. Thus, any decision follows our rule of two. The second person's job is to play the devil's advocate and to check for assumptions, mistakes, and to provide a second viewpoint on the recommendation.
Often we take into account the other team members' history and other specialties to best choose the person to look at our recommendation. That allows us to make sure we're not missing out on crucial tidbits of institutional knowledge or expertise.
The rule of two also gives us better depth - while a documented recommendation is made and archived, having two people who know about it on staff means that more people will actually remember the recommendation and know what it was and why it was made. With the shades of grey approach that security often has to take to make business work, that knowledge can be critical.
