These resources are a collection of links that point to web sites, documents, and other information that you may find helpful in developing information security policies and managing your organization's information security program. Security information can come from a variety of places. These links point to many different types of sources that include many commercial, non-profit, government, and "underground" resources. Use them to understand their unique perspectives on information security.

Incident Response Teams
The groups listed here provide information about security problems as they become known. In addition to reporting incidents, these groups work with various vendors and user organizations to keep them aware when problems occur. When fixes are available, each individual team reports them. They have their own level of services, which may include archiving of security software (source) and past incident reports.

• Although there are others working on survivability research, the primary work is being initiated by the Software Engineering Institute, at Carnegie Mellon University. You can read about their research and details of their survivability program at http://www.cert.org/nav/index_purple.html.

• The Univeristy of Virginia Department of Computer Science also has performed a lot of resarch into survivability through its Center for Survivable Information Systems. Their web site (found at http://www.cs.virginia.edu/~survive/) gives the reader another insight into how surviviability fits into critical infrastructure protection.

• Security By Itself May Not Be Enough - An Overview of the Discipline of System Survivability, by John Price (May 10, 2001) clearly explains survivability and its role in information security clearly and in a manner that could be understood by a less-than technical manager. The article is published in the SANS Information Security Reading Room and can be found at http://www.sans.org/infosecFAQ/securitybasics/not_enough.htm.

• In the United States, Export controls on commercial encryption products are administered by the US Department of Commerce, Bureau of Export Administration, Office of Strategic Trade and Foreign Policy Controls, Information Technology Controls Division. Rules governing exports of encryption are found in the Export Administration Regulations (EAR), 15 C.F.R. Parts 730-774. More information can be found at http://www.bxa.doc.gov/Encryption/Default.htm.

• The Wassenaar Arrangement (WA) is an agreements amongst 33 countries to controlexports for general arms and dual-use goods and technologies. One of those technologies are cryptography products. The web site for this agreement provides the basic rules and regulations of agreeing nations and contact information. You can find more information at http://www.wassenaar.org.

• Other good sources of information can be found at:

• Internet Engineering Task Force relevant Request for Comments (RFC) are avaiable from the RFC Editor at http://www.rfceditor.org

• The SANS Institute Reading Room has a lot of individual articles that focus on several areas of Information Security Policy Development. The articles range from helpingthe reader defining policy to working through implementation and validation details. These documents can be found at http://www.sans.org/infosecFAQ/policy/policy_list.htm.

• AusCERT Site Security PolicyDevelopment, Rob McMillan, ftp://ftp.auscert.org.au/pub/auscert/papers/Site.Security.Policy.Development.txt

• A good example of a policy written for a university can be found at the University of California at Davis. Read their policy at http://security.ucdavis.edu/policies.

• National Institute of Standards and Technolgy (NIST) maintains the security standards used by civilian agencies. The Guide for Developing Security Plans for Information Technology Systems, Special Publication 800-18 (SP 800-18), provides guidance to U.S. government agencies for developing security plans. SP 800-18 helps agencies comply with the regulations set forth by the Office of Management and Budget (OMB) Circular A-130 (Management of Federal Information Resources) Appendix III (Security of Federal Automated Information Resources). Those working with the US government on information security should read these documents to understand the agency's regulatory requirements. A copy of these documents can be found at:

• Although the National Aeronautics and Space Administration (NASA) is not a civilian agency, there is a good example of a security plan for one of their projects. You can read the NASA Integrated Services Network (NISN) Project Security Plan (July 1998) at http://www.nisn.nasa.gov/Doc_Repos/secplan.html.

• Security policies and baseline standards are useless unless they are widely implemented. How you achieve this will determine the success of your policies. This site from Security Risk Associates (of the UK) has a number of articles that discusses these issues. You can find them at http://www.security.kirion.net/securitypolicy.

Scott's Home Page...