Like my posts on IT governance standards, I produced this training material some time back when I was doing a lot of IT security work. I’ve since moved onto other IT disciplines, but I hope that this article is of some use to those looking for an introduction to WIFI security. I have divided the material into two parts. The first half is background and theory, and this post illustrates a practical example.

First up, let’s finish off a little theory to go with the first post.

Continue reading “WIFI Security: Background, Risks and Mitigation Part 2”

Like my posts on IT governance standards, I produced this training material some time back when I was doing a lot of IT security work. I’ve since moved onto other IT disciplines, but I hope that this article is of some use to those looking for an introduction to WIFI security. I have divided the material into two parts. The first half is background and theory, and the second half of a practical example.

I remember when writing it, my audience, although technically savvy did not a have a strong background in cryptography or security. So I tried to make it easy to read, rather than too technical. Not sure if I succeeded! 🙂

Continue reading “WIFI Security: Background, Risks and Mitigation Part 1”

The content of this blog is essentially material I compiled for training sessions that I ran last year. It was originally PowerPoint, but I hope that this blog version is useful. Some of the legislative stuff is probably now out of date, and it was for an Australian audience – moral of the story is to do your own research.

For part 1 of this presentation, view this post, part 2 this post and part 3 here.

ISO17799/27001

• Started life as BS7799-1 and 2
• BS7799-1 became ISO17799. BS7799-2 is recently ISO27001
• There is an Australian version "AS/NZS ISO/IEC 17799:2006"
• Internationally recognized standards for best practice to information security management
• High level and broad in scope
• Not a technical standard
• Not product or technology driven

ISO 17799 is a direct descendant of part of the British Standard Institute (BSI) Information Security Management standard BS 7799. The BSI (www.bsi-global.com) has long been proactive in the evolving arena of Information Security.

The BS 7799 standard consists of:

• Part 1: Information Technology-Code of practice for information security management
• Part 2: Information security management systems-Specification with guidance for use.

BS7799 was revised several times, and by 2000 information security had become headline news and a concern to computer users worldwide. Demand grew for an internationally recognized information security standard under the aegis of an internationally recognized body, such as the ISO. This demand led to the "fast tracking" of BS 7799 Part 1 by the BSI, culminating in its first release by ISO as ISO/IEC 17799:2000 in December 2000.

In 2006, adoption of BS 7799 Part 2 for ISO standardization was completed and now forms ISO27001.

ISO17799 vs. ISO27001

• ISO17799 is a code of practice – like COBIT it deals with ‘what’, not ‘how’.
• ISO27001 This is the ‘specification’ for an Information Security Management System (ISMS). It is the means to measure, monitor and control security management from a top down perspective. It essentially explains how to apply ISO 17799 and it is this part that can currently be certified against

Unlike COBIT, ISO17799 does not include any maturity model sections for evaluation. (incidentally, nor does ISO9000)

ISO 17799 is a code of practice for information security. It details hundreds of specific controls which may be applied to secure information and related assets. It comprises 115 pages organized over 15 major sections.

ISO 27001 is a specification for an Information Security Management System, sometimes abbreviated to ISMS. It is the foundation for third party audit and certification. It is quite small because it doesn’t actually list the controls, but more a methodology for auditing and measuring. It comprises 34 pages over 8 major sections.

ISO17799 is:

• an implementation guide based on suggestions.
• used as a means to evaluate and build a sound and comprehensive information security program.
• a list of controls an organization "should" consider.

ISO27001 is:

• an auditing guide based on requirements.
• used as a means to audit an organizations information security management system.
• a list of controls an organization "shall" address.

ISO17799 Domains

• Security Policy
• Security Organization
• Asset Management
• Personnel Security
• Physical and Environmental Security
• Communications and Operations Management
• Access Control
• System Development and Maintenance
• Business Continuity Management
• Risk Assessment and Treatment
• Compliance

ISO17799 divides up security into 12 domains.

Within each domain, information security control objectives (if you recall that is he same terminology as COBIT) are specified and a range of controls are outlined that are generally regarded as best practice means of achieving those objectives.

For each of the controls, implementation guidance is provided.

Specific controls are not mandated since each organization is expected to undertake a structured information security risk assessment process to determine its requirements before selecting controls that are appropriate to its particular circumstances (the introduction section outlines a risk assessment process

ISO/IEC 17799 is expected to be renamed ISO/IEC 27002 in 2007. The ISO/IEC 27000 series has been reserved for information security matters with a handful of related standards such as ISO/IEC 27001 having already been released and others such as ISO/IEC 27004 – Information Security Management Metrics and Measurement – currently in draft.

We will examine Asset Management domain as an example of ISO17799.

ISO17799 in relation to ITIL

• ISO 17799 only addresses the selection and management of information security controls.
• It is not interested in underlying implementation details. For example:
• ISO 17799 is not interested that you have the latest and greatest logging and analysis products.
• ISO 17799 is not interested in HOW you log.
• Product selection is usually an operational efficiency issue (i.e. ITIL)
• ISO 17799 is interested in:
  • WHAT you log (requirements).
  • WHY you log what you do (risk mitigation).
  • WHEN you log (tasks and schedules, window of vulnerability).
  • WHO is assigned log analysis duty (roles and responsibilities).
• Satisfying these ISO 17799 interests produces defensible specifications and configurations that may ultimately influence product selection and deployment. (feeds into ITIL)

ISO17799 Example: Asset Management

• 7.1 Responsibility for assets:
  • Objective:
  • To achieve and maintain appropriate protection of organizational assets. All assets should be accounted for and have a nominated owner.
  • Owners should be identified for all assets and the responsibility for the maintenance of appropriate controls should be assigned. The implementation of specific controls may be delegated by the owner as appropriate but the owner remains responsible for the proper protection of the assets.
• 7.2 Information Classification
• Implementation guidance is offered for all controls

Domain: Asset Management

7 Asset management

Control 7.1 Responsibility for assets

Control Objective: To achieve and maintain appropriate protection of organizational assets. All assets should be accounted for and have a nominated owner. Owners should be identified for all assets and the responsibility for the maintenance of appropriate controls should be assigned. The implementation of specific controls may be delegated by the owner as appropriate but the owner remains responsible for the proper protection of the assets.

7.1.1 Inventory of assets

Control

All assets should be clearly identified and an inventory of all important assets drawn up and maintained.

Implementation guidance

An organization should identify all assets and document the importance of these assets. The asset inventory should include all information necessary in order to recover from a disaster, including type of asset, format, location, backup information, license information, and a business value. The inventory should not duplicate other inventories unnecessarily, but it should be ensured that the content is aligned. In addition, ownership (see 7.1.2) and information classification (see 7.2) should be agreed and documented for each of the assets. Based on the importance of the asset, its business value and its security classification, levels of protection commensurate with the importance of the assets should be identified

Other information

There are many types of assets, including:

• information: databases and data files, contracts and agreements, system documentation, research information, user manuals, training material, operational or support procedures, business continuity plans, fallback arrangements, audit trails, and archived information;
• software assets: application software, system software, development tools, and utilities;
• physical assets: computer equipment, communications equipment, removable media, and other equipment;
• services: computing and communications services, general utilities, e.g. heating, lighting,power, and air-conditioning;
• people, and their qualifications, skills, and experience;
• intangibles, such as reputation and image of the organization.

Inventories of assets help to ensure that effective asset protection takes place, and may also be required for other business purposes, such as health and safety, insurance or financial (asset management) reasons. The process of compiling an inventory of assets is an important prerequisite of risk management

7.1.2 Ownership of assets

Control

All information and assets associated with information processing facilities should be owned2 by a designated part of the organization.

Implementation guidance

The asset owner should be responsible for:

• ensuring that information and assets associated with information processing facilities are appropriately classified;
• defining and periodically reviewing access restrictions and classifications, taking into account applicable access control policies.

Ownership may be allocated to:

• a business process;
• a defined set of activities;
• an application; or
• a defined set of data.

Other information

Routine tasks may be delegated, e.g. to a custodian looking after the asset on a daily bsis, but the responsibility remains with the owner.

In complex information systems it may be useful to designate groups of assets, which act together to provide a particular function as ‘services’. In this case the service owner is responsible for the delivery of the service, including the functioning of the assets, which provide it.

7.1.3 Acceptable use of assets

Control

Rules for the acceptable use of information and assets associated with information processing facilities should be identified, documented, and implemented.

Implementation guidance

All employees, contractors and third party users should follow rules for the acceptable use of information and assets associated with information processing facilities, including:

• rules for electronic mail and Internet usages (see 10.8);
• guidelines for the use of mobile devices, especially for the use outside the premises of the organization (see 11.7.1);

Specific rules or guidance should be provided by the relevant management. Employees, contractors and third party users using or having access to the organization’s assets should be aware of the limits existing for their use of organization’s information and assets associated with information processing facilities, and resources. They should be responsible for their use of any information processing resources, and of any such use carried out under their responsibility.

The term ‘owner’ identifies an individual or entity that has approved management responsibility for controlling the production, development, maintenance, use and security of the assets. The term ‘owner’ does not mean that the person actually has any property rights to the asset.

ISO17799 Example: Asset Management

• 7.1 Responsibility for assets:
• 7.2 Information Classification
  • Objective:
  • To ensure that information receives an appropriate level of protection.
  • Information should be classified to indicate the need, priorities, and expected degree of protection when handling the information.
  • Information has varying degrees of sensitivity and criticality. Some items may require an additional level of protection or special handling. An information classification scheme should be used to define an appropriate set of protection levels and communicate the need for special handling measures
• Implementation guidance is offered for all controls

7.2 Information classification

Objective: To ensure that information receives an appropriate level of protection.

Information should be classified to indicate the need, priorities, and expected degree of protection when handling the information.

Information has varying degrees of sensitivity and criticality. Some items may require an additional level of protection or special handling. An information classification scheme should be used to define an appropriate set of protection levels and communicate the need for special handling measures.

7.2.1 Classification guidelines

Control

Information should be classified in terms of its value, legal requirements, sensitivity, and criticality to the organization.

Implementation guidance

Classifications and associated protective controls for information should take account of business needs for sharing or restricting information and the business impacts associated with such needs. Classification guidelines should include conventions for initial classification and reclassification over time; in accordance with some predetermined access control policy (see 11.1.1). It should be the responsibility of the asset owner (see 7.1.2) to define the classification of an asset, periodically review it, and ensure it is kept up to date and at the appropriate level. The classification should take account of the aggregation effect mentioned in 10.7.2. Consideration should be given to the number of classification categories and the benefits to be gained from their use. Overly complex schemes may become cumbersome and uneconomic to use or prove impractical. Care should be taken in interpreting classification labels on documents from other organizations, which may have different definitions for the same or similarly named labels.

Other Information

The level of protection can be assessed by analyzing confidentiality, integrity and availability and any other requirements for the information considered.

Information often ceases to be sensitive or critical after a certain period of time, for example, when the information has been made public. These aspects should be taken into account, as over-classification can lead to the implementation of unnecessary controls resulting in additional expense.

Considering documents with similar security requirements together when assigning classification levels might help to simplify the classification task.

In general, the classification given to information is a shorthand way of determining how this information is to be handled and protected.

7.2.2 Information labeling and handling

Control

An appropriate set of procedures for information labeling and handling should be developed and implemented in accordance with the classification scheme adopted by the organization.

Implementation guidance

Procedures for information labeling need to cover information assets in physical and electronic formats.

Output from systems containing information that is classified as being sensitive or critical should carry an appropriate classification label (in the output). The labeling should reflect the classification according to the rules established in 7.2.1. Items for consideration include printed reports, screen displays, recorded media (e.g. tapes, disks, CDs), electronic messages, and file transfers. For each classification level, handling procedures including the secure processing, storage, transmission, declassification, and destruction should be defined. This should also include the procedures for chain of custody and logging of any security relevant event. Agreements with other organizations that include information sharing should include procedures to identify the classification of that information and to interpret the classification labels from other organizations.

Other Information

Labeling and secure handling of classified information is a key requirement for information sharing arrangements. Physical labels are a common form of labeling. However, some information assets, such as documents in electronic form, cannot be physically labeled and electronic means of labeling need to be used. For example, notification labeling may appear on the screen or display. Where labeling is not feasible, other means of designating the classification of information may be applied, e.g. via procedures or meta-data.

Benefits of Best Practices

• Avoiding re-inventing wheels
• Reducing dependency on technology experts
• Increasing the potential to utilize less-experienced staff if properly trained
• Making it easier to leverage external assistance
• Overcoming vertical silos and nonconforming behavior
• Reducing risks and errors
• Improving quality
• Improving the ability to manage and monitor
• Increasing standardization leading to cost reduction
• Improving trust and confidence from management and partners
• Creating respect from regulators and other external reviewers
• Safeguarding and proving value
• Helps strengthen supplier/customer relations, make contractual obligations easier to monitor and enforce

There are also some obvious, but pragmatic, rules that management ought to follow:

• Treat the implementation initiative as a project activity with a series of phases rather than a ‘one-off’ step.
• Remember that implementation involves cultural change as well as new processes. Therefore, a key success factor is the enablement and motivation of these changes.
• Make sure there is a clear understanding of the objectives.
• Manage expectations. In most enterprises, achieving successful oversight of IT takes time and is a continuous improvement process.
• Focus first on where it is easiest to make changes and deliver improvements and build from there one step at a time.
• Obtain top management buy-in and ownership. This needs to be based on the principles of best managing the IT investment.
• Avoid the initiative becoming perceived as a purely bureaucratic exercise.
• Avoid the unfocused checklist approach.

Free Information: Aligning CT , ITIL and ISO 17799 for Business Benefit: http://www.itgovernance.co.uk/files/Aligning%20ITIL,%20CobiT,%2017799.pdf

• IT best practices need to be aligned to business requirements and integrated with one another and with internal procedures.
• COBIT can be used at the highest level, providing an overall control framework based on an IT process model that should generically suit every organization.
• Specific practices and standards such as ITIL and ISO 17799 cover discrete areas and can be mapped to the COBIT framework, thus providing an hierarchy of guidance materials.

The content of this blog is essentially material I compiled for training sessions that I ran last year. It was originally PowerPoint, but I hope that this blog version is useful. Some of the legislative stuff is probably now out of date, and it was for an Australian audience – moral of the story is to do your own research.

For part 1 of this presentation, view this post and part 2 this post.

Continue reading “IT Governance Standards: COBIT, ISO17799/27001, ITIL and PMBOK – Part 3”

The content of this blog is essentially material I compiled for training sessions that I ran last year. It was originally PowerPoint, but I hope that this blog version is useful. Some of the legislative stuff is probably now out of date, and it was for an Australian audience – moral of the story is to do your own research.

For part 1 of this presentation, view this post.

Continue reading “IT Governance Standards: COBIT, ISO17799/27001, ITIL and PMBOK – Part 2”

The content of this blog is essentially material I compiled for training sessions that I ran last year. It was originally PowerPoint, but I hope that this blog version is useful. Some of the legislative stuff is probably now out of date, and it was for an Australian audience – moral of the story is to do your own research!

Here is our agenda:

• IT Compliance introduction
• US, Australian and EU laws
• Introduction to Best Practice Frameworks
• Introduction to COBIT with example
• Introduction to ITIL with example
• Introduction to ISO17799 with example
• Making them play together

IT Compliance – Why bother?

• Companies want a better ROI on IT investments
• Concern over increasing IT expenditure
• Regulatory regulations. E.g. Sarbanes Oxley
• Global outsourcing
• Increasing IT risk (security threats)
• Growing maturity of international best practice frameworks like ISO17799
• The need to benchmark and assess performance against standards and peers

There has been a huge increase in the adoption of IT best practices in the last few years. There are a few reasons for this, but fundamentally its driven by a requirement for to improve the quality and reliability of IT in an organization which in turn is in response to a growing number of regulatory and contractual requirements.

IT best practices are important because:

• Management of IT is critical to the success of enterprise strategy.
• They help enable effective governance of IT activities.
• A management framework is needed so everyone knows what to do (policy, internal controls and defined practices).
• They provide many benefits, including efficiency gains, less reliance on experts, fewer errors, increased trust from business partners and respect from regulators.

IT Governance – Costly?

• It has the potential to be costly
• You need to keep it current (avoid shelfware)
• You need to train staff
• If you don’t understand *why* it is needed, you will fail
• Without board level buy-in, it will probably fail (then they will ask for it within 1 week)
• Should not be treated as technical guidance, but business guidance

There is a danger, however, that any implementation of these potentially helpful best practices will be costly and unfocused if they are treated as purely technical guidance.

Standards and best practices are not a panacea, and their effectiveness depends on several factors.

Firstly they have to be kept up to date. Implementing these standards is not a once off operation that is set and forget. In a lot of organizations it requires a high level of commitment, a change of mindset and importantly a change of habits. To deliver this, staff need the appropriate level of training and sometimes IT departments need to re-organize.

Note: IT departments historically are not well experienced with implementing IT best practice standards, however many other departments within an organization are. We will get into why this has to change (and is changing) further into the presentation.

Standards have to be applied within the business point of view, with the focus on where their use would provide the most benefit to the organization. That primarily is driven by financial considerations, which we will look into a little later.

Note: IT Departments generally are becoming more business focused, despite the relative inexperience when it comes to IT Compliance standards.

So for best practice standards to be effective, all the levels from business management, IT management, auditors, compliance officers, infrastructure and operational staff need to work together to make sure that IT best practices actually lead to cost-effective and well-controlled IT delivery.

The only way to get that level of buy-in and commitment often requires board or senior management level sponsorship. In this model, management have the clout to ‘make it happen’.

Best practice standards are most useful when applied as a set of principles and as a starting point for tailoring specific procedures. To avoid practices becoming ‘shelfware’, management and staff must understand what to do, how to do it and why it is important.

Any implementation of best practice should be consistent with the any existing risk management and control framework. For example many engineering service companies certify to ISO9000/9001 for quality process. We do not want apply principles or practices that are not compatible with this.

You *will* be asked

• It is often not IT dept choice.
• Most likely it will come from board level based on business investments that have legislative requirements
• Its amazing how interested company directors become in compliance when they realize their personal liabilities!

More often than not, IT departments have best practice standards thrust upon them. This is particularly true for US and UK companies, but increasingly for Australian and EU companies as well. This is the often the least ideal situation, since the scope is probably bigger than you expect, the timeframe is less than you expect and the likelihood of a poor implementation is increased.

The main driver for this trend has been legislative and legal requirements put upon organizations. Often these requirements explicitly define Company directors liability.

Another big driver is competitive advantage. I have personally had two occasions where a client asked for implementation details of ISO17799. In both cases, we were completely unprepared for this and management naively thought I could knock it out in a couple of days!

In the next section we will look at the US legislation that has had the biggest impact on compliance standards in the last few years.

Sarbanes Oxley (SOX)

• Board level accountability in the wake of Enron/Worldcom type scandals
• Who’s affected: USA corporate subsidiaries, appointed auditors or financials advisors to these companies in Australia or Australian companies listing on the USA markets or those that have joint projects with US companies.
• Requirement that companies evaluate and disclose the effectiveness of their internal controls as they relate to financial reporting
• Directors directly liable for the companies they control.
• SOX recognizes COBIT as the methodology for assessing IT control effectiveness

The Sarbanes-Oxley Act is a significant piece of US federal legislation that was signed into law by President Bush on July 30, 2002 in response to corporate failures such as Enron, WorldCom and the many other corporate accounting scandals that have plagued the US in recent years. It is already having far reaching effects on US public companies, their management, auditors and procedures relating to reporting protocols to US regulatory authorities. The Act also applies to Australian companies and nationals with US parents or who have a significant business-to-business relationship with a publicly owned US company. Compliance to the act is compulsory and has significant repercussions for CFO’s, CEO’s, Board members and Directors of Australian companies. http://www.austrade.gov.au/australia/layout/0,,0_S2-1_1zg-2_2-3_PWB110371167-4_main-5_-6_-7_,00.html

The Sarbanes-Oxley Act’s major provisions include:

• Creation of the Public Company Accounting Oversight Board (PCAOB)
• A requirement that public companies evaluate and disclose the effectiveness of their internal controls as they relate to financial reporting, and that independent auditors for such companies "attest" (i.e., agree, or qualify) to such disclosure
• Certification of financial reports by chief executive officers and chief financial officers
• Auditor independence, including outright bans on certain types of work for audit clients and pre-certification by the company’s Audit Committee of all other non-audit work
• A requirement that companies listed on stock exchanges have fully independent audit committees that oversee the relationship between the company and its auditor
• Ban on most personal loans to any executive officer or director
• Additional disclosure
• Enhanced criminal and civil penalties for violations of securities law
• Significantly longer maximum jail sentences and larger fines for corporate executives who knowingly and willfully misstate financial statements, although maximum sentences are largely irrelevant because of the ability of judges to declare consecutive sentences under the Federal Sentencing Guidelines

COBIT was developed before SOX, and was given higher prominence when the SOX legislation recognized COBIT as the means to provide the assurance for IT internal controls.

It’s a US law, we are not affected!

• The European Union has been considering SOX type controls prior to US adoption of SOX (FSAP)

"Even with, or perhaps so, the three tiers of regulatory bodies in Europe, there are no pan-European requirements for specific internal controls. Given this fact, EU demand for SOX equivalent IT solutions is currently more limited than the US. Over the next three to five years, however, as member states fully embrace EU directives and regulations, the demand for country-compatible or regional IT compliance solutions is expected to grow. And, as Europe strives for higher investor confidence, there is the likelihood of additional, and perhaps more specific, requirements to come.

While EU codes are not as prescriptive as US laws, all of the guidance represents common bottom line goals. Companies will benefit if they can leverage internal experience with SOX by speaking to the benefit of technology in achieving compliance goals; that is, how specific applications and systems increase transparency, lock down network security, protect sensitive information, shore up financial reporting and ultimately improve all of the other business processes that support and justify investor confidence.

http://www.itcinstitute.com/display.aspx?id=466

EU Financial Services Action Plan (FSAP)

In June 1998, the Cardiff European Council invited the European Commission to table a framework for action to develop a single market in financial services. In May 1999, the Commission published a Communication containing a Financial Services Action Plan, which the Lisbon European Council endorsed in March 2000.

The FSAP is a set of 42 measures intended to fill gaps and remove barriers to create a legal and regulatory environment supporting the integration of EU financial markets by 2005. It has three aims:

• the creation of a single EU wholesale market for financial services and products;
• the creation of an open and secure financial retail market; and
• implementation of state of the art prudential rules and supervision

EU Law continued..

• The EU additionally has very strict privacy laws (Data Protection Directive 1998)
• Sector specific compliance: HIPAA, BASEL II

EU Data Protection Act

Personal data are defined as "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;"

The notion processing means "any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;" (art. 2 b)

Principles

Personal data should not be processed at all, except when certain conditions are met. These conditions fall into three categories: transparency, legitimate purpose and proportionality.

Transparency

The data subject has the right to be informed when his personal data are being processed. The controller must provide his name and address, the purpose of processing, the recipients of the data and all other information required to ensure the processing is fair. (art. 10 and 11)

Data may be processed only under the following circumstances (art. 7):

• when the data subject has given his consent
• when the processing is necessary for the performance of or the entering into a contract
• when processing is necessary for compliance with a legal obligation
• when processing is necessary in order to protect the vital interests of the data subject
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party to whom the data are disclosed
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject

The data subject has the right to access all data processed about him. The data subject even has the right to demand the rectification, deletion or blocking of data that is incomplete, inaccurate or isn’t being processed in compliance with the data protection rules. (art. 12)

Legitimate Purpose

Personal data can only be processed for specified, explicit and legitimate purposes and may not be processed further in a way incompatible with those purposes. (art. 6 b)

Proportionality

Personal data may be processed only insofar as it is adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed. The data shouldn’t be kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data were collected or for which they are further processed. Member States shall lay down appropriate safeguards for personal data stored for longer periods for historical, statistical or scientific use. (art. 6)

Basel II

Basel II, also called The New Accord (correct full name is the International Convergence of Capital Measurement and Capital Standards – A Revised Framework) is the second Basel Accord and represents recommendations by bank supervisors and central bankers from the 13 countries making up the Basel Committee on Banking Supervision to revise the international standards for measuring the adequacy of a bank’s capital. It was created to promote greater consistency in the way banks and banking regulators approach risk management across national borders. The Bank for International Settlements (often confused with the BCBS) supplies the secretariat for the BCBS and is not itself the BCBS

The Australian Perspective

• Australian government has recognized the business cost of SOX type compliance and does not want to follow the US model
• DOCIT produced a "IT Security and Governance" whitepaper
• Corporations Act 2001. Uphold Due Care
• Privacy Act 1988 Protecting Information
• ATO 2005/9 Income Tax Record keeping
• ASX Principles of Good Corporate Governance
• AS 4360 Risk Management Framework

"SOX is seen by many organizations as a major cost to profit and manpower" (http://money.cnn.com/2006/03/21/news/companies/compliance_complaints/index.htm)

"A global study from European accountants Mazars, found that close to 20% of EU companies are planning to de-list from the US market to avoid complying and more than half feel the costs outweigh the benefits" http://www.laywersweekly.com.au/articles/9D/0C043D9D.asp?Type=53&Category=853

However this has the potential to impact on the cost of credit for such companies as warned in July 2006 by Moodys. "The cost of capital for public companies in countries that choose not to implement US Sarbanes-Oxley (SOX) type corporate governance rules may soon increase to reflect the additional risk premium resulting from companies and their auditors concealing the true level of audit risk"

At present the Australian government is not planning to introduce SOX type legislation, instead believing that the current regulatory provisions are adequate. Major legislation includes: Corporations Act 2001. Uphold Due Care, Privacy Act 1988 Protecting Information, ATO 2005/9 Income Tax Record keeping, ASX Principles of Good Corporate Governance, AS 4360 Risk Management Framework.

The Department of Communications, Information Technology and the Arts (DOCIT) on behalf of the Information Technology Security Expert Advisory Group (ITSEAG) engaged KPMG to produce a report on the governance of IT and information security matters for the corporate governance needs of Australian companies.

They identified 3 main observations to the risk landscape of ICT.

• There is a growing gap between the rate of technology adoption and the rate of controls adoption
• Convergence of technologies has led to a convergence of risk, greatly increasing the the potential impact to the business
• Increased dependences on technology has greatly increased the potential impacts in the event of failure.

They identified 3 main categories representing the greatest threats to critical infrastructure

• Human Error
• System Failure
• Malicious Software

They then define security governance as "implementing a culture of accountability in order for effective security management to take place". They refer to the ISO17799 as the model for their "Enteprise Security Architecture Model".

Note the use of the term accountability. It is a recurring theme across all best practice standards.

Why stop at one!

• COBIT v4
• ISO17799/ISO27001
• ITIL
• PMBOK
• SEI CMM
• COSO ERM

We have established that there are legislative/business reasons for best practice. But where to start?

• ITIL—Published by the UK government to provide best practices for IT service management
• COBIT—Published by ITGI and positioned as a high-level governance and control framework. COBIT stands for Control Objectives for Information and related Technology. IT Controls, measures, and processes
• ISO/IEC 17799—Published by the International Organization for Standardization (ISO) and International Electro technical Commission (IEC) and derived from the UK government’s BS 7799 to provide a framework of a standard for information security management Code of practice for information security management . It Security Best Practice
• PMBOK – Project Management Body of Knowledge . Project Management best practice (PMP certification)
• SEI CMM – Software Engineering Institute (SEI) Capability Maturity Model. Software Development Life Cycle
• COSO ERM – Committee of Sponsoring Organizations of the Treadway Commission. Enterprise risk management — Integrated Framework.

Framework Interaction

• The frameworks complement each-other
• Frameworks are vendor agnostic – no focus on tools
• Most frameworks are geared toward a specific subject
• PMBOK – Project Management
• SEI CMM – Software Engineering Maturity
• ISO17799/ISO27001 – Security Best Practice
• COBIT is a high level and considered the ‘umbrella’ connecting the others.
• We will look at COBIT and its relationship with ISO17799 and ITIL. PMBOK and SEI CMM will not be looked at

For the second half of this topic, consult this post.

Seriously.. this particular post is so fringe I wonder if there is any point, given I mostly blog around SharePoint 2007. But hey, governance is critical at all levels and its all well and good to have all this governance at a SharePoint farm level, only to find the underlying infrastructure supporting it is sub-optimally configured or maintained.

For what its worth, I don’t do this sort of work anymore.. its been a long time since geeky low level stuff pushed my buttons. But hey, you never know – maybe someone may find this of some use..

So here we go. This post simply outlines the process of upgrading an IBM blade server to the latest greatest (at the time of writing) drivers, firmware and stuff. The operating system was installed by IBM’s fancy schamzy ServerGuide CD’s. But from my experience with IBM in particular, by the time you rip open the packaging, the CD is out of date and there are much newer versions on IBM’s site. Given that we are talking about disk subsystems, BIOS, drivers and that sort of stuff here, you should ideally ensure you always do a comprehensive check of all components of your server and system infrastructure and make sure you have the latest.

Upgrading this stuff before the server is in production is less risky and allows you to capture really useful information that helps for next time.

Example HBA and storage subsystem driver install for WINDOWS Cluster on IBM BladeServers

1. Qlogic San Surfer management agent

Run the QLogic SANsurfer install program on the blade server and click on the custom button and then click on the Next button:

Deselect everthing except SANsurfer FC Windows Agent (we do not need all the other crap) and click on the Next button:

Click on the Install button:

Click on the Done button:

2. Update the Qlogic drivers

So now that we have the SanSurfer management agent installed, we can use the SanSurfer Administration utility to connect to this server and check things out. You can collect some useful stats from this utility which I will blog about some other time. (I used it to corroborate disk I/O performance as reported by my SAN as well as Windows physicaldisk performance counters)

Anyway I digress. So I am assuming here that you have installed the SanSurfer management components (the stuff you skipped in step 1) onto management PC. So using SANSurfer Administration utility, Connect to the IP of the server running the agent and then click on each HBA/Port listed.

Click UTILITIES tab and click Update Driver and choose “from the Qlogic Website”

If there is a new driver, then you will see a message like the one below

You will be asked to enter a password.. (you can find the default password in the documentation that comes with the blade if you have never set it)

Now the update has completed..

3. Option ROM and Firmware

Note the OS driver was not the only thing upgradable via this utility. It is also possible to upgrade firmware and BIOS for the controller itself

So I went snooping at the IBM website and came across the is the IBM OEM Support page

http://support.qlogic.com/support/oem_detail_all.asp?oemid=224

Listed on this page is:

4Gb Expansion Card ROM Image for HS & LS blades 1.38 4Gb Expansion Card BIOS 1.24, Fcode 1.25, Firmware 4.00.24.

Examination of the current BIOS using SanSurfer showed an older BIOS.

BIOS is 1.04, FW 4.00.23, fcode 1.08

Downloaded ibm_qmix472cf1.38risc4.00.24.zip from the above site and saved it to my PC.

Now back in the SANSurfer GUI, choose UPDATE OPTION ROM

Choose the downloaded zip file

enter password

Reboot the server and check the option rom Information. Well what do you know.. now it matches the version on the IBM OEM site.

4. Install IBM Storage Manager host agent for failover

This site has a nice new IBM SAN, and to achieve redundancy within the SAN, you have to install an IBM component that sets up the HBA’s on the blade for failover. This software came with the SAN and once again I checked IBM’s web site for the latest version.

Here, I used Storage Manager v9.19 for Windows 64-bit\Windows

Choose HOST from the list here.

Choose the RDAC Driver as recommended. This is holding my entire farm and I’ll stick to the recommendation

Restart and hey presto! You will see in a later post my test plan for stress testing this SAN once set up as I test this failover by pulling cables

IPSEC.. WTF? Isn’t this supposed to by SharePoint?

Well, yeah you got me.. but a few years back I was a Cisco nerd in the ISP industry and got pretty handy at it. I wrote this article 3 years ago but then forgot about it until recently.. so it may as well see the light of day because at the time I wrote it, there was very little info out there on this subject.

Continue reading “An annotated IPSEC example”

This is version 2 of this article, after I went and accidentally blew away my first masterpiece that took literally days to write. If this has ever happened to you, don’t you hate it, that your second version is never as good as your first?

Quick Links: [Part 1, Part 2, Part 3, Part 4, Part 5, Part 6, Part 7]

Anyway, this is (attempt 2 of) part 1 of a series of articles that cover SharePoint branding in some detail. Kudos has to be given Heather Solomon especially for her wonderful site and articles on this subject (and author of the book to your left :). In Addition, Andrew Connell and Mike have done some great work that helped me in this area. So, SharePoint branding was the catalyst behind my deciding to make a blog and call it cleverworkarounds. The whole experience at times made me want to change careers, but I ultimately got there. I would go down one path, only to be stumped by a problem, and think I have the solution, only to find another quirk that needed another workaround. So the aim of cleverworkarounds is to determine the least dodgy way to implement branding of a SharePoint installation. No doubt people will disagree with the conclusions I’ve reached, but that’s expected since the cleverness of a workaround really depends on your needs.

So this series of articles will cover a few issues. First some basic master page theory, then I will talk about the difference between branding in WSS3 (the freebie version) and MOSS07 (the pricey one). I will then take you through the quirks of CSS and master pages. Subsequent articles will get into the details of branding techniques and finally finish off by covering the governance issues surrounding branding.

Continue reading “SharePoint Branding – How CSS works with master pages – Part 1”

If you check my introductory post, I discussed the concept of SharePoint features in a real world scenario. In this post I actually show an example of features from end to end, to illustrate that scenario.

So, first to recap the scenario, slightly simplified from my other post: A webdesigner has a new CSS file that is the new corporate branding standard. They must package it up as a ‘feature’. A misunderstood sysadmin nazi installs the feature onto the SharePoint farm once only, then sends a mail to the 35 site collection owners advising them to activate the "branding feature" on their sites.  Each site collection owner who does so has the identical configuration modified so it is all nice and consistent.

Now also before we start, this demo requires the "Office SharePoint Server Publishing Infrastructure" feature to be enabled. If this is not enabled, the "Style Library" document library that we rely on, will not exist.

Step 1: Create the Feature

Our web designer of course has a development box so they can’t kill production. On this box they navigate to the

C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\TEMPLATE\FEATURES

and create a new folder called CustomBranding

C:\Program Files\Common Files\Microsoft Shared\web server extensions\12\TEMPLATE\FEATURES\CustomBranding

Inside this folder we place our CSS file (in this case, called CustomBrand.CSS) and we create a file called FEATURE.XML.

Now in real life, you will copy a FEATURE.XML from one of the many other features here and work off that. But in our case, we will just type it in. The contents of FEATURE.XML is this:

<Feature Id="01c34560-6561-11dc-8314-0800200c9a66″   
Title="Pimp my SharePoint"   
Description="This is a feature that adds a new sexy CSS"   
Version="1.0.0.0″   
Scope="Site"   
xmlns="http://schemas.microsoft.com/sharepoint/">   
<ElementManifests>        
    <ElementManifest Location="ProvisionedFiles.xml"/>   
</ElementManifests>
</Feature>

So we have a <feature> element and inside that an <elementmanifests> element. The required parameters for the <feature> element are below (lifted straight from MSDN)

Attribute		Description
Description		Optional String. Returns a longer representation of what the Feature does.
Id		Required Text. Contains the globally unique identifier (GUID) for the Feature.
Scope		Required Text. Can contain one of the following values: Farm (farm), WebApplication (Web application), Site (site collection), Web (Web site).
Title		Optional Text. Returns the title of the Feature. Limited to 255 characters.
Version		Optional Text. Specifies a System.Version-compliant representation of the version of a Feature. This can be up to four numbers delimited by decimals that represent a version.

So the first thing to do is generate a GUID. You can do this a number of ways, but I typically use an online generator like the one here to do it.

My GUID from the online generator is:  01c34560-6561-11dc-8314-0800200c9a66. Feel free to use it for this example but you should substitute with your own.

Title and description parameters should be plainly obvious and version is optional, but whack it in anyway.

Scope is important, a feature can be activated at various points in the farm. "Site" means it is activated once per site collection. All sub-sites under this site collection can make use of the feature without having to activate it. This will become clear later.

Next we refer to an <element manifest>. This is a reference to another XML file that actually tells Sharepoint what to do (provisionedfiles.xml). In our case, it is going to tell SharePoint to upload the CustomBrand.CSS file to the site collection style library.

Let’s take a look.

<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
    <Module Name="MyPimpedStyles" Url="Style Library" RootWebOnly="TRUE">        
        <File Url="CustomBrand.css" Type="GhostableInLibrary" />    
    </Module>
</Elements>

In this file, the top-level Elements element defines the elements comprising the Feature. In my previous post, I outlined a table of elements that can be used to install SharePoint features.

• Content Types: Contains a definition of a SharePoint content type.
• Content Type Binding: Actually applies a content type to a document library.
• Control: Allows you to replace existing controls on the page, such as the search or navigation with your own custom control.
• Custom Action: You can define custom actions such as add a new menu item in "Site Actions".
• Feature/Site Template Association: This allows you to bind a feature to a site template so that the feature is included in new sites based on that template.
• Field: Contains a field, or column definition that can be reused in multiple lists.
• Hide Custom Action: Opposite to "Custom Action", where you want to hide menu items.
• List Instance: Provisions a SharePoint site with a list which includes specific data.
• List Template: A list definition or template, which defines a list that can be provisioned to a SharePoint site.
• Module: Deploys files which are included when provisioning sites.
• Receiver: Defines an event handler for a list, or document library
• Workflow: Defines a workflow for a list, or document library. 

So as you can see in the above XML file, we have used the MODULE element to install 1 single file. Let’s examine the <MODULE> and <FILE> element in detail.

<Module Name="MyPimpedStyles" Url="Style Library" RootWebOnly="TRUE">        
<File Url="CustomBrand.css" Type="GhostableInLibrary" />    
</Module>

Module Attribute	Description
Name	Required Text. Contains the name of the file set.
RootWebOnly	Optional Boolean. TRUE if the files specified in the module are installed only in the top-level Web site of the site collection.
Url	Optional Text. Specifies the virtual path of the folder in which to place the files when a site is instantiated. If Path is not specified, the value of Url is used for the physical path. Use the Url attribute to provision a folder through the Feature.

File Attribute	Description
IgnoreIfAlreadyExists	Optional Boolean. TRUE to provision the view even if the file aready exists at the specified URL; otherwise, FALSE.
Type	Optional Text. Specifies that the file be cached in memory on the front-end Web server. Possible values include Ghostable and GhostableInLibrary. Both values specify that the file be cached, but GhostableInLibrary specifies that the file be cached as part of a list whose base type is Document Library.When changes are made, for example, to the home page through the UI, only the differences from the original page definition are stored in the database, while default.aspx is cached in memory along with the schema files. The HTML page that is displayed in the browser is constructed through the combined definition resulting from the original definition cached in memory and from changes stored in the database.

So, the module section is specifying where any <file> elements be copied to. We are going to copy this to the document library called "Style Library" in the root web site for the site collection. 

 

Step 2. Installing and testing the Feature

Now that our web developer has created the feature, they test it on their development SharePoint server. Open command prompt and execute the STSADM -installfeature command. When the -name parameter is specified, SharePoint knows to look in the TEMPLTE\FEATUIRES folder already, so you do not have to specify a full path.

Step 3. Test the feature

Okay, so the feature is installed. Now what? Now we need to activate this feature on a site collection. Here is the "Style Library" of my test site. (Remember that this library will not exist unless the SharePoint Publishing Infrastructure feature has been installed). Note that at this time, there is no CSS file called CUSTOMBRAND.CSS

So now let’s Activate the feature. Browse to Site Actions>Site Settings and from the Site Collection Administration menu, choose "Site Collection Features". Lo and behold! We have our feature listed! Note the title and description is as per our FEATURE.XML file.

Click "Activate" to activate the feature (you can also do this on the command line via STSADM -o activatefeature command). Once it is marked as active, re-examine the style library. Woo freakin hoo! There is our CSS file!

Step 5. Test and deploy the Feature

In our example here, we can test this feature, by choosing to use this new CSS file in the master page settings of any site within the site collection. The Site Collection administrator navigates to site settings->look and feel->master page settings and specifies the CSS file override as shown below.

By clicking on the "Browse" button, they can select the CSS file from the style library in the site collection.

This highlights the relationship between the web designer and the farm, site collection and site owners. In a large production farm the sequence would look something like this.

• The developer creates and tests the feature
• The developer hands the tested and approved feature to the the SharePoint farm administrator
• The SharePoint farm administrator copies this feature into the FEATURES folder on the web front end servers on the farm and notifies the site collection administrators that the feature has been installed
• Each site collection administrator activates the feature and informs the site owners that the feature is now available.
• Each site owner optinally chooses to use this new CSS installed by the feature.

Summing Up

I hope that you found this article useful. Now you are going to totally hate me, because now I am going to tell you that features are only half of the solution to SharePoint customisation. "What is the other half"? you may ask.  Well the other half of the solution is "solutions" … don’t you just love generic terminology!