IPSC Best Practices
A quick reference to many industry best practices, tools, and resources for information security as identified by the Information Privacy and Security Council.
Overview of IPSC Best Practices
This purpose of this web page is to provide a quick reference to many industry best practices, tools, and resources for information security as identified by the Information Privacy and Security Council. The majority of links on this page are external to the State of Hawai’i web pages as indicated by a globe icon. The intent is to update this page frequently to provide current information on tools, practices, and standards. No endorsement is implied or intended by the State of Hawai’i by the listing or omission of vendors and/or commercial products on this page.
Table of Contents
- Software Licensing Audit
- Log Management Tools
- Penetration Testing
- Vulnerability Testing
- Malware Prevention & Scanning
Browser Plug-Ins & Web Safety Tools
- General Information Security Awareness Training
- Personally-Identifiable Information (PII) Training
Public Reports on Cyber Threats & Data Breaches
Helpful information from the State of Hawai’i ICSD Cyber Security Team http://hawaii.gov/dags/icsd/cst/cyber-security-resources http://hawaii.gov/dags/icsd/cst/cyber-security-toolkit http://hawaii.gov/dags/icsd/cst/cyber-security-videos
- MS-ISAC (Multi-State Information Sharing & Analysis Center) Vulnerability Advisories
This section provides more information about automated tools that can be used to provide a secure computing environment.
- Software Licensing Audit: Business Software Alliance: Free Software Audit Tools
- Log Management/Analysis and SIEM (Security Information and Event Management) The category involves working with large volumes of computer generated records (log files) which provide various types of information such as information about the computer, network, and when and by who information was accessed. And by sifting through the information and applying various rules, there is an automated determination if there are any security or operational issues that need to be addressed. The NIST Guide to Computer Security Log Management provides more information about this area.
- Penetration testing Penetration testing is used to evaluate the security of computer systems and networks by simulating an attack as if from a malicious source. The process involves an active analysis of the system for any potential vulnerabilities that may result from poor or improper system configuration, known and/or unknown hardware or software flaws, or operational weaknesses in process or technical countermeasures. This analysis is carried out from the position of a potential attacker, and can involve active exploitation of security vulnerabilities. Any security issues that are found will be presented to the system owner together with an assessment of their impact and often with a proposal for mitigation or a technical solution.
- Vulnerability Assessment Tools
- Secunia (a security company) provides a free online baseline vulnerability scanner
- They also have a free security tool designed to detect vulnerable and out-dated programs and plug-ins which can expose a PC to attacks
- Gibson Research Corporation ShieldsUP!! benignly probes the target computer at your location for vulnerabilities.
- Anti-virus, Anti-spyware, malware scanners, personal firewalls, web scanners, etc.
- AVG Anti-Virus Free edition (for personal use only)
- Malwarebytes Anti-Malware Free scanner detects and removes malware like worms, Trojans, rootkits, rogues, spyware, and more.
- Microsoft Security Essentials free anti-virus protection for Windows
- Symantec Security Check tests your computer’s exposure to online threats
Browser Plug-Ins & Web Safety Tools
A listing of free plug-ins useful for safe web browsing. Be sure to carefully read the FAQs before implementing any of these plug-ins.
- Targeted Advertising Cookie Opt-Out (TACO) Sets an opt-out flag for numerous advertising tracking cookies
- Better Privacy deletes super-cookies
- NoScript Prohibits potentially harmful scripts from being executed within a web page
- McAfee Site Advisor adds visible safety ratings to searches and sites visited
- Norton (Symantec) Safe Web allows you to enter a web address (URL) and will return a rating based on safety and security issues
- The Qualys Browser Check will identify your outdated plug-ins that may be vulnerable to attacks
This section provides information about computer (web-based) training modules for new employees and any mandatory annual refreshers. Examples are Civil Rights, LEP, Privacy, Security, DHRD modules, etc.
General Security Training:
- TEEX Domestic Preparedness Campus DHS/FEMA Certified Cyber Security Training
- OnguardOnline.gov provides tips from the Federal Government
- Information Assurance and security training provided by DISA
- National Cyber Security Alliance
- MS-ISAC training resources
- Carnegie Mellon CyLab offers an interactive game that teaches users how to identify phishing URLs, where to look for cues in web browsers, and how to use search engines to find legitimate sites
- Defense Information Systems Agency (DISA) class on Phishing
Personal Information Education:
- Data Breaches: http://www.privacyrights.org/
- Verizon Breach Investigations: http://www.verizonenterprise.com/DBIR/
- Ponemon/IBM Cost of Data Breach Study: http://www-935.ibm.com/services/us/en/it-services/security-services/cost-of-data-breach/
- DHS (Department of Homeland Security) Cyber Security Framework
- NIST (National Institute of Standards and Technology) Computer Security Division
- NIST 800-53: Recommended Security Controls for Federal Information Systems and Organizations
- ISO (International Standards Organization) 27002: Code of Practice for Information Security:
- CoBIT Executive Summary
- PCI DSS (Payment Card Industry Data Security Standards)
- HIPAA (Health Insurance Portability and Accountability Act)
- FISMA (Federal Information Security Management Act) Overview
- FIPS (Federal Information Processing Standards) Publications
- FIPS 140-1: Framework for Cryptographic Standards
- HR 2221: Data Accountability and Trust Act (summary):
- HR 2221: Data Accountability and Trust Act (full text)
- Information and Communication Services Division (ICSD) Policies (State Intranet access only)
Disclaimer: The information posted on the State of Hawaii website includes hypertext links or pointers to information created and maintained by other public and/or private organizations. The State of Hawai’i provides these links and pointers solely for your information and convenience. When you select a link to an outside website, you are leaving the State of Hawai’i site and are subject to the privacy and security policies of the owners/sponsors of the outside website. The State of Hawaii provides multiple channels through which all individuals can have access to the same information and data. The State of Hawai’i does not control or guarantee the accuracy, relevance, timeliness or completeness of information contained on a linked website. The State of Hawai’i does not endorse the organizations sponsoring linked websites and does not endorse the views they express or the products/services they offer. The State of Hawai’i cannot authorize the use of copyrighted materials contained in linked websites. Users must request such authorization from the sponsor of the linked website. The State of Hawai’i is not responsible for transmissions users receive from linked websites.