Linux Advisory Watch – September 5th 2003

This week, advisories were released for sendmail, gdm, node, pam_smb, vmware, horde, phpwebsite, eroaster, mindi, gallery, atari800, sendmail, and up2date. The distributors include Conectiva, Debian, Gentoo, Red Hat, and Turbo Linux.

Recently, I discovered an interesting information security project titled “Towards a Taxonomy of Information Assurance.” The founder , Abe Usher, originally posted on a security mailing list asking for comments from the open source community. The project Web site states the following as the purpose: “My intent is that this taxonomy could be used by the academic community, industry, and government in improving the precision of communication used in discussing information assurance/security topics.” The author indicates that his research on information assurance has not yet uncovered a taxonomy that “is sufficiently detailed for application with real world problems.”

The entire taxonomy has been divided into three categories: security services, information states, and security countermeasures. Security services includes availability, authentication, confidentiality, integrity, and non-repudiation. Security countermeasures includes technology, policies, people, and information states includes transmission, storage, and processing. Each of these sections have been further sub- divided into more detailed categories. The best way to understand how the taxonomy is organized is to visit the project Web site:

http://www.sharp-ideas.net/ia/information_assurance.htm

Ok, a taxonomy?! So what! What potential uses could this have? The first thing that I thought of was document classification. Like many of you, over the last few years I have collected many security and open source documents that I use for reference. Generally, I prefer to keep a local copy of all useful documents to ensure that they will always be available. As my digital library has grown, indexing has become much more complex. At the moment, it is difficult to fully organize efficiently. Using a completed information security taxonomy as reference, I will now be able to create a comprehensive directory structure to store all of my documents. In addition to better organization, a completed taxonomy will assist persons interested in learning more about information security. It will give students a better overview of everything included in information security. I applaud Abe Usher for his efforts. I would also like to encourage readers to submit any suggestions or ideas to him.

Until next time,
Benjamin D. Thomas

LinuxSecurity Feature Extras:

A Practical Approach of Stealthy Remote Administration – This paper is written for those paranoid administrators who are looking for a stealthy technique of managing sensitive servers (like your enterprise firewall console or IDS).

Expert vs. Expertise: Computer Forensics and the Alternative OS – No longer a dark and mysterious process, computer forensics have been significantly on the scene for more than five years now. Despite this, they have only recently gained the notoriety they deserve.

[ Linux Advisory Watch ] – [ Linux Security Week ] – [ PacketStorm Archive ] – [ Linux Security Documentation ]

Linux Advisory Watch is a comprehensive newsletter that outlines the security vulnerabilities that have been announced throughout the week. It includes pointers to updated packages and descriptions of each vulnerability.
[ Subscribe ]