Schneier on Security

Davi Ottenheimer • May 18, 2006 11:22 PM

NIST special publications often have some useful information, although extremely specific (vendor lists?) and not far afield of other standard sources already available.

Speaking of which, have you heard one of these conversations lately?

A: “Hi, have you read the latest NIST SP?.”

B: “No, sorry, I speak ISO.”

A: “Oh, right, you have offices outside the US. I also know a little CObIT and some SANS. Can you speak in those?”

B: “Actually, I do speak a little SANS, but it’s just basic stuff and hardly a standard. These days we’re mostly talking COSO and some PCI DSS around here.”

A: “Hmmm, well let me try and teach you our internal security standards, since they are a blend and much better than all that open stuff.”

As far as the pagination and editorial comments, I’m surprised no one has pointed out that this is a giant 2MB PDF. Aside from one (questionable*) image, there does not appear to be much reason for such a bloated text doc even at 65 pages.

I was also a little surprise at how little Windows logging was discussed. Here’s a typical phrase: “Section 3.3 discusses syslog in detail and provides examples of syslog log entries. Other OS logs, such as those on Windows systems, are stored in proprietary formats.”

Um, ok, so we should just ignore those, right?

Maybe it’s just me but I noted over 100 syslog specific comments (many interesting and helpful) and less than a couple related to Windows.

• Illustration of the word consolidation is nice, but hardly seems necessary. I think just about anyone can imagine what it looks like, even if you’re trying to show that data from many systems should be consolidated to few, with a monitoring system attached. Maybe they could have illustrated what it looks like when a sysadmin is told they will have to now figure out how to consolidate hundreds or thousands of log files, and then be able to parse them, all the while doing their regular duties (insert image of smoke-from-ears here).