Security Training
Security Certification
Internet Storm Center
Cyber Security Graduate School
Security Awareness Training
Penetration Testing
Industrial Control Systems
Cyber Defense Foundations
IT Audit
Computer Forensics
Software SecurityStandards
Featuring 19 Papers as of October 8, 2012
-
Systems Engineering: Required for Cost-Effective Development of Secure Products
Dan Lyon - October 8, 2012
Security of data and systems is critical to consider during development of a complex system, and by taking a systems approach, secure design can be achieved in a cost effective manner.
-
Security for Critical Infrastructure SCADA Systems
Andrew Hildick-Smith - August 24, 2005
Supervisory Control and Data Acquisition (SCADA) systems and other similar control systems are widely used by utilities and industries that are considered critical to the functioning of countries around the world.
-
Information Security Gets a Seat at the Table
Kent Nabors - April 8, 2004
A company is a statement of faith between suppliers, employees, investors and customers. If any one or more of those groups decides they don't want to play any more, then the game is over. If a bank loses critical customer information because of a security failure, a financial risk arbitrage maneuver won't help.
-
An Introduction to Certification and Accreditation
Joseph Zadjura - November 19, 2003
This paper examines the C&A process, offers guidance to helps define the Security Requirements, identify responsible parties and their roles, providing a basic understanding of C&A.
-
Organizational Information Security from Scratch - A Guarantee for Doing It Right
Patrick Jones - October 31, 2003
The purpose of this document is to provide an overview of an information security infrastructure and a strategy for implementing it.
-
HIPAA Security Standards v1.2d
Daniel Fagin - October 31, 2003
The focus of this paper is the creation of certain baseline information security standards to protect electronic medical records.
-
The OSI Model: An Overview
Rachelle Miller - October 31, 2003
This paper provides an overview of the Open Systems Interconnection (OSI) reference model which defines a hierarchical architecture that logically partitions the functions required to support system-to-system communication.
-
The NSA: A Brief Examination of the "No Such Agency"
Steven Bennett - October 31, 2003
This paper introduces the National Security Agency (NSA) to the reader and discusses some of the key technologies, methods, and issues that relate to its mission.
-
The Common Criteria ISO/IEC 15408 - The Insight, Some Thoughts, Questions and Issues
Ariffuddin Aizuddin - October 31, 2003
This paper provides an overview of an international effort called Common Criteria (CC), an IT Security evaluation methodology, developed to define and facilitate consistent evaluations of security products and systems, fostering international recognition and trust in the quality of security products and systems throughout the global economy.
-
Multilevel Security Networks: An Explanation of the Problem
Gary McKerrow - October 31, 2003
This paper addresses the current efforts within the Department of Defense (DoD) to develop a Multi-Level Security (MLS) system, although, the same methodology and practice can be applied to other networks with similar requirements.
-
Collaborative Security Strategies in an Outsourced, Cross-Agency Web System
Roopangi Kadakia - October 31, 2003
This analysis will look at the Certification and Accreditation models, Risk assessment frameworks, and risk management strategies, which can be used in combating new challenges in existing processes and standards.
-
Internal SLA (Service Level Agreements) for Information Security
Eric Hansen - October 31, 2003
The purpose of this paper is to advocate for the establishment of internal SLAs between the Information Technology team and the Information Security team.
-
Securing Sensitive Data: Understanding Federal Information Processing Standards (FIPS)
Thomas Kenworthy - October 31, 2003
This paper will define FIPS (Federal Information Processing Standards), identify FIPS approved encryption algorithms, and examine some different vendor solutions and their use of these approved algorithms.
-
A Survey Of Trusted Computing Specifications And Related Technologies
Ricard Kelly - October 31, 2003
This paper seeks to survey the key points of these technologies and provide a framework for suggesting whether a TCPA/TCG or NGSCB architecture will improve security in an environment and where it may reduce security.
-
TEACH, the DMCA and Distance Education
Katie Flowers - October 31, 2003
By reviewing the technological requirements of TEACH, the titles of the DMCA and the history of both acts this paper will show that while TEACH, to date, has not been publicly recognized as an amendment to the DMCA it can truly be viewed as such in the United States with regards to the issue of distance education.
-
Common Criteria and Protection Profiles: How to Evaluate Information
Kathryn Wallace - October 31, 2003
The purpose of this paper is to discuss the standards of Common Criteria and the security framework provided by the Common Criteria.
-
The Trusted PC: Current Status of Trusted Computing
Christopher Hageman - October 31, 2003
This paper, focusing on the Trusted Computing Group's standards, will provide an overview of trusted computing as it stands today: its methods, applications, possible pitfalls and current implementations.
-
The HIPAA Final Security Standards and ISO/IEC 17799
Sheldon Borkin - October 31, 2003
This paper provides a detailed analysis comparing HIPAA Final Security Standards and ISO/IEC 17799, along with an approach to compliance with both standards.
-
Protection Profile, A Key Concept in The Common Criteria
Nor Ramli - October 31, 2003
This paper will give a description of the roadmap to the Common Criteria (CC) that basically explains the distinct but related parts and how three key CC user groups namely the consumers, developers and evaluators use them.
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.
All papers are copyrighted. No re-posting or distribution of papers is permitted.
Masters This paper was created by a SANS Technology Institute student as part of their Master's curriculum.
