There are many organizations that provide useful information for security
professionals. These organizations provide information on detecting and
responding to both established and emerging information security threats.
Information about operating system weaknesses, best practices for security, and
security training and certification information is also available. Independent
security evaluations have arisen to provide organizations with an unbiased and
objective review of security products. For example, Common Criteria, FIPS 140,
and ICSA are some of the independent certifications and evaluations
.
CERT/CC
The CERT Coordination Center (CERT/CC) is a reporting
center for Internet security issues. The CERT/CC plays a major role in
coordinating responses to Internet security threats. The CERT/CC is located at
the Software Engineering Institute (SEI) operated by Carnegie Mellon
University.
US-CERT
The United States Computer Emergency
Readiness Team (US-CERT) is a partnership between the Department of Homeland
Security and the public and private sectors. US-CERT was established in 2003 to
protect the nation's Internet infrastructure by coordinating defense
against and responses to Internet security threats.
US-CERT is
responsible for:
- analyzing and reducing cyber threats and vulnerabilities
- disseminating cyber threat warning information
- coordinating incident response activities
SANS Institute
The SysAdmin, Audit, Network, Security (SANS)
Institute was established in 1989 as a cooperative research and education
organization. The SANS Institute develops and maintains research documents
about various aspects of information security. These documents are available at
no cost. SANS also operates the Internet Storm Center, an early warning system
for Internet security issues.
(ISC)2
The International Information Systems Security
Certification Consortium, Inc. (ISC)2 is a non-profit organization
that maintains a collection of industry best practices for information
security. The (ISC)2 has created two certifications that align to
these best practices, the Systems Security Certified Practitioner (SSCP) and
the Certified Information Systems Security Professional (CISSP).
Common Criteria
The Common Criteria is an international standard
for evaluating IT security. It was developed by a consortium of fourteen
countries to replace a number of existing country-specific security assessment
and was intended to establish a single high-quality standard for international
use. Although there are seven security levels defined for the Common Criteria
evaluation process, Evaluation Assurance Level 4 (EAL4) is the highest
universal evaluation level implemented under the Common Criteria today
.
FIPS
The Federal Information Processing Standard (FIPS) 140 is a
US and Canadian Government standard that specifies security requirements for
cryptographic modules. FIPS 140 has four levels of assurance: Level 1 is the
lowest and Level 4 is the most stringent. Each level builds upon the one below
it, so a Level 2 certification means that a product meets the requirements for
both Level 1 and Level 2
.
ICSA
ICSA Labs tests firewalls against a standard set of
functional and assurance criteria elements. ICSA Labs is presently testing
firewalls against the Modular Firewall Product Certification Criteria version
4.0. ICSA also test VPN devices for IPSec interoperability. IPSec
interoperability testing validates a product or set of products that use
cryptography to provide effective security services. ICSA Certification exists
to provide a set of measurable, public-domain standards for commercial security
products.