Charlie Moody leaned back in his chair. It was Monday morning, the first workday after the biggest conversion weekend in the implementation of Sequential Label and Supply's information security project. Charlie had just reviewed the results. So far, everything had gone according to plan. The initial penetration tests run on Sunday afternoon were clean, and every change request processed in the past three months had gone through without any issues.
Charlie was eager for the routine to return to normal, that is, to the way things had been before the attack on the company's network had triggered the changes of the past few months.
Kelvin Urich tapped on the open door of Charlie's office. "Hey, Charlie," he said, "have you seen the e-mail I just sent? There's an urgent vulnerability report on BUGTRAQ about the version of UNIX we use. The vendor just released a critical patch to be applied right
away. Should I get the system programming team started on it?"
"Absolutely! Get them to pull the download from the vendor's FTP site as soon as they can," said Charlie. "But before they install it on the production systems, be sure they try it out on the test lab servers. If that goes okay, have them patch the servers for the HQ development team. Oh, and could you get these change orders into change control ASAP, and add the production server change request to the paperwork for the overnight change window?"
"I'll get right on it," Kelvin said.
After Kelvin left, Charlie pulled up BUGTRAQ on his PC. He was reading about the new vulnerability when there was another knock on his door. It was Iris Majwubu.
"Hi, Charlie," Iris said. "Got a second?"
"Sure, Iris. How have you been? Settling in with Kelvin's team okay?"
She smiled and nodded. "Yeah, they're a good group. They have me studying the documentation trail from the time before the security program was implemented. I came to see you about the reassessment of the information asset inventory and the threat-vulnerability
update that you asked for."
Charlie was confused for a second, but then he remembered what Iris was referring to. "Oh,right," he said, with a slight grimace. "Sorry-I had put the quarterly asset and threat review out of my mind while we were busy implementing the blueprint. I suppose it's time
to start planning for the regular reviews, isn't it?"
Iris handed him a folder and said, "Here's the first draft of the plan for the review project.
Kelvin has already seen it, and he suggested I review it with you. Could you take a look and let me know when you would like to go over it?"
Remember from the beginning of this book how Amy's day started? Now imagine how it could have been:
For Amy, the day began like any other at the Sequential Label and Supply Company (SLS) help desk. Taking calls and helping the office workers with computer problems was not glamorous,but she enjoyed the work; it was challenging and paid pretty well. Some of her friends in the industry worked at bigger companies, some at cutting-edge tech companies, but they all agreed that technology jobs were a good way to pay the bills.
The phone rang, as it did on average about four times an hour, and about 28 times a day.
The first call of the day, from a worried user hoping Amy could help him out of a jam,seemed typical. The call display on her monitor gave some of the facts: the user's name, his phone number, the department in which he worked, where his office was on the company
campus, and a list of all the calls he'd made in the past. "Hi, Bob," Amy said. "Did you get that document formatting problem squared away?"
"Sure did, Amy. Hope we can figure out what's going on this time."
"We'll try, Bob. Tell me about it."
"Well, I need help setting a page break in this new spreadsheet template I'm working on," Bob said.
Amy smiled to herself. She knew spreadsheets well, so she would probably be able to close this call on the first contact. That would help her call statistics, which was one of the ways her job performance was measured.
Little did Amy know that roughly four minutes before Bob's phone call, a specially programmed computer out at the edge of the SLS network had made a programmed decision. This computer was generally known as postoffice.seqlbl.com, but it was called the "e-mail gateway" by the networking,messaging, and information security teams at SLS. The decision it had made was just like many thousands of other decisions it made in a typical day-that is, to block the transmission of a file that was attached to an e-mail addressed to [email protected]. The gateway had determined that Bob didn't need an executable program that had been attached to that
e-mail message, which (the gateway also determined) originated from somewhere on the Internet but contained a forged reply-to address from Davey Martinez at SLS. In other words, the gateway had delivered the e-mail to Bob Hulme, but not the attachment.
When Bob got the e-mail, all he saw was that another unsolicited commercial e-mail with an unwanted executable had been blocked. He had deleted the nuisance message without a second thought.
While she was talking to Bob, Amy looked up to see Charles Moody walking calmly down the hall. Charlie, as he liked to be called, was the senior manager of the server administration team and also the company's chief information security officer. Kelvin Urich and Iris Majwubu were trailing behind Charlie as he headed from his office to the door of the conference room. Amy thought, "It must be time for the weekly security status meeting."
She was the user representative on the company information security oversight committee,so she was due to attend this meeting. Amy continued talking Bob through the procedure for setting up a page break, and decided she would join the information security team for coffee and bagels as soon as she was finished.
Questions:
1. What area of the SP 800-100 management maintenance model addresses the actions of the content filter described here?
2. What recommendations would you give Sequential Label and Supply Company for how it might select a security management maintenance model?