Information Assurance Model

The McCumber model provides a concise representation of Information Systems Security discipline. The objective was to integrate separate disciplines such as personnel security, computer security, communications security, and operational security into a cohesive Information Assurance model. The model is viewed as both multidisciplinary and multidimensional. The four dimensions of the model are, Information States, Security Services, Security Countermeasures and time.
McCumber INFOSEC Model

mekabay.com/courses/academic/norwich/.../lectures/01_INTRODUCTION.pdf
The interaction of the components is more important than the individual components themselves. The model is a framework for all who are seeking to understand Information Assurance, its dynamic components and how it will protect information in various states.

What is Live CD?

What is a Live CD?
A Live CD is a bootable compact disk that contains its own operating system that allows a user to utilize it in several ways to help them manage major issues or major changes on their desktop or laptop computers. It can be used when there are security issues or there is a need to try a different operating system. It doesn't install anything on your hard disk and it does not make any changes to the computer’s existing operating system, hard drives or files. You just insert the CD into your CD drive and restart the computer. It will boot from the CD and you can start using operating system software on your machine right away. In fact, you can even run a Live CD on a computer which has no hard-disk. All programs run directly from the CD. It doesn't alter your original software so it's convenient for testing or demonstration purposes. The system can return to its previous operating system when the computer is rebooted without the Live CD (Kayne, Pillay, User-ful, Borgohain).
Security Perspective
Consider the scenario of wanting to purchase the top of the line computer (whether laptop or desktop) from an online store. You have chosen the best combination of hardware for your money and you get it shipped. When you receive your new laptop or desktop, you run Live CD and use it as your operating system. You can use the hard disk (if any) as your storage medium. When you log off, you remove the live CD and put it away knowing that if your machine is ever stolen, the data in the internal hard disk is useless to anyone since the entire drive is encrypted with your private key and it is secured as well. You could also save your information on a USB mass storage device. From a corporate security aspect, your read-only CD is safe since it cannot be tampered or infected since it is read only (Pillay, Schaumann).
The origin of the live CD was not a CD at all, but a bootable floppy disk. Many operating system vendors, hardware manufacturers, and anti-virus developer's produced bootable floppy disks with a base operating system to perform functions which were not always possible with an operating system already running. As an example, hard disk manufacturers distributed bootable floppy disks to allow the system user to test their hardware products without having an operating system in the way, and for consistency in testing configurations. Anti-virus software developers provided bootable floppy and CD-ROM disks to allow the user to boot his system in a known safe condition, so any virus infections on their machine would not interfere with the virus testing software. Initially write-protected floppies were used to prevent infection from spreading from the tested system, but before long live CD media was used because they were cheaper to produce and were considerably faster for testing. Also, for the security-conscious user, or for the conscientious-security user, live CDs are useful, among other things for using untrusted hardware, such as public-use PCs at coffee shops, analyzing computers that may have been compromised, recovering data from systems that no longer boot for some reason and running software you'd prefer not to install on your hard disk.
Knoppix
Knoppix is a Debian-based Linux distribution and one of the first Linux live CDs that was available. While the Knoppix distribution is packed with open-source goodness, one of the most popular uses for Knoppix is recovering files from damaged drives. To that end Knoppix is packed with open-source applications for testing disk integrity, recovering files, reading corrupted drives, and more. There are a total of 2,000 programs packed into the disc covering everything from disc recovery to media playback. New technologies make the Knoppix Live CD very versatile and flexible, and there are many things you can do with the Live CD without having to resort to a full-blown hard disk install. You can work mobile. All you need to carry around is a CD and a small USB flash drive to store your settings and configurations. You can start Knoppix from almost anywhere with the same data, settings and even your own installed programs. A hard disk installation on the other hand, will tie you to the disk where you installed it, plus all the possible problems that come with a hard disk install (Knoppix, Fitzpatrick).
Windows Live CD
Microsoft has released a tool for system administrators and all personal computer professionals, the so called Windows Preinstallation Environment (WinPE). It is a modified, short version of the operating system based on the Windows XP kernel. In fact, WinPE lets you boot up your personal computer in a Graphical User Interface (GUI) and at the same time, control the configuration of all your system. You can then format a partition, have access to files on your hard disk or to other computers in your local area network, or use some external devices. if you have the correct drivers (CDR-INF).
Drawbacks
One of the biggest drawbacks of using a Live CD is the speed. Remember, you are running this from RAM so the amount of RAM the machine has (as well as the speed of the CD drive) will determine how fast your Live CD distribution will run. So a machine with low RAM will run poorly. This isn’t such an issue if you are planning on installing immediately. But using the Live CD on a low-RAM machine will be painfully slow. The other drawback was already mentioned, unless you are using a flash drive-based Live distribution, you cannot save data. If you are only testing the distribution out to see if you like it, that’s not a problem (Wallen).
Final Thoughts
Live CDs are here to stay. They have many uses and few drawbacks. If you are hesitant to use a Live CD because you don’t want to lose data, you shouldn’t worry about that (unless you accidentally click the installation button and accidentally click through all of the steps to install the operating system (Wallen).
1. Kayne, R. (2009) http://www.wisegeek.com/what-is-a-live-cd.htm
2. Pillay, Harish. (2005) http://www.freesoftwaremagazine.com/articles/live_cds
3. Schaumann, Jan. (2006) http://www.netbsd.org/~jschauma/nblivecds.pdf
4. TECH FAQ. http://www.tech-faq.com/live-cd.shtml
5. User-ful. (2208) http://support.userful.com/wiki/index.php/FAQs/Live_CD
6. Borgohain, Bolin. http://blogs.siliconindia.com/bolinborgohain/What_is_a_Live_CD-bid- axPw6Er43009378.html
7. Knoppix. (2008) http://www.knoppix.net/wiki/Live_CD_Tips
8. CDR-INF. (2005) http://www.cdrinfo.com/Sections/Reviews/Specific.aspx?ArticleId=15113
9. Wallen, Jack. (2009) http://www.ghacks.net/2009/02/18/get-to-know-linux-live-cd/
10. Bauer, Mick. (2008) http://www.linuxjournal.com/article/10038
11. Fitzpatrick, Jason. (2009) http://lifehacker.com/5157811/five-best-live-cds

Journal Assignment One - ID Theft

I selected my article because it is a current event that should not have happened. It is important because corporations are still too lax and complacent when it comes to Information Systems Security. The things that really intrigued me about the article “Army of 950 identity thieves marched through Manhattan’ 2 commanders indicted” was the involvement of so many people in the theft, how well it was organized, how they were able to avoid law enforcement, the amount of the theft ($2 million), and that they got away with it for almost 16 months. They were able to steal right under the eyes of nearly every bank in Manhattan. Not only that, but they were able to steal from the New York Police Department. How can we be able to gain or win the trust of these major banks with our money when they are all not capable of taking identity theft seriously? They are not doing enough to implement strong security measures that can prevent identity theft or at least capture the theft as it is happening.
How can so many people get involved with this crime? Was their belief in the myth that they are not stealing from people but from big businesses that in their mind makes it all right? Are they thinking it is a white collar crime and they will get off easy? What is the harm in bank tellers stealing account information and giving it to someone else? Information is intangible and is not of any value to most people. Banks deal with billions of dollars so who is going to miss a couple of million?
These thefts by this very well organized army of thieves happened between February 2007 and February 2009. We are in the 21st century where we have advanced considerably in technology. So what happened? Back in the 60’s when the infamous Frank Abagnale (Depicted in movie “Catch Me If You Can”) passed bad checks totaling $2.5 million; it took law enforcement a while to capture him. At the time of Abagnale’s great bad check spree, our technology to help identify and track this type of fraud was nonexistent. It was very difficult and understandable that someone was able to easily get away with it. Today, because of so many technological advances, we have developed so many security tools that can be implemented to stop identity theft and bank fraud. From my perspective and from what I have learned so far, it is the management and human factor in employee personnel in these organizations who are not taking it seriously. They are not doing their homework, they are not seeking the right help, and they are certainly not paying attention to their employees.