Resources

US Government Resources

NOTE: Some of these, such as NIST documents, may be listed below in topical areas.

US Computer Emergency Readiness Team — http://www.us-cert.gov/
List of NIST Information Security Publications — http://csrc.nist.gov/publications/PubsTC.html
NICCS – National Initiative for Cybersecurity Careers and Studies – http://niccs.us-cert.gov/

Ethical Hacking Educational Resources

Following is a list of Web sites that provide learning resources for ethical hacking.

Learn How To Hack – Ethical Hacking Resources | HackerOne

https://www.hackerone.com/blog/resources-for-new-hackers

The Ultimate Guide to Ethical Hacking – InfoSec Resources

https://resources.infosecinstitute.com/category/certifications-training/ceh/ethical-hacking-overview/#gref

Ethical Hacking Resources | IEEE Innovation at Work

https://innovationatwork.ieee.org/ethical-hacking/

Top Resources To Learn Ethical Hacking

https://hackwarenews.com/top-resources-to-learn-ethical-hacking/

General Resources

A Risk Management Reading List — http://fcw.com/articles/2012/10/23/risk-management-reading-list-nist.aspx
US Computer Emergency Readiness Team — http://www.us-cert.gov/
IT Security White Papers — http://www.itwhitepapers.com/technology/security
Risk Assesment
Computer emergency lines
Airport Security

Security Blogs

Bruce Schneier Crypt-O-Gram — http://www.schneier.com/crypto-gram.html
Krebs on Security — http://krebsonsecurity.com/

Planning for Security and Contingencies

· Contingency Planning Guide for Federal Information Systems — http://csrc.nist.gov/publications/nistpubs/800-34-rev1/sp800-34-rev1_errata-Nov11-2010.pdf

· Guide for Developing Security Plans for Federal Information Systems — http://csrc.nist.gov/publications/nistpubs/800-18-Rev1/sp800-18-Rev1-final.pdf

· Computer Security Incidents: Assessing, Managing, And Controlling The Risks – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/b-01-04.pdf

· Techniques for System and Data Recovery – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/04-02.pdf

· System and Network Security Acronyms and Abbreviations — http://csrc.nist.gov/publications/nistir/ir7581/nistir-7581.pdf

· Guide to Integrating Forensic Techniques into Incident Response — http://csrc.nist.gov/publications/nistpubs/800-86/SP800-86.pdf

· Office of the President of the United States: International Strategy for Cyberspace — http://www.whitehouse.gov/sites/default/files/rss_viewer/international_strategy_for_cyberspace.pdf

Information Security Policy

Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) — http://csrc.nist.gov/publications/nistpubs/800-122/sp800-122.pdf
Information Security Guide For Government Executives — http://csrc.nist.gov/publications/nistir/ir7359/CSD_ExecGuide-booklet.pdf
Commercial product – Security Policies Made Easy — http://www.informationshield.com/ispmemain.htm

Developing the Security Program

Building an Information Technology Security Awareness and Training Program — http://csrc.nist.gov/publications/nistpubs/800-50/NIST-SP800-50.pdf
An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule — http://csrc.nist.gov/publications/nistpubs/800-66-Rev1/SP-800-66-Revision1.pdf
implementing an Effective IT Security Program (SANS) — http://www.sans.org/reading_room/whitepapers/bestprac/implementing-effective-security-program_80
Creating the Effective Security Awareness Program — http://www.sans.org/reading_room/whitepapers/awareness/creating-effective-security-awareness-program-demonstration_1079
Building a Security Awareness Program — http://www.gideonrasmussen.com/article-01.html
Success Strategies for Security Awareness — http://www.techrepublic.com/article/success-strategies-for-security-awareness/5193710

Security Management Models

Minimum Security Requirements for Federal Information and Information Systems — http://csrc.nist.gov/publications/fips/fips200/FIPS-200-final-march.pdf
Standards for Security Categorization of Federal Information and Information Systems — http://csrc.nist.gov/publications/fips/fips199/FIPS-PUB-199-final.pdf
An Overview Of The Common Criteria Evaluation And Validation Scheme – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/10-00.pdf

Security Management Practices

Guide for Security-Focused Configuration Management of Information Systems — http://csrc.nist.gov/publications/nistpubs/800-128/sp800-128.pdf
Technical Guide to Information Security Testing and Assessment — http://csrc.nist.gov/publications/nistpubs/800-115/SP800-115.pdf
IT Security Metrics – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/bulletin08-03.pdf
Information Security Continuous Monitoring for Federal Information Systems and Organizations — http://csrc.nist.gov/publications/nistpubs/800-137/SP800-137-Final.pdf
Security Guide for Interconnecting Information Technology Systems — http://csrc.nist.gov/publications/nistpubs/800-47/sp800-47.pdf
Guide for Applying the Risk Management Framework to Federal Information Systems: A Security Life Cycle Approach — http://csrc.nist.gov/publications/nistpubs/800-37-rev1/sp800-37-rev1-final.pdf
Comparison of Security Management Practices — http://www.giac.org/cissp-papers/407.pdf
Information Security Program Guide for State Agencies – California Office of Information Security and Privacy Protection — http://www.sans.org/reading_room/whitepapers/bestprac/implementing-effective-security-program_80

Risk Management: Identifying and Controlling Risk

Recommended Security Controls for Federal Information Systems and Organizations — http://csrc.nist.gov/publications/nistpubs/800-53-Rev3/sp800-53-rev3-final_updated-errata_05-01-2010.pdf
Specification for Asset Identification 1.1 — http://csrc.nist.gov/publications/nistir/ir7693/NISTIR-7693.pdf
Secure Hash Standard (SHS) — http://csrc.nist.gov/publications/fips/fips180-4/fips-180-4.pdf
GIAC G2700 Certified ISO-27000 Specialist — http://www.giac.org/certification/certified-iso-27000-specialist-g2700
ISO-2700 Central — http://www.17799central.com/
History of ISO-27000 Standards — http://www.27000.org/thepast.htm
Many resources for IST-27000 Standards — http://www.iso27001security.com/html/iso27000.html

ESIS – Open Source Executive Security Information System – http://esis.sourceforge.net/ESIS/Home.html
Security for Cloud Computing – 10 Steps to Ensure Success – http://www.cloud-council.org/Security_for_Cloud_Computing-Final_080912.pdf
Comparison between ISO-27005, Octave and NIST SP 800-30 – http://sisainfosec.com/blog/comparison-between-iso-27005-octave-nist-sp-800-30-2/

Why the Emerging ISO-27000 Series are vital for Business Resilience — http://www.personal.psu.edu/gms/sp13/456/about%20iso-27K%20Poole.pdf
GIAC G2700 Certified ISO-27000 Specialist — http://www.giac.org/certification/certified-iso-27000-specialist-g2700
ISO-2700 Central — http://www.17799central.com/
History of ISO-27000 Standards — http://www.27000.org/thepast.htm
Many resources for IST-27000 Standards — http://www.iso27001security.com/html/iso27000.html
ISO/IEC 27001 2013 Plain English Introduction – http://www.praxiom.com/iso-27001-intro.htm
ISO/IEC 27002 2013 Old versus New – http://www.praxiom.com/iso-27002-old-new.htm
ISO/IEC 27002 2013 Translated into Plain English – http://www.praxiom.com/iso-27002.htm
Moving from ISO/IEC 27001:2005 to ISO/IEC 27001:2013 – http://www.bsigroup.com/LocalFiles/en-GB/iso-iec-27001/resources/BSI-ISO27001-transition-guide-UK-EN-pdf.pdf

Vulnerabilities and Threats

The Common Vulnerability Scoring System (CVSS) and Its Applicability to Federal Agency Systems — http://csrc.nist.gov/publications/nistir/ir7435/NISTIR-7435.pdf
Computer Attacks: What They Are and How to Defend Against Them – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/05-99.pdf

· Guide to Malware Incident Prevention and Handling — http://csrc.nist.gov/publications/nistpubs/800-83/SP800-83.pdf

· National Vulnerability Database: Helping Information Technology System Users And Developers Find Current Information About Cyber Security Vulnerabilities – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/b-Oct-05.pdf

· Creating A Program To Manage Security Patches And Vulnerabilities: NIST Recommendations For Improving System Security – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/b-02-06.pdf

· Norton Cybercrime Report 2011 — http://us.norton.com/content/en/us/home_homeoffice/html/cybercrimereport/

Protection Mechanisms

Guidelines for Securing Wireless Local Area Networks (WLANs) — http://csrc.nist.gov/publications/nistpubs/800-153/sp800-153.pdf
Guidelines on Security and Privacy in Public Cloud Computing — http://csrc.nist.gov/publications/nistpubs/800-144/SP800-144.pdf
Guide to Intrusion Detection and Prevention Systems (IDPS) — http://csrc.nist.gov/publications/nistpubs/800-94/SP800-94.pdf
Guidelines on Firewalls and Firewall Policy — http://csrc.nist.gov/publications/nistpubs/800-41-Rev1/sp800-41-rev1.pdf
Biometrics – Technologies for Highly Secure Personal Authentication – ITL Security Bulletin — http://csrc.nist.gov/publications/nistbul/05-01.pdf
Guide to SSL VPNs — http://csrc.nist.gov/publications/nistpubs/800-113/SP800-113.pdf
Advanced Encryption Standard — http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations — http://csrc.nist.gov/publications/nistpubs/800-52/SP800-52.pdf

· Federal Agency Use of Public Key Technology for Digital Signatures and Authentication — http://csrc.nist.gov/publications/nistpubs/800-25/sp800-25.pdf

· Guideline for Implementing Cryptography in the Federal Government — http://csrc.nist.gov/publications/nistpubs/800-21-1/sp800-21-1_Dec2005.pdf

· DoD Cyber Protect Network Security Game — http://iase.disa.mil/eta/cyber-protect/launchpage.htm

· TLS – Transport Layer Security — http://en.wikipedia.org/wiki/Transport_Layer_Security

· SSL Certificates — https://www.globalsign.com/ssl-information-center/what-is-an-ssl-certificate.html?gclid=CI3YutnD46wCFcp65Qoduzywnw

· NIST.org Free Online Antivirus, Spyware and Firewall reviews — http://www.nist.org/news.php?extend.93

Personnel and Security