When I started following blogs a couple of years ago I discovered several blogger's who impressed me with their knowledge of various aspects of security. I thought I had hit a gold mine in finding their blogs. Now I had places to go and get information on various topics. I could even ask them questions and usually get a reply from them. Towards the end of 2006 a few of them started talking about a new community that was starting up. It offered a place to post your thoughts, questions, comments, ideas, etc and interact with other security professionals. So I decided to check it out and saw a few things that I liked.
- The boards weren't stuffed to the gills with questions so it made it easy to find what you were looking for.
- The boards are kept organized. There aren't hundreds of user created main topic areas that clutter the boards.
- When you posted a question or idea others chimed in with comments that were meaningful. There is no name calling or belittling others. If someone does do that their comment is removed and they may soon follow.
- You actually saw who you were interacting with and not some cryptic screen name. This allowed me to have a sense or whether or not I could trust them. All members are required to register with and use their real names. (OK, so we don't do ID checks on everyone but you get the picture)
These are just a few of the things that I really liked. I then hooked up via email with Michael Santarcangello who could be called the "Father of the Security Catalyst Community". I had listened to his podcast and read his blog and liked what he had to say and the way that he thinks. He, like many in the SCC, doesn't think along the same old "best practices" lines that seem to infect many in IT and Security. He thought outside the box and tried to get others to do the same.
That was Jan. 2006 and since joining the SCC I have benefited tremendously. It has provided me a place to get answers, feedback, support and development friendships and networking with other Security Professionals. Lots of people have joined the community and many of them participate regularly in what is going on. I'd like to invite you to stop by and check out what is going on. I'm going to highlight a few of the conversations that have gone on in the recent past and a few of the people who have their own blogs. My goal in this is to give you a little more insight into what the community is all about and entice you to come join us and add your voice to what will become a major voice in security in the future.
Recent SCC Posts of note:
- Rootkits and MBRs - As soon as news of the new (ok, not new but new in the news) MBR Rootkits hit the gang at the SCC jumped on this one. Read what the community has to say about this topic. I personally think that the first response post is packed with wisdom and insight. :)
- ICMP Tunneling - I went back a while on this one because it has some useful information on a topic that we don't hear much about and many people haven't really considered as a threat to our data.
- Value of asp.net web.config file encryption - Here is another topic that isn't very sexy and doesn't get a lot of attention in the media and blogs but that doesn't stop us from discussing it. We all know the importance of web app security but we can't forget the server itself.
- Project Management Training - We all like to stay on top of our game and training and opportunities to learn and improve ourselves is a major focus of the community. Here we discuss how to prepare yourself to be successful in Project Management.
We have lots of blogger's and others who have their own web sites. You can find a complete list of them by clicking on the "members" link from any page in the community and then click on the website column. Many of the names you will recognize right away because they are the "big names" in information security blogging (and usually in their field of specialty also) and some you may not be familiar with but they have great things to say. I wanted to bring a couple of them to your attention.
- Michael Dickey (aka - LonerVamp) blogs at terminal23. Michael caught my attention early on because he has lots of good things to say. He's a Linux guru who understands security and has a great grasp on using linux both to help secure your environment and as your everyday OS. He can get pretty technical so beware. Sometimes he makes my head hurt.
- Adam Dodge has a website called Educational Security Incidents (ESI) where he maintains a ongoing list and discussion of breaches in the .edu space. Those of you who work in the .edu space need to know Adam and his site. Colleges and Universities have their own unique challenges when it comes to information security that most of us don't face. They have to find the balance between the "free flow of data" nature in a university environment and protecting the PII, research and other important data. There are lots of other .edu security gurus in the community that will benefit you greatly if you are in that field.
- Alex Hutton is another blogger that is worth your read. His focus is on Risk Management and he blogs at and maintains a site called Riskanalys.is (yes the .is is correct). Alex usually doesn't talk too technical but don't let that fool you. He knows his stuff from everyday security to the implications of not being compliant to how risk can make or break your company.
Well, that's it. A quick recap of what's going on in the Security Catalysts Community and why you should be involved.
