Network Frontiers, LLC

Information Security vs. Information Assurance

2007-04-17T17:10:25Z

We have to stop improperly referring to information assurance as information security.

Yes, I know that many of us who grew up in the world of ISO 17799 have based our language on the language found there, where the ISO team bulked information confidentiality, information integrity, and information availability into one group and called it information security. But security is only one facet of protecting information.

Security still applies, but there's more to it.
If you think about securing (locking down) information, then yes, ensuring privacy and soundness are about security. Accessibility isn't as much about locking down as making available. But the thought pattern of information security doesn't bring to the forefront of our minds the additional aspects of assurance through confidence based on measurement metrics and accountability reporting. And that is why I'd like all of us to change our language and talk more about information assurance than information security.

The move toward information assurance is found in organizational accountability
We will begin changing our thought patterns and changing our language as we begin to re-think security in terms of measured confidence in our accountability. And we can only do that when we start to add the proper metrics and reporting to our information assurance plans. And that's another thing that ISO 17799 left out -- metrics and reporting of accountability for compliance with its own ruleset.

Information assurance is about defining rules for maintaining information privacy, protecting information soundness, and ensuring information accessibility by mandating that someone (or multiple people) are held accountable that organizational policies, standards, and procedures are created to match the mandatory regulatory controls, and are properly paired to the information systems within the organization.

It is assurance through accountability that we want to espouse.

That's the mindset we want to build.

The Compliance Glossary

2006-11-13T03:30:58Z

The Language of Compliance: a glossary of acronyms, terms, and extended definitions

Have you ever read a regulation, standard, or best practice and wondered what they were talking about?

Would you like to know the difference between personal data, electronic protected health information, confidential information, and sensitive information?

Would you like the definition of materiality? How about what a regulation, standard, and safe harbor really are?

If your organization is involved with compliance at all, then this is the glossary book for you.

We've gone through every major compliance and IT related glossary we could find and then harmonized all of the terms so that you know when this regulation is calling for "confidentiality" and that standard is talking about "confidentiality," what they both really mean.

This book has more terms in it than any other regulatory compliance glossary. In addition, it has references to where each of the terms can be found, as well as a great many "spotlight definitions" that add more information to the terms and really do make them all more understandable.

Click HERE to go to the book's web page, or HERE to order it from Amazon.

Have you checked out the Unified Compliance Framework?

2006-11-13T03:22:58Z

A lot of the work that we are currently doing has a lot to do with compliance, and is tied directly to the Unified Compliance Framework. If your organization is involved with compliance efforts at all, you should at least check out the site. It can be found by clicking HERE.

Compliance mapping and documentation

2006-10-08T08:27:21Z

This service works with your team to identify and and document your organizaitonal compliance framework and will create the reports necessary for you to demonstrate compliance for your various auditors. We will work with your team to ensure that you have properly gathered all of the necessary rules that you must follow, and will map the requirements for those rules to your existing processes, policies, and procedures as well as any authoritative attestations, assessments, and reports from external and internal auditors. We will then cross reference all known regulatory requirements with existing internal controls, eliminating duplicate compliance requirements in the process.

Benefits

Speeds up the documentation of your compliance framework
Aligns your framework with existing internal policies and controls
Drastically reduces overhead by eliminating duplicate regulatory requirements

What we'll deliver

Detailed report (and executive summary) mapping compliance status with internal controls
Detailed report (and executive summary) mapping internal controls to existing evidence

What you'll need to provide

Access to key managers for support in documentation collection
Working team participation in control mapping and final review

Scope

Engagement determined by number of applicable business units, regulatory requirements, systems, internal controls, and evidence data sources

Timeframe

Determined largely by scope, with most engagements running anywhere from 2 to 8 weeks

Cost

Billing is based upon time and materials

If interested, contact Lynn Heiberger at 510 835 2415, ext 111, or e-mail her by clicking HERE.

Privacy Policy

2006-09-26T20:36:34Z

Network Frontiers and Shaser-Vartan have developed these global information practices to assure that your privacy is respected and your personal data is protected. Our Privacy Policy discloses Network Frontiers and Shaser-Vartan's online information practices for handling personal and non-personal information, which is meant to comply with applicable local laws and regulations. Please read this Privacy Policy carefully before you use any of Network Frontiers and Shaser-Vartan's web sites.

How your information is used

Network Frontiers and Shaser-Vartan will not sell, rent, loan or lease your personally identifiable information to others unless we have your permission or are required by law to do so. Network Frontiers and Shaser-Vartan will not use or share the personally identifiable information that you provide to us online in ways unrelated to those described herein without first letting you know and offering you a choice to opt out.

Because Network Frontiers and Shaser-Vartan operate globally, we may need to share your personal information with our worldwide business units. We will only share your information with other Network Frontiers and Shaser-Vartan entities (including subsidiaries and affiliates) and/or business partners who are acting on our behalf to provide the necessary service or information requested by you, to consolidate data storage, or to simplify the management of customer information. Such Network Frontiers and Shaser-Vartan entities and/or business partners are governed by our Privacy Policy with respect to the use of this data and are bound by appropriate confidentiality agreements.

If you have any problems exercising your choice to opt out, please contact us at info@netfrontiers.com.

Important Note for European Visitors

For those of you visiting us from the European Economic Area, please note that Network Frontiers and Shaser-Vartan may transfer your personally identifiable data outside the European Economic Area for use for any of the purposes described herein. By using our web site and providing us with your personal data, you consent to such transfer of your personal data.

Information We Collect

Non-personally Identifiable Information

As a visitor to our Site, you can engage in many activities without providing any personal information. We do, however, collect and aggregate information indicating, among other things, which pages were visited, the order in which they were visited, and which hyperlinks were "clicked" with. Such information is not linked to any personally identifiable information. The non-personally identifiable information we collect help us identify the most popular areas of our Site and determine the effectiveness of our promotional activities.

Cookies

Cookies are text files that store some information on your computer's hard drive and allow our systems to recognize your browser. Cookies collect information like IP addresses, operating systems and browser software, but they do not collect any personal information. Cookies let you customize your experience at our Site. We also use cookies to record anonymous information pertaining to particular web pages viewed, which helps us in analyzing trends, tracking user's movement, and gathering broad demographic information for aggregate use. In this effort, we also use measurement technologies from our business partners to assist us in gathering and analyzing that data.

Personally Identifiable Information

At some Network Frontiers and Shaser-Vartan sites, you can order products or Services, register for materials, make requests, download software or documentation, enter contests, vote in polls or otherwise express an opinion, subscribe to one of our services, such as our online newsletters, Webinars, or participate in one of our online forums, discussion groups or communities. The types of personally identifiable information that may be collected at these pages include: name, address, e-mail address, telephone number, fax number, credit card information, and information about your interests in and use of various products, programs, and services. Data collected online may also be combined with information you provide when you register for other offline Network Frontiers and Shaser-Vartan products and services. Network Frontiers and Shaser-Vartan uses your information to better understand your needs and to provide you with better service.

Surveys and Promotions

From time to time our Sites may request information from you via surveys or contests. Participation in these surveys or contests is completely voluntary and you have a choice whether or not to disclose any information. Information requested may include contact information, such as your name and your shipping address, to notify the winner(s) and demographic information, such as your age for eligibility purposes. Survey information will be used for purposes of monitoring or improving the use and satisfaction of our site.

Mailing Lists

Network Frontiers and Shaser-Vartan occasionally provides the opportunity for visitors to supply their email address for the purpose of receiving a specific newsletter or product information. These email addresses will only be used for this purpose and will never be shared with unaffiliated third parties unless you have provided your consent for us to do so. At a minimum, we will always give you the opportunity to opt out of receiving such materials. In addition, where applicable, we will follow all local requirements, such as allowing you to opt in before receiving unsolicited contact.

How We Protect Your Information

To prevent unauthorized access or disclosure, to maintain data accuracy and to ensure the appropriate use of information, we have put into place physical, electronic and managerial procedures to safeguard the information that we collect online. We use encryption when collecting or transferring data such as credit card information.

Access To Your Information

You have the right to access and correct your personal information at any time. To review, update or make changes to your personal information, please contact us at info@netfrontiers.com.

Children's Information

Network Frontiers and Shaser-Vartan does not target its web sites to children, and we will never knowingly collect personally identifiable information from children. If we become aware that a subscriber is under the age of 18 and has registered, we will remove their personally identifiable information from our files.

Third Party Web Sites

Please note that our Privacy Policy only applies to sites controlled by Network Frontiers and Shaser-Vartan and links to third party web sites are provided solely as a convenience to you. You are advised to check the privacy policies of those sites before providing your personal information to them. Network Frontiers and Shaser-Vartan has not reviewed all of these third party web sites, does not control and is not responsible for any of these sites, their content or their privacy policies. Thus, Network Frontiers and Shaser-Vartan does not endorse or make any representations about these sites, or any information, products or other materials that may be found there.

Contacting Us

We value your opinions. If you have any questions or comments about our Privacy Policy, please contact us at info@netfrontiers.com.

Front Page Entry

2006-09-26T19:20:22Z

Regulatory compliance does indeed seem to most of us like one big maze of uncertainty and doubt. But it doesn't have to be that way.

We're here to make compliance easier for your staff, as well as your checkbook.

Don't be fooled by consulting firms that tell you that regulatory compliance has to be complicated. Yes, if you are "in the thick of it" as they say, it might very well seem complicated. But it doesn't have to be that way.

Let us take you out of the maze and give you a bird's eye view of the problems and pitfalls of regulatory compliance. We know the way out of the maze because we know how it is built and we know the simplest, least painful path your organization can take.

We've spent years studying compliance, helping clients, and coming up with the award winning Unified Compliance Framework that everyone is talking about. We've learned how to reduce the complexity, reduce the overhead, and reduce the cost of all forms of IT regulatory compliance.

We know how to make your life easier.

And it won't cost you an arm or a leg in the process.

Check out our services, you'll be glad you did.

And check out the Unified Compliance Framework, you'll learn more than you thought you could.

Identify, Align, Comply: Fusing Compliance and Business with a Unified Compliance Approach

2006-09-26T18:09:29Z

Dorian Cougias will be presenting at the IT Compliance Institute's Washington D.C. conference in October on the topic of Unified Compliance. Here's the excerpt from the presentation:

ustaining consistent compliance results across diverse business units, regulatory efforts, and IT practice areas depends largely on your ability to standardize and align the IT policies and procedures that comprise your compliance program. This session will present concrete ways to assess, compare, and align major laws and IT standards with your own business structure and IT goals. Presented by the principle author of ITCi's Unified Compliance Project (UCP), this session will leverage the framework and exhaustive research that is the foundation of the UCP and propose ways you can participate in the UCP community.

You will learn

How to decide which control objectives fit your organization and which don't
How to align appropriate control objectives with your own organizational structure and functions
How to use the Unified Compliance matrices to build structured, consistent, logical and well written policies and procedures around aligned controls
Ways to participate in collaborative development of new compliance resources via the UCP

For more information about the conference, log on to the ITCi website.

The Unified Compliance Project introduction

2006-09-26T18:04:20Z

The Unified Compliance Project is a part of the Unified Compliance Framework that Network Frontiers and Latham Watkins have been deeply involved within for the last coupe of years.

Dorian has created an outstanding introduction to the project and the framework in the form of a webinar, which is available at the ITCi website. You can watch the webinar by clicking HERE.

The Backup Book

2006-09-26T17:58:18Z

Backup can be a boring topic – but it can save your business so it’s a necessary read. We’ve made it a better read with the proper blend of humor and real world insight.

Recovery is often neglected in most books – because it is harder than the vendors promise and those who write application-specific books don’t want to anger their vendor sponsors. We have no such worries.

Most books don’t go into the nitty-gritty of real world, dirty-hands implementation. They prefer to take the high ground of planning. Why? Simply because a single writer, or even small writing team, could never have enough real world experience to provide insight into enough scenarios to make nitty-gritty writing worthwhile for the reader. Not in our case. With over 300 Field Editors in 7 countries, we cover the gamut of individual users through international organizations.

We have succeeded in combining what can go wrong and how that applies to the various backup methods, coupled that information with recovery and business continuity tactics, and then played this information out over the backdrop of various real-world scenarios. Our Field Editors love it. As Joel Faust, a Field Editor recently commented:

I am impressed. A man once told me to speak, write, and act at a 9th grade level. This seems to work best for most people. I believe you have captured that for the most part. If I had more time I may pick it apart some but all in all it seems very well done. It seems as though this book will be an excellent and enjoyable primer for the curious and possibly, and with the details you’ve added, an excellent refresher for seasoned Network personnel.

Not only is The Backup Book a great read, it is one of the most highly regarded technology books of the last decade. It is the only technology book to win Book of the Year for both technology and Internet books as well as be awarded the coveted five star review from Foreword magazine.

Online policies and procedures training

2006-09-26T17:16:24Z

Network Frontiers is currently working with DCi to create an online training course for teaching end users how to create policies and procedures.

If you are interested in such a course, please contact Dorian Cougias at 510 835 2415, ext 112, or e-mail him by clicking HERE.

Tailored audit templates

2006-09-26T17:11:33Z

Network Frontiers has entered thousands of audit questions into a single database and consolidated these questions so that you only need to ask them once. With your customized audit, you will be asking the same questions that the auditors ask and be prepared for all upcoming audits and disasters before they strike. Your audit will be delivered in Word, Excel, and Systems Continuity Plan Pro format.

Here's what you need to do to get started:

Step One - A Brief Review

Ordering your customized audit will take only minutes. We will ask you a few questions about your objectives, industry, and business relationships. Next, we will provide a timeline and pricing. If the timing and costs work for you, we will begin work immediately.

Step Two - Audit Templates for Continuity and Compliance

Based upon the regulations that you must comply with and the systems that you are protecting, Network Frontiers will select the audit questions recognized and used by the regulators, auditors, and recognized industry associations.

Step Three - Customized Template Delivery

In less than a week, you will have your customized audit templates. Once you receive your templates, Network Frontiers will walk you through the steps of using Systems Continuity Plan Pro to conduct your audits or you can jump right in with the Word or Excel Version.

Email Us

We are happy to answer any of your questions. Just email us at customaudit@netfrontiers.com. Or call Lynn Heiberger at 408-732-6600 ext. 111.

Where are we?

2006-09-26T17:04:17Z

At Jack London Square in the East Bay...

220 Fourth Street, Suite 103

Oakland, CA 94607

On our Phones...

510 931 6611

By Fax...

510 835 2465

And always available by e-mail...

General info info@netfrontiers.com

Or by name, firstinitiallastname@netfrontiers.com

Our logo says it all

2006-09-26T17:00:32Z

Network Frontiers provides guidance through the maze

Today's vast and ever growing world of technology products has created a maze of conflicting messages that the IT professional must sort through. Each different player in the market states "my product works best in your environment" without usually knowing much about that environment at all.

So how do you navigate the maze? That's what Network Frontiers is about. We are about testing and introducing products and concepts into today's technology market and then telling the truth about them.

Our promise to IT professionals worldwide is today the same as it was when we founded the company in 1992 - Network Frontiers will help guide you through the maze of tehcnology products and issues so that you can get your job done.

With no biases.

And pure straight talk about what works and what doesn't.

Network Recovery planning

2006-09-26T16:52:12Z

Let's face it, the world has changed recently, and we don't have to go into it to understand why. But companies have been facing minor crises such as fires, tornadoes, and earthquake damage for years. And there are ways to ensure even if the building is no longer there, that within a minimal amount of time you can be up and running with mission critical systems. As Irv Fish, the CFO of Fallon McElligott once said, "if you can bill your clients, the world knows you are in business."

Most businesses only think they are ready for a disaster to hit. Sure, backups are done, but are they done in such a way to ensure proper and timely restoration of multiple devices? Probably not. Do you know which computers should be brought back first, second, third, in order to ensure that you are up and running with the minimal amount of downtime?

Do you know which document, which jobs, which clients are most or least likely to tolerate "downtime" while you are recovering from a major hiccup like losing the building?

The NetRecover service will teach your staff, from techies to business managers, about the tolerance to downtime that each project, service, and business application might have. And we'll set up your backup and restoration plan so that you can recover quickly in case of an emergency. We'll give you a predetermined plan that will tell you what computers, software, and network devices you must have if you have to run your business out of a hotel (as many in NYC did), a house (as some in California have), or an alternate business location.

Services & Deliverables

Our staff will run through a litany of mini-audits, a small class for your staff, and will create a slew of preparedness plans with you. The list will include:

Mission Critical Applications audit
Tolerance to Downtime classes and self-audit
UPS Short Term Requirements
Backup and Offsite Storage
Restoration Planning
Hot Site (where you go in case of trouble) Requirements
Hot Site Deployment planning
Re-purchase plan for mission critical computers, network gear, and software

Contact

If you are interested in this service, please contact Lynn Heiberger at 510 835-2415, ext 111, or e-mail her by clicking HERE.

Network Health Check

2006-09-26T16:50:29Z

You can't get e-mail on a regular basis. You try to put files on your fileserver, but somewhere along the way during the transfer, it just sort of stops. Your printed documents are said to be "corrupted" by the printer more than you'd like. Your network seems to be as fast as the LA 405 "Expressway" during rush hour. And your network probably has more viruses than a NY city garbage rat.

If your network was a person visiting a doctor, it would probably say that it has "constipation, constant dizziness, and coronary palpitations." In other words, it generally doesn't feel good, but you don't know why.

Your network needs a checkup.

And that's exactly what the "doctors" at Network Frontiers are ready to do for you. We'll come in, put our version of a stethoscope on your network cables and listen for irregularities. We'll check the blood pressure of your servers and make sure there aren't any arteries that are clogged and that they aren't too overworked. We'll make sure that you are inoculated for all the current viruses. And we'll give you a prescription for whatever ails you.

Services

We'll use a method called Packet Analysis of TCP/IP (and AppleTalk if you have it), reviewing for such irregularities as AARP storms, bad NIC cards, address conflicts, and any network congestion causing problems.
Load Analysis for each switched segment.
Load Analysis for each routed segment.
Cable Testing for Twisted Pair. Fiber testing additional.
DNS Mapping
1. Master/Slave Responsibility
2. Table Entries
Virus Scan

Contact

If you are interested in this service, please contact Lynn Heiberger at 510 835-2415, ext 111, or e-mail her by clicking HERE.