SF - 3.03.0 - ITIL

SF - 3.03.0 - ITIL

ITIL is the Information Technology Infrastructure Library.  It is, in fact, an actual library, or, at least, a collection of books.  At one point it had twenty-nine volumes in it, divided into five sections.  One of the books in the library was on security.  It was, generally speaking, a set of principles, setting out a number of management guidelines.  Because of the importance of management to security, there was an obvious connection to ITIL.  Unfortunately, at some point, the security volume of the information technology infrastructure library was discarded.

Initially, the Information Technology Infrastructure Library was an interesting example of how a poorly defined field required a bothersome and arduous certification process.  You could get certification in ITIL, but in order to do so you had to jump through a lot of hoops, and write a number of essays, on various topics, which I suppose would prove that you had read various volumes of the library.  However, particularly given that ITIL eventually helped influence British standard 15000, and ISO 20000, the ITIL has become more defined, and these days the certification process is much easier.

Security frameworks (SF) series:

Previous: https://fibrecookery.blogspot.com/2026/06/sf-2180-information-security-forum.html

Introduction and ToC: https://fibrecookery.blogspot.com/2026/06/security-frameworks-sf-0000-intro-and.html

Next: https://fibrecookery.blogspot.com/2026/06/sf-3060-graphical-management-frameworks.html

Trolley problem options

You are the conductor of a trolley.  (For the purposes of this exercise, the conductor is the person who throws the switch selecting which track to take.  No, I don't know how to drive a trolley, and I don't know how a conductor would throw the switch.)

Ahead of you on the track is a switch.  If you do not switch the switch, you will drive over ten people. These ten people are poor.

If you switch the switch, you will drive on an alternate track, and drive over one person.  This one person is wealthy.  Much wealthier than the collective wealth of the ten people on the original track.

Capitalism states that the wealth of the one wealthy person, whether created or inherited/safeguarded, is greater than the wealth of the ten people, and therefore you should drive over the ten people.

(No, I don't know why none of the people will get out of the way.  Maybe they are all female, and have been tied up by Snidely Whiplash.  No, I don't know where the ranch is.)

Socialism states that the needs of the many outweigh the needs of the few, and therefore you should drive over the rich person.

(No, I don't know why the trolley has been designed with no brakes.)

(No, I don't know what the economics or business model would be for a trolley which has no brakes, and therefore has no ability to stop and allow passengers to board or disembark.)

At this point, a student, representing agnosticism, asks how you know that the people on the original track are poor, and that the people on the one person on the alternate track is rich.

For the purposes of the exercise we will posit that you have just been handed a telegram giving you all of this information, and confirming that beside the group of ten people is a priest holding a sign that you can easily read from where you are that says "Y" for yes or "N" for no, and that on the alternate track there is a rabbi standing beside the rich person with a similar set of signs.  This verifies that the information you have been given in the telegram is correct.

(For the purposes of the exercise there is absolutely no significance to the fact that the person who is verifying the identity of the rich person is Jewish, and that the person verifying the identity of a bunch of poor people is Catholic.)

At this point a student in information security points out that this form of authentication of identity is sadly lacking in verification structures and should not be trusted.

Subsequently, a fatalist says that you can avoid the whole problem of choice by simply jumping from the trolley where you are, thus relieving yourself of the responsibility and moral choice, and leaving the fate of all of the people in the hands of either God or random chance.

An American Christian nationalist now asks whether either the rabbi or the priest is black?

(At this point, the instructor has to go and lie down in a cool, dark room for a while ...)

SF - 2.18.0 - Information Security Forum

SF - 2.18.0 - Information Security Forum

Information Security Forum (ISF)‏

Standard of Good Practice for Information Security

The Information Security Forum (ISF)‏ originally set out to create a standard of good practice for information security.  At least they didn't use the term best practice.

The information security forum divided security into five "aspects," that of security management, critical business applications, computer installations, networks, and systems development.  This follows and models three or four of the "domains" of information security originally created by the International Information Systems Security Certification Consortium.

However, the Information Security Forum broke these five "aspects" out into thirty "areas," and (you guessed it) 135 sections.  The security forum can still be found, but these days has devolved into a rather standard sales organization for training and educational materials.

Security frameworks (SF) series:

Previous: https://fibrecookery.blogspot.com/2026/06/sf-2150-security-blueprints.html

Introduction and ToC: https://fibrecookery.blogspot.com/2026/06/security-frameworks-sf-0000-intro-and.html

Next: https://fibrecookery.blogspot.com/2026/06/sf-3030-itil.html

Review of "Wardriver"

Yesterday, I watched a movie called "Wardriver."  It has taken me at least 24 hours to figure out that the title of the movie is supposed to refer to the practice of wardriving, an occupation of driving (or, very often, walking) around, trying to find wifi hotspots which are either completely unprotected, or for which the protection is weak and easily broken.

It has taken me that long because the practice of wardriving, in reality, is nothing like the activities done in the movie.  War driving is, itself, a derivation of war dialing; an earlier practice whereby you would mass dial a whole bunch of different phone numbers, attempting to find modems, and particularly modems where the login credentials were weak or non-existent.  The practice of both war dialing and war driving was to find systems that you could get access to.  Neither practice was particularly suitable for attacking a specific company or enterprise, or even a particular type of company or enterprise.

The activities taking place in the movie were directed at very specific types of companies.  As a matter of fact, a number of different practices were involved in the movie, including, rather later in the movie, the practice of credit card skimming, which has absolutely nothing to do with connecting to specific systems, or even systems in general.

There may be other technical activities going on in this movie.  Quite frankly, nothing in the movie prompted me to pay particular attention to the technology that was going on or being used, and the movie is, as so many movies are these days, in very dark settings, which makes it difficult to see anyways, and there are activities going on involving text or chat, which are displayed on screen in fonts too small for my aged eyes to read.  Yes, it was a DVD, and I could have stopped and enlarged the text to figure out more of what was going on, but, once again, there was absolutely nothing in the movie that prompted me to want to take that kind of trouble to figure out extra details of what was going on.

SF - 2.15.0 - Security Blueprints

SF - 2.15.0 - Security Blueprints

Security Blueprints is an interesting and distinctive type of security framework.  It is an interesting combination of a breakdown framework and a checklist framework.  If you remember the mind maps phenomenon, it is kind of a version of that, related to security.  It was popular at about the same time, approximately twenty years ago, and made a bit of a splash because of an association with IBM at the time.

It's a heavily graphical presentation, with individual boxes representing individual offices, and possibly even processes.  It tends to be rather fractal, like a mind map, in that when you open a box, a number of other boxes with different offices or processes also open.

Security frameworks (SF) series:

Previous: https://fibrecookery.blogspot.com/2026/06/sf-2120-fisma.html

Introduction and ToC: https://fibrecookery.blogspot.com/2026/06/security-frameworks-sf-0000-intro-and.html

Next: https://fibrecookery.blogspot.com/2026/06/sf-2180-information-security-forum.html

"Stay Safe" course ...

Girl at the Community Policing table (excitedly): "We took the stay safe course.at school!"

"Me (truly interested): "What did you learn?"

Girl: "Ummm ..."

SF - 2.12.0 - FISMA

SF - 2.12.0 - FISMA

The Federal Information Systems Management Act, or FISMA, is a law in the United States, and therefore only applies to American systems.  It also primarily applies to American government systems.  Its significance to the broader field of information security is that Americans tend to assume that their laws apply to anyone else who is dealing with American companies or government agencies.  I have mentioned the Sarbanes Oxley law, which is an American law, but which contains wording that is similar to those in various other American laws, stating that, if you do significant business with an American company, you are deemed to have accepted that this law applies to you.  The law assumes that you have deemed to have accepted that this law applies to you even if you don't even know that this law exists.

An additional issue with FISMA is that it really only says and specifies that you need to apply appropriate protection to any information management system.  The protection that you need to apply needs to be appropriate to the importance of the information contained within the system.  The details of what particular programs are important, and what the protections for these systems are are related in various additional standards, such as the National Information Assurance Certification and Accreditation Process (NIACAP)‏, the National Institute of Standards and Technology outline ((which tends to also apply to non-government systems), the Defense Information Technology Systems Certification and Accreditation Process (DITSCAP)‏, and Director of Central Intelligence Directive 6/3.

Security frameworks (SF) series:

Previous: https://fibrecookery.blogspot.com/2026/06/sf-2090-common-criteria.html

Introduction and ToC: https://fibrecookery.blogspot.com/2026/06/security-frameworks-sf-0000-intro-and.html

Next: https://fibrecookery.blogspot.com/2026/06/sf-2150-security-blueprints.html