Earl Crane
Adjunct Professor, Heinz School
Carnegie Mellon University
mystie3k at cmu * edu
earl at cranesnest * net
earlcrane at gmail * com
Home address:
Washington, DC
Current Research Projects:
Information Security in the Federal Government
Social Media
- Guidelines for Secure Use of Social Media by Federal Departments and Agencies
- Abstract: The use of social media for federal services and interactions is growing tremendously, supported by initiatives from the administration, directives from government leaders, and demands from the public. This situation presents both opportunity and risk. Guidelines and recommendations for using social media technologies in a manner that minimizes the risk are analyzed and presented in this document.
- This document is intended as guidance for any federal agency that uses social media services to collaborate and communicate among employees, partners, other federal agencies, and the public.
- Note: The Federal CIO Council does not endorse the use or imply preference for any vendor commercial products or services mentioned in this document.
Cloud Computing
Information Security and Insider Threat
- Classical and Emerging Paradigms Of Leadership
- Trust has been extensively studied by sociologists, but
only recently has this been reviewed from a standpoint of establishing
online trust. Emerging thought leaders in the online world explore this
with trust-based marketing, but the new medium of the internet creates a
new, unexplored space. This KAM Breadth component reviews the history of
establishing trust in three sections: Interpersonal Trust, Team Trust,
and Societal Trust. Interpersonal trust has a long history, dating back
to the ancient world, while team trust is relatively new with
industrialization. Societal trust is the newest and largest in scope,
encompassing both societal trust and trust in abstract systems. Trust in
abstract systems guides the focus of the KAM Depth component, trust in
information systems.
- Trust,
technology adoption, and insider threat
- Trust is usually considered a humanistic quality, and has
varying interpersonal or societal theories as discussed in the Breadth
Component. Now I look exclusively at trust as it applies to information
systems, and consider trust’s influence on technology adoption and
insider threats. Trust affects technology adoption as users may require
that assurance or perceive a risk encouraging them to adopt technology.
Insider threats apply specifically to information system espionage, IT
sabotage, and theft, of which trust is an enabling factor in multiple
aspects. This article addresses current trust theories as they relate to
insider threat and information system adoption, and identifies common
themes throughout them all.
- Insider
Threat Awareness and Mitigation Training
- This paper contains training content for an insider
threat awareness program. This material was combined with the breadth and
depth components to create a one hour presentation, delivered to system
owners and information security managers. The awareness program provides
background information to the issues of trust, technology adoption, and
insider threat. It concludes with a set of thirteen recommendations for
managers to reduce the risk of insider threat, compiled by Carnegie
Mellon.
- Presentation:
Insider Threat and Information Security
Current Bio
http://www.heinz.cmu.edu/faculty-and-research/faculty-profiles/faculty-details/index.aspx?faculty_id=26
Federal Bio
Current Courses Taught:
(95-857) Incident Response
http://www.heinz.cmu.edu/current-students/course-results/course-details/index.aspx?cid=361
Computer intrusions and security incidents are a part of life. Responding to
these incidents is complex due to the technologies and disciplines involved.
Effective response requires an understanding of technology, investigative
sciences, legal requirements, and political considerations.
System and security administrators as well as managers are often asked to
respond to and resolve incidents, but rarely have the requisite knowledge to do
so. This course teaches the theory and principles of incident response through
a hands-on and practical approach.
Students will see common network attacks first hand, and then learn the
specific steps and methodology necessary to resolve the incident. They will
learn how a particular attack leaves a signature, and will be given the tools
to identify those signatures. Students will then use those tools to identify
unknown attacks, both in lab settings and projects.
The entire lifecycle of incident response is covered, from pre-incident
preparation through notification, initial response, and recovery. Real world
case studies will provide insight into the computer crime cases that
corporations and government are currently facing. Guest speakers with computer
forensics and law enforcement backgrounds may be invited to speak.
Goals:
Learn a methodology for identifying and resolving computer security incidents
Gain hands-on experience using the tools and techniques currently used by government and private industry to respond to incidents
Introduce the forensic process and legal requirements of response
Learn unique critical thinking skills
(90-895) Policy Topics: Information Security Policy
http://www.heinz.cmu.edu/current-students/course-results/course-details/index.aspx?cid=417
Federal IT systems face a dizzying array of policies, regulations, and
government initiatives, issued from multiple sources. Many of these issues are
unique to government IT systems, and the wide range of compliance requirements
make securing and managing a government IT system more complex than many
commercial IT systems. From nation-state attackers to collateral classified
information and above, federal IT security managers deal with a wide array of
security issues beyond commercial America.
This course will provide second year masters level students with aspirations
of serving the United States government, either as a contractor or as a public
servant, the knowledge and background information necessary to effectively
govern the security of federal IT systems. Students in this program will be
exposed to the historical context leading up to modern information security
policy, and the current issues and trends influencing today’s decision makers.
The calling to secure these systems is great and the intellectual resources are
slim. We must defend our homeland against threats foreign and domestic, known
and unknown, to ensure our national, state, and local policy decision makers
and first responders have the IT resources they need to operate in a time of
crisis. Their ability to communicate securely and efficiently lies in your
hands.
Groups
CMU Alumni in DC
http://www.cmu-dc.com/
Infragard
http://www.infragard.net/
ISACA
http://www.isaca.org/
ISC2
https://www.isc2.org
Page of useful links
Current Google Reader OMPL File Output
google-reader-subscriptions.xml
News
DHS Daily Open Source Infrastructure Report
http://www.dhs.gov/xinfoshare/programs/editorial_0542.shtm
Global Incident Map
http://www.globalincidentmap.com/home.php
BBC News | News Front Page | World Edition
http://news.bbc.co.uk/
washingtonpost.com - Technology - Industry News, Policy, and
Review
http://www.washingtonpost.com/wp-dyn/content/technology/index.html
Engadget
http://www.engadget.com
Gizmodo
http://www.gizmodo.net
New York Times
http://www.nytimes.com
The Register
http://www.theregister.co.uk
Slashdot
http://slashdot.org
Wired News: Top Stories
http://www.wired.com
Security
2600: The Hacker Quarterly
http://www.2600.com/
codesecurely.org
http://www.codesecurely.org/default.aspx
SANS NewsBites
http://www.sans.org/newsletters/newsbites/newsbites.php
Security Fix
http://blog.washingtonpost.com/securityfix
SecurityFocus News
http://www.securityfocus.com
Mark Curphey - SecurityBuddha.com
http://securitybuddha.com
Schneier on Security
http://www.schneier.com/blog/
TaoSecurity
http://taosecurity.blogspot.com/index.html
Counterterrorism Blog
http://counterterrorismblog.org
Industry Rag
SC Magazine US Latest News
http://www.scmagazine.com/us
FCW.com
http://www.fcw.com
CNET News.com
http://news.com.com
InformationWeek Security News
http://www.informationweek.com/security/
eWEEK Security
http://security.eweek.com
Blogs
Agile Management Blog
http://www.agilemanagement.net/Articles/Weblog/blog.html
DCist
http://www.dcist.com
Southern Poverty Law Center: Hatewatch
http://www.splcenter.org
Resources
SANS Information Security Reading Room
http://www.sans.org/reading_room
Software Engineering Institute (SEI)
http://www.sei.cmu.edu