The Value of Branding and Simplicity to Certifications

At the risk of stirring the cyber pot (item 3, specifically) I wanted to post a response to a great mailing list thread I've been following. A reader asked about the value of the CISSP certification. Within the context of the mailing list, several responders cited their thoughts on SANS certifications. Many mentioned why the CISSP tends to be so popular. I'd like to share my thoughts here.

In my opinion, the primary reason the CISSP is so successful is that it is easy to understand it, which facilitates marketing it. It is exceptionally easy for a recruiter to search LinkedIn profiles, other databases, or resumes for the term "CISSP." If you encounter a person with the CISSP, you basically know what the person had to do to get the certification.

Before continuing, answer this quick question: what are the following? 1) SSCP, 2) CAP, 3) CSSLP?

Let me guess -- you didn't recognize any of them, just like I did?

Now, let me see if you recognize any of the following? 1) GGSC-0400, 2) GNET, 3) GAWN-C, 4) GBLC, 5) GCIM?

I believe you didn't recognize any of those either.

How about? 1) GISP, 2) GLEG, 3) GCIH, 4) GAWN?

I'm guessing some of you might recognize GCIH as the SANS "GIAC Certified Incident Handler," which actually doesn't have much to do with "incident handling." That's a topic for another day, but it does show GCIH benefits from decent branding.

You've probably figured out that the last two lists of acronyms were SANS certifications. The first list was a selection of a few of the retired SANS certifications. There's 26 of those.

The second list was a selection from the list of 24 active SANS certifications.

What about the first list, starting with "SSCP?" Those are other certifications offered by ISC2. They're utterly forgettable. Had I not visited the ISC2 Web site, I would never have known they existed.

Now, one could argue that the brand "SANS" is as recognizable, or even more recognizable, than the brand "CISSP."

The problem is that a person's resume could list "SANS" as a course he or she attended, without noting if a certain achievement (i.e., certification) was achieved. "SANS" is also a poor search term because the diversity of the SANS ecosystem means you could be dealing with a legal person, or a reverse engineer, or a UNIX system administrator.

What is the answer for SANS, if the CISSP will likely continue to out-market it? I recommend adopting the model used by Cisco. If you hear a person has a CCIE, that means something -- you immediately think of deep knowledge, several levels of work, and grueling hands-on testing over two days in a controlled environment.

The genius of Cisco's approach is that they have "tracks" for the CCIE, e.g. Data Center, Routing and Switching, etc. Those aren't the brands though; that stays with CCIE.

The Cisco approach isn't perfect, because you can't simply search resumes for "CCIE" intending to get a CCIE in security. You might find a CCIE in routing and switching, or wireless. However, if one finds a CCIE, you get a sense of the level of seniority and ability to operate in a stressful environment (at least as far as a test can simulate).

SANS has tried something like the CCIE with their "GIAC Security Expert (GSE)." The GSE is similar to the CCIE in many respects, including horribly tough hands-on labs, but unfortunately hardly anyone knows about it. It is really difficult to reach that level in SANS certification. However, because only 63 people hold it, there's no real market for them.

By the way, I smell a branding failure when SANS certifications like GSE, GCIH, and so on all have a "G," which references another acronym -- "GIAC," for "Global Information Assurance Certification." That doesn't even include the term "SANS," which is the stronger brand. GIAC originally meant "Global Incident Analysis Center," but that's another story.

In brief, I think SANS could increase the branding value of their certifications if they retired the existing acronyms and names, incorporated "SANS" into a new naming scheme, and concentrated on a "level" approach seen with Cisco. Focus on Entry-Level, Associate, Professional, and Expert as Cisco does, and develop programs to accelerate the adoption of the Expert level among its constituency as Cisco did with CCIEs.

Rebranding would cause lots of SANS folk plenty of heartache, but I think integrating "SANS" into the new level-oriented structure would more than compensate for the initial transition costs. Ultimately the system would be stronger for everyone.

What do you think?

Tweet

Read More

NSA IAM and IEM Summary

Two years ago I wrote Thoughts on NSA IAM Course. That post is still in the top ten Google search results for NSA IAM, which is sad because that means there isn't much about the program online. IAM stands for INFOSEC Assessment Methodology. (Ugh, I hate "INFOSEC".)

The only real material about IAM (beyond the public slides used to teach the classes appears in Security Assessment: Case Studies for Implementing the NSA IAM by Russ Rogers, Greg Miles, Ed Fuller, Ted Dykstra. The Syngress sample chapter nicely summarizes the IAM purpose and compares it to alternatives.

The National Security Agency (NSA) Information Security (INFOSEC) Assessment Methodology (IAM) is a detailed and systematic method for examining security vulnerabilities from an organizational perspective as opposed to a only a technical perspective. Often overlooked are the processes, procedures, documentation, and informal activities that directly impact an organization’s overall security posture but that might not necessarily be technical in nature. The IAM was developed by experienced NSA and commercial INFOSEC assessors and has been in practice within the U.S. government since 1997. It was made available commercially in 2001.

NSA developed the IAM to give organizations that provide INFOSEC assessments a repeatable framework for conducting organizational types of assessments as well as provide assessment consumers appropriate information on what to look for in an assessment provider. The IAM is also intended to raise awareness of the need for organizational types of assessment versus the purely technical type of assessment. In addition to assisting the government and private sectors, an important result of supplying baseline standards for INFOSEC assessments is fostering a commitment to improve an organization’s security posture.

The following chart from the sample chapter explains how NSA differentiates security activities:



So what are the general steps proposed by NSA IAM? There are three general phases:

1. Pre-Assessment




• Determine and manage the customer’s expectations


• Gain an understanding of the organization’s information criticality


• Determine customer’s goals and objectives


• Determine the system boundaries


• Coordinate with customer


• Request documentation




2. On-Site Assessment




• Conduct opening meeting


• Gather and validate system information (via interview, system demonstration, and document review)


• Analyze assessment information


• Develop initial recommendations


• Present out-brief




3. Post-Assessment




• Additional review of documentation


• Additional expertise (get help understanding what you learned)


• Report coordination (and writing)

NSA IAM emphasizes creating a Technical Assessment Plan (TAP) which includes the following:

• Point of Contact


• Mission


• Organizational Information Criticality


• System Information Criticality


• Customer Concerns and Constraints


• System Configuration


• Interviews


• Documents


• Timeline of Events

In brief, the NSA IAM is a giant interview, demonstration, and documentation review that preceeds any kind of technical review. The IAM spends a good chunk of time determining Organizational Information Criticality and System Information Criticality via brainstorming and customer interviews. The idea is to narrow the scope of the assessment to something that customers care about. IAM (and IEM) sources clearly point out that their methodologies are not audits, inspections, or risk assessments. One of the course slides provides this (sort of) summary:



That's the IAM. What is the IEM [INFOSEC Evaluation Methodology]? Again, the best resource is a Syngress book -- Network Security Evaluation Using the NSA IEM by Russ Rogers, Ed Fuller, Greg Miles, Matthew Hoagberg, Travis Schack, Chuck Little, Ted Dykstra, and Bryan Cunningham. Quoting from the first chapter:

The IEM is a follow-on methodology to the NSA IAM. It provides the technical evaluation processes that were intentionally missing from the IAM. The IEM is a hands-on methodology, meaning you'll be actively interacting with the customer's technical environment. As such, the NSA intended for the IAM and IEM processes to work hand in hand...

Whereas the IAM provides us with an understanding of organizational security as it relates to policies and procedures, the IEM offers a comprehensive look into the actual technical security at the organization.

The IEM is divided into phases as well:

1. Pre-Evaluation Phase




• Pull information from IAM Pre-Assessment


• Coordination with the customer to determine acceptable Rules of Engagement (ROE)


• Give the team an understanding of the perceived system components


• Define customer expectations


• Define customer constraints or concerns


• Legal Requirements


• Develop the Technical Evaluation Plan (TEP)




2. On-Site Evaluation Phases




• Evaluation In-Brief


• Tool Introduction and System Evaluation




• Port Scanning


• SNMP Scanning


• Enumeration & Banner Grabbing


• Wireless Enumeration


• Vulnerability Scanning


• Host Evaluation


• Network Device Analysis


• Password Compliance Testing


• Application Specific Scanning


• Network Sniffing




• Evaluation Out Brief




3. Post Evaluation Phase




• Analyze the evaluation raw data


• Conduct additional vulnerability research


• If necessary, seek additional expertise


• Develop recommendations


• Coordinate final report authoring with team members


• Deliver final report to customer

Like the IAM's TAP, the IEM directs creation of a Technical Evaluation Plan, or TEP:

1. Points of Contact


2. Methodology Overview




• Purpose of the IEM


• Description of the IEM


• Evaluation Tools to Be Used




3. Criticality Information (Organizational Criticality Matrices and System Criticality Information)


4. Detailed Network Information


5. Customer Concerns


6. Customer Constraints


7. Rules of Engagement


8. Coordination Agreements




• Level of Detail of Recommendations


• List of Agreed-On Deliverables


• The Coordination Agreements Section: A Catchall




9. Letter of Authorization


10. Timeline of Events

There's more to the IEM but those are the parts I want to have available for personal reference.

The following shows how the IAM and IEM can work together.



Is this rocket science? Of course not. Are the 10 "evaluation" activities naive and incomplete? Yes. The idea is you can build on this sort of methodology with your own approaches. I actually liked the IAM class and the structure of the IEM TEP, but I found the IEM class itself laughable.

If you want more details on really conducting evaluations, then a review of the latest Open Source Security Testing Methodology Manual (OSSTMM) is probably worthwhile.

Read More

Thoughts on Latest CISSP Requirements Change

You all know I am a big fan of the CISSP certification. (If you don't recognize that as sarcasm, please read some old posts.) I wasn't going to comment on the press release (ISC)²® to Increase Requirements for CISSP® Credential to Validate Information Security Expertise, but no one else really has.

First, a little history. The last time a requirements change was announced was January 2002, in the press release (ISC)² TO IMPLEMENT NEW CISSP REQUIREMENTS IN 2003. That article stated:

...new requirements for the Certified Information Systems Security Professional (CISSP) certification, effective Jan. 1, 2003.

As of that date, the minimum experience requirement for certification will be four years or three years with a college degree or equivalent life experience. The current requirements for the CISSP call for three years of experience...

The "equivalent life experience" provision is intended for mature professionals who did not obtain a college degree but are in positions where a college degree would normally be required...

You may remember these changed were announced about a month after 16 year old Namit Merchant passed the CISSP exam, according to a December 2001 SecurityFocus report.

I passed the CISSP in late 2001 as well (I was almost 30, not 16) so all I needed was three years of relevant work experience. Since 1 January 2003, you could have three years experience plus one of the approved credentials. Those include many certs from SANS, for example.

The new requirements for the CISSP, announced this week, are:

Effective 1 October 2007, the minimum experience requirement for certification will be five years of relevant work experience in two or more of the 10 domains of the CISSP CBK®, a taxonomy of information security topics recognized by professionals worldwide, or four years of work experience with an applicable college degree or a credential from the (ISC)²-approved list.

Currently, CISSP candidates are required to have four years of work experience or three years of experience with an applicable college degree or a credential from the (ISC)²-approved list, in one or more of the 10 domains of the CISSP CBK.

I am not sure why (ISC)² is increasing the experience requirement. I don't think an five years of "experience" are going to make that much of a difference when compared to four years of experience plus a degree or credential. Honestly, equating a degree with a certification like CompTIA Security+ (on the "approved list") is really a joke, or should be.

Experience is not the only change:

Also effective 1 October, CISSP candidates will be required to obtain an endorsement of their candidature exclusively from an (ISC)²-certified professional in good standing.

Currently, candidates can be endorsed by an officer from the candidate’s organization if no CISSP endorsement can be obtained. The professional endorsing the candidate can hold any (ISC)² base certification – CISSP, Systems Security Certified Practitioner (SSCP®) or Certification and Accreditation Professional (CAPCM).

This is an anti-fraud attempt. I think it is too late. From the rumblings I've heard, cheating on exams like CISSP is not uncommon. One bad apple can "earn" the CISSP and then "endorse" all his buddies.

Maybe (ISC)² is finally starting to behave like employed French workers, protecting those who already have the certification at the expense of those on the outside? In other words, are there too many CISSPs chasing too few jobs? The latest press release states:

“With an estimated 1.5 million people working in information security globally, the nearly 50,000 CISSPs remain an elite group of professionals that are leading this industry,” Zeitler said. “(ISC)² will continue to assess its certification criteria and processes, as well its examinations and educational programs, to ensure that remains the case.”

50,000! Less than five years ago the press release (ISC)² RECOGNIZES 10,000th CISSP said only 2,000 CISSPs were certified in 1999, and 10,000 was reached in October 2002.

I still think the CISSP exam, and the certification in general, is a waste of time. For the latest example why, read How I Prepared and Passed CISSP:

I chose a self study route, and devoted around 2 months for the preparation. Locked myself in and had very little to no time for the family, I’d told them what I was up to, both my wife and son were very supporting. Every weekday I would dedicate 3 to 4 hours, and on weekends 5 to 6 hours for preparation. The last week before exam, I took leave from work and dedicated around 12 hours straight everyday for 7 days. To cope with the physical and mental tensions I did 45 minutes yoga in the morning and 20 minutes meditation in the afternoon. I took a break or stretched for 5 to 15 minutes after every 1 or 2 hours of studies.

That is ridiculous. I would expect someone who wants to be considered as a "security professional" to be well-enough versed in the CISSP material to not require seven straight days of 12 hour studying sessions, beyond the previous seven weeks of study.

I prepared for the test in 2001 by reading the first edition of the Krutz and Vines CISSP guide, followed by the Exam Cram the night before. That was it. No boot camp, not study marathons, no weeks of study groups. I had about four years experience and I figured that if (ISC)² required three years, I should be ok. I finished the test in 90 minutes and that was it.

If you're wondering how I would replace the CISSP, please read my 2005 post What the CISSP Should Be. I think Peter Stephenson's requirements for certifications are good guidelines as well.

Read More

Who Needs CISSP for Ethics?

Last year I discussed the value of the CISSP with respect to its code of ethics. Today while renewing my ISSA membership, I was presented with the following:

The primary goal of the Information Systems Security Association, Inc. (ISSA) is to promote practices that will ensure the confidentiality, integrity, and availability of organizational information resources. To achieve this goal, members of the Association must reflect the highest standards of ethical conduct. Therefore, ISSA has established the following Code of Ethics and requires its observance as a prerequisite for continued membership and affiliation with the Association.

As an applicant for membership and as a member of ISSA, I have in the past and will in the future:

* Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;
* Promote generally accepted information security current best practices and standards;
* Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;
* Discharge professional responsibilities with diligence and honesty;
* Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and
* Not intentionally injure or impugn the professional reputation of practice of colleagues, clients, or employers.

Please check the box indicating you have read the above statement and agree to its principles:

It looks to me like ISSA has the ethics bases covered. If I agree to that statement, I get as much value as being a CISSP as far as ethics goes.

Unfortunately, misdirected efforts like DoD 8570.1 attach significance to the CISSP out of all proportion to its worth.

Read More

CCNP Changes

If you're interested in earning the Cisco Certified Network Professional (CCNP) certification, you should read about changes in the cert. This TCPmag.com article is a nice summary. Basically Cisco removed some old material and added a lot more on security, wireless, and other modern topics. I would like to test for the CCNP before my CCNA expires in March 2008, but I'll wait until updated study books are available.

Read More

Certification & Accreditation Re-vitalization

Thanks to the newest SANS NewsBites (link will work shortly), I learned of the Certification & Accreditation Re-vitalization Initiative launched by the Chief Information Officer from the office of the Director of National Intelligence. According to this letter from retired Maj Gen Dale Meyerrose, the C&A process is too costly and slow, due to "widely divergent standards and controls, the lack of a robust set of automated tools and reliance upon manual review." He wants to "move from a posture of risk aversion to one of risk management, from a concept of information secuirty at all costs to one of getting the right information to the right people at the right time with some reasonable assurance of timeliness, accuracy, authenticity, security, and a host of other attributes."

That all sounds well and good, but it misses the key problem with C&A -- it doesn't prevent intrusions. It may be seen as a necessary condition for "securing" a system (which is not really possible anyway), but it is in no way sufficient. The forum set up to foster discussion of this initiative contains an insightful thought: Why do we have C&A at all? It's unfortunately that Gen Meyerrose didn't acknowledge that C&A doesn't provide much in the way of "security" at all, but that would admit that .gov and .mil have spent billions to no end. Woops.

Read More

DoD Certification Program Update

I've had a chance to read issues of Federal Computer Weekly delivered while I was on vacation. I like reading FCW because it gives me some insight into the madness found inside the Beltway.

I enjoyed reading Wanted: Information assurance-savvy people, which discussed DoD's plans for certifying IT staff. I've examined this issue before. Here's a quote by someone who understands the problems with DoD's plan:

Alan Paller, director of research at the SANS Institute, said DOD should have no problem meeting its initial target of 80,000-plus employees trained and accredited in information assurance. But he doesn’t think the baseline certification that DOD requires will produce a workforce capable of securing the military’s systems.

“The problem is that the bulk of the certifications don’t teach people how to do security,” Paller said. “Certified people will be able to talk about security, but they won’t know how to do it — to actually encrypt data and do the necessary work.”

Instead, DOD needs a way to evaluate actual information assurance work, Paller said. That requires hand-on training and scenario-based testing, he added.

Alan is absolutely right. A DoD certification program which accepts the CISSP as the top technical certification indicates the program designers are absolutely clueless.

Speaking of clueless:

Robert Lentz, DOD’s director of information assurance, said he respects Paller’s opinion but is not worried that the program is headed in the wrong direction. The important thing is to get baseline certifications awarded and then work from there, Lentz said.

Assuming the reported depicted Mr. Lentz's words accurately, I am extremely disappointed by this opinion. This attitude sounds to me like the following: "Who cares if our program is wrong? Let's just get it started." That is a recipe for failure, especially considering this quote from the article:

DOD’s success with IA training and certification could have wider implications, said Jim Flyzik, president of the Flyzik Group, a consulting firm. If successful, DOD’s approach would probably be adopted in other areas of government, he said.

Great. DoD starts down the wrong path, and the rest of the government follows? Ouch.

Read More

DoD 8570.01-M Posted

Thanks to David Bianco for sending me to this article about the manual for DoD 8570.1 being posted here. The .pdf looks like a scan of a hard copy document. I couldn't search it using xpdf.

Read More

DoD Directive 8570.1 Changes Everything

Last night I attended my local ISSA-NoVA meeting. I listened to Steven Busch from the Defense-wide Information Assurance Program (DIAP). He is a "Change and Workforce Management Senior Managing Consultant" with IBM working on implementing DoD Directive 8570.1, "Information Assurance Training, Certification, and Workforce Management", which I mentioned yesterday. He's also a Marine. (Notice I said "Marine," not "ex-Marine." Even though Mr. Busch is no longer in uniform, I recognize there are no "former Marines.")

I will try to summarize what I heard, with the expectation that Mr. Busch's slides will be posted at the ISSA-NoVA Web site soon. I managed to get related material from this earlier briefing (.pdf, slow). There's also a summary at (ISC)2.

The vision for 8570.1 is the following:

A professional, efficiently managed IA workforce with knowledge and skills to securely configure information technology, effectively employ tools, techniques and strategies to defeat adversaries, and proactively identify and mitigate the full spectrum of rapidly evolving threats and vulnerabilities in order to protect the network.

After reading my comments, you may agree that the implementation of 8570.1 will not meet this vision.

8570.1 will apply to anyone with privileged access (e.g., system administration) to DoD systems, to include uniformed military personnel, civilians, and contractors. The following chart summarizes 8570.1 (incorrectly called "8570" below) and 8570.1-M, the Manual which was signed on 19 December 2005 and provides implementation guidance.



Essentially, to administer a DoD system, military, civilian, and contractor operators will have to attain these goals:

1. Vendor-neutral security certification


2. Vendor-specific platform certification


3. On-the-job training

Before I discuss the approved certifications, let's look at the people affected by these requirements.



The slide shows two existing tracks. One is an IA Technical Category (for system and network administrators) and the other is an IA Management Category. Now let's see the certification list as displayed last night.



The Tech I and Management I categories are the bottom of the pyramids shown previously, while the IIIs are the top of the pyramids.

Let's break out those acronyms, since I didn't recognize all of them. First, the certifications for technical people:

• A+: CompTIA's basic system administration cert


• Network+: CompTIA's basic network administration cert


• TICSA: TruSecure ICSA (formerly International Computer Security Association) Certified Security Associate; never encountered this before


• SSCP: Systems Security Certified Practitioner, an (ISC)2 certification that just received ANSI accreditation -- a requirement for all of the vendor-neutral certifications


• GSEC: GIAC (Global Information Assurance Certification, formerly Global Information Assurance Center) Security Essentials Certification, a SANS entry-level certification


• Security+: basic security; why is Security+ here, and come to think of it, why is A+ and Network+ listed earlier for security certifications?


• SCNP: Security Certified Network Professional, offered by the Security Certified Program; never even heard of them


• CISSP: Certified Information Systems Security Professional from (ISC)2, which is also ISO/IEC 17024 certified. All of these certifications need to be ISO compliant, but I do not think they all presently are compliant.


• SCNA: Security Certified Network Architect, another SCP cert I've never seen before


• CISA: Certified Information System Auditor, offered by the Information Systems Audit and Control Association (ISACA); also ANSI-certified.


• GSE: GIAC Security Expert; this is a SANS cert held by five people. It is absolutely ridiculous to put the tech-less CISSP in the same category as the GSE, which requires "five intermediate level GIAC certifications" and "3 days of testing!"

Here are the certifications for managers, only listing those not covered above:

• GSLC: SANS GIAC Security Leadership Certification


• GISO: SANS GIAC Information Security Officer; this is already obsolete, replaced by the GSLC or GISF


• CISM: Certified Information Security Manager, another ISACA cert

The list will not necessarily be used by everyone in DoD. The DoD components can choose the certs on this list that they will accept. They cannot independently add certs to the list, although the oversight board managing this program for DoD can add new certs in the future.

You are probably wondering about the vendor-specific certification requirements. Mr. Busch explained that if a person administers Microsoft systems, they will need Microsoft certification. If they are a Cisco network admin, they will need Cisco certification. He admitted they have "not done much" yet in this area.

Earlier I reported on this story which inaccurately states the following:

[DoD] requires frontline security professionals to have certifications from CompTIA and (ISC)2 but not from the SANS Institute or vendors.

That is patently not true. When I first read that statement, I thought I understood why Alan Paller was upset. Now that I see there are some SANS certifications accepted by DoD, I realize he is more upset by DoD's choice of certifications. I agree with him.

Essentially, if you have your CISSP, you have the "golden ticket" for technical or managerial work in DoD. While that might be appropriate for management, it is absolutely worthless for operators. This DoD program is not going to result in any better security if the emphasis is placed on certs that have little or no technical relevance.

There may be benefit to having vendor-specific certs. Someone responsible for administering Solaris, Red Hat, or Cisco products are probably going to benefit from those programs. Unfortunately, DoD seems to be treating these programs as an afterthought.

One audience member asked Mr. Busch what he should tell an admin he knows that works on Oracle, Microsoft SQL, Solaris, and slew of other applications and operating systems. Mr. Busch replied "Most DoD components don't have that many OS' in one environment." This will be a real shock to the people on the front lines!

DoD plans to collect "IA performance data" to "measure the effectiveness" of this program. I would like to see if the people they consider "certified" (and they want 10% of the force ready by 30 Dec 06) are any more capable than the uncertified crowd.

I also wonder why DoD didn't leverage the CERT®-Certified Computer Security Incident Handler (CSIH) certification program. It's practically DoD already, is vendor-neutral, has been around for a long time, and appears to cover the subjects I would want to see in DoD security people.

There are some aspects of this program that I think are beneficial, without reservations. Mr. Busch said DoD is trying to include IA training within Professional Military Education, such as that found at the war colleges. This is a great idea and I would be interested in helping with that program. People with IA certifications will also be tracked DoD-wide, and IA will be treated less as an "additional duty" and more of a professional obligation.

Crucially, Mr. Busch recognizes that receiving training helps retention. Someone during the ISSA meeting asked what DoD will do when it trains its people and then watches them separate from the service. That attitude absolutely infuriates me. The alternative means keeping untrained people in place, because they have no marketable skills? That is completely idiotic. I argued with a colonel at the Pentagon about this when I was a captain.

I would like to hear your thoughts on this program. Overall, I think the intentions are good, but the selection of certs is on the whole misguided. I also hope to hear more details from Alan Paller, who seems to have a good grasp on this issue.

Read More

IISFA Is Irrelevant

For the past several months, I've been receiving notices from "Marcus Lawson - ISFA" of the International Information Systems Forensics Association. IISFA is the organization that awards the Certified Information Forensics Investigator™ (CIFI) Certification. I initially thought this would be a good certification for the reasons outlined in that post and previous posts linked within it.

The emails from IISFA have said the following.

Subject: Your International Information Systems Forensics Association membership is past due for renewal.

Dear Richard,

I have good news and bad news:

Bad news: your membership has, or is about to expire to the Information Systems Forensics Association. This means you will no longer be a part of the "Global Voice of Information Forensics;" you will not longer receive "The Information Forensics Journal;" and you will no longer be able to participate in ISFA events; internationally or locally.

Good news: You can renew your membership and continue to be a part of the excitement of investigative and scientific discovery for another year.

We hope you will continue to enjoy the benefits of ISFA for another year.

Sincerely,

Michelle Bourque, CISSP International Director of Membership International Information Systems Forensics Association

Your International Information Systems Forensics Association membership expired on 01/20/2006. Please take advantage of our limited time grace period offer and renew by 2/19/2006 to continue receiving all the benefits we have to offer.

Member Name: Richard Bejtlich,
Current Membership Type: Member
Membership Start Date: 01/06/2005
Membership Expiration Date: 01/20/2006

I've tried sending this response to multiple email addresses. No one has responded.

I've received mutliple renewal notices regarding my IISFA membership. They say:

Bad news: your membership has, or is about to expire to the Information Systems Forensics Association [sic].

Isn't it IISFA, the International Information Systems Forensics Association?

The email then says:

you will not [sic] longer receive "The Information Forensics Journal;"

Has there been any new issue of IFJ since the July/August 2004 issue?

The email continues:

you will no longer be able to participate in ISFA [sic] events; internationally or locally.

Have there been any IISFA events? I was scheduled to speak at the 22 Sep 04 meeting in Georgia, but I haven't heard anything about IISFA meetings since that event was cancelled (due to tragedy).

The most recent news item at iisfa.org dates from April 2005.

Overall, I do not get the impression that IISFA is offering much of value to me. Why should I renew membership?

Why should I renew, indeed? Has anyone gotten anything of value from IISFA, period? I plan to let membership lapse and my CIFI standing disappear.

Read More

Notes from Airplane Reading

Last week I read several magazines on the way to DoD Cybercrime. Here are a few thoughts on what I read. From the threat and vulnerability definition department, we have the article DHS offers $765M in risk-based grants from Federal Computer Weekly:

The Homeland Security Department has made $765 million available in fiscal 2006 for 35 urban areas to guard against terrorist threats, DHS Secretary Michael Chertoff announced today.

The Urban Areas Security Initiative (UASI) this year follows a new, risk-based formula that allots funding according to threat, vulnerability and consequence, Chertoff said...

In assigning the grants, DHS also for the first time used threat analysis from the intelligence community to look at different kinds of threats, such as transient populations, Chertoff said.

Replace the word "consequence" with "cost of replacement" in the second paragraph and you have the common risk equation found in my books and elsewhere. Nice reporting, Michael Arnone!

I liked this article by CIO magazine editor in chief Abbie Lundberg. This is an excerpt:

People talk a lot about the new skills for IT being "business" skills, coming from the business side. It bothers me that people talk about "the business" as if it’s some monolithic thing made up of every department that’s not IT.

The implication is that all these not-IT departments share common skills, attributes and concerns, and that there are no competing interests among them or any lack of understanding between them. It also seems to assume that they possess some intrinsic understanding of what’s right for the enterprise’s future and that IT doesn’t. Right.

Frankly, I don’t think "the business," or any one part of it, is in unique possession of the skills necessary to construct the 21st-century organization. In fact, I’d hazard to say that IT may be better equipped to drive and execute this transformation than any other department in the modern corporation.

Thank you. I don't know what you read or hear, but I am tired of hearing drivel about "business skills." Here's an example from the same issue of CIO, an article titled The New IT Department:

The preferred educational background for IT employees today is more often an MBA than a computer science degree, says [Lauri] Orlov [VP and research director for Forrester]. New IT hires are as likely to be brought over from the business side as they are to have been groomed in IT.

Is this why companies continue to be compromised? Are the MBAs running around wondering why their self-defending networks are failing? I guarantee we will see a "back-to-basics" movement in the next few years, where "hands-on" tech skills will be emphasized again.

Speaking of "hands-on" skills, FCW had another interesting article -- SANS: Popular certifications don't ensure security. So what's the big deal? Alan Paller summarizes the findings:

Many popular information technology security certifications don't improve holders' ability to ensure computer systems' security, according to a new survey from the SANS Institute, a training and education organization for security professionals.

The survey found that respondents with certifications from the Computing Technology Industry Association (CompTIA), the International Information Systems Security Certification Consortium -- also known as (ISC)2 -- and the Information Systems Audit and Control Association (ISACA) think that their training does not give them as strong an advantage in performing hands-on security jobs as platform- and vendor-specific certifications do.

Because respondents could vote for multiple certifications, "the low votes for CompTIA, (ISC)2 and ISACA certifications are compelling proof that these certifications should not be relied upon for people with hands-on security responsibilities," said Alan Paller, the institute's director of research.

One could argue this report and the survey (.pdf) are serving SANS's interests, but the findings also benefit holders of Cisco and similar vendor certifications.

Why is Alan upset?

He is especially concerned that the Defense Department now requires its frontline information assurance employees to have such nontechnical certifications. DOD's decision, finalized in December, came after the Titan Rain scandal last year in which international cybercriminals circumvented DOD's security measures and stole classified information.

"If these certifications do not correlate with hands-on security skills, then DOD is misleading its commanders by implying their people have the necessary security skills when they do not," Paller said.

What does DoD require?

DOD officials are satisfied with their choice of certifications, said Robert Lentz, director of information assurance in the DOD CIO's office. The department has codified competencies for its IT security employees under Directive 8570.1, "Information Assurance Training, Certification and Workforce Management," which requires frontline security professionals to have certifications from CompTIA and (ISC)2 but not from the SANS Institute or vendors.

Lentz said the certifications ensure that information assurance employees have adequate hands-on experience. Combined with additional specialized training that commanders provide on-site, they will ensure sufficient security for mission-critical systems, he added.

CompTIA and (ISC)2? Wonderful. Even I will admit that SANS certification holders are far more technically equipped than CompTIA Security+™ or CISSP holders.

It is a tragedy that the CISSP has become associated with "hands-on" technical proficiency. And what of CompTIA?

The CompTIA Security+ certification tests for security knowledge mastery of an individual with two years on-the-job networking experience, with emphasis on security.

"Two years" and "security knowledge mastery" should not be in the same sentence.

I may have more to say on this topic after I attend tonight's ISSA-NoVA meeting. The subject is 8570.1.

Read More

Should I Accept New ISC(2) Certification Agreement?

Today I received an email from the International Information Systems Security Certification Consortium, Inc., ISC(2), that read, in part:

"The purpose of this notice is to provide information regarding the status of your (ISC)² certification.

Our records indicate that your anniversary date is near and your Annual Maintenance Fees are current. As you are aware, a total of 120 Continuing Professional Education (CPE) credits, of which at least 80 must be Type 'A' credits, are required to be submitted during each three year certification period in order to maintain your credential. Our records indicate that, based upon your CPE submissions to date, you are not on track to meet your recertification requirements at the end of the three year period. We urge you to pay close attention to this matter to avoid the expiration of your CISSP credential."

OH NO! Time for me to log in to the ISC(2) Web site to record in some of the hundreds of CPEs I haven't logged. However, as soon as I entered my credentials, I see this:

---

Certification Agreement

IT IS IMPERATIVE THAT YOU CAREFULLY READ THE FOLLOWING TERMS AND CONDITIONS. IF YOU ACCEPT ALL OF THE TERMS AND CONDITIONS CONTAINED IN THIS AGREEMENT, INDICATE BY SELECTING THE "ACCEPT" BUTTON AT THE BOTTOM OF THIS AGREEMENT. IF YOU DO NOT ACCEPT ALL OF THE TERMS AND CONDITIONS CONTAINED HEREIN, INDICATE BY SELECTING "DECLINE". IF YOU DO NOT ACCEPT THE TERMS OF THIS AGREEMENT, YOU SHALL NOT OBTAIN CERTIFICATION AND YOU MAY NOT USE THE CISSP, SSCP or CAP LOGOS.

This Certification Agreement ("Certification Agreement") is entered into as of the date set forth ("Effective Date") on the Application Agreement ("Application Agreement") by and between the undersigned ("Certification Candidate") and the International Information Systems Security Certification Consortium, Inc. "(ISC)²".

---

This doesn't look so great. As I read through the text (which you can retrieve as a .pdf here, I find this section (all emphasis additions are mine):

---

6. CONFIDENTIALITY.

6.1 Certification Candidate agrees that to the extent (ISC)² previously disclosed or currently or subsequently discloses to the Certification Candidate, or the Certification Candidate learns from (ISC)², information relating to (ISC)²'s Exams, products or sensitive aspects of (ISC)²'s business (including without limitation, computer programs, names and expertise of employees and consultants, know-how, business, financial, customer and product development plans, forecasts, questions, answers, worksheets, computations, drawings, diagrams, length and/or number of Exam segments and/or questions, or any communication, including verbal communication regarding or related to the Exam, the identity of Exam administrators, and other Exam takers, price and cost data, price and fee amounts, pricing and billing policies, marketing techniques, future plans and potential strategies of (ISC)² which have been or are being discussed), such information shall be deemed the confidential property of (ISC)² ("Proprietary Information"). Certification Candidate recognizes and acknowledges that (ISC)²'s Proprietary Information (and the confidential nature thereof) is critical to (ISC)²'s business and that (ISC)² would not enter into this Agreement without assurance that its Proprietary Information and the value thereof will be protected as provided in this Section and elsewhere in this Agreement.

6.2 Certification Candidate agrees (i) to hold (ISC)²'s Proprietary Information in confidence as a fiduciary and to take all reasonable precautions to protect such Proprietary Information, (ii) not to use such Proprietary Information at any time during or following the term of this Agreement, except as contemplated by this Agreement, and (iii) that to not disclose, publish, disclose, reproduce or transmit any Proprietary Information to any third party, in any form, including without limitation, verbal, written, electronic or any other means for any purpose.

---

Are they serious? What am I supposed to do with this confidential and proprietary information from the front matter of the CISSP Prep Guide?

"The Examination The examination questions are from the CBK and aim at the level of a three to five-year practitioner in the field. It consists of 250 English language questions, of which 25 are not counted..."

I am honestly considering clicking the "do not accept" button. I wonder if this blog post will upset ISC(2) enough to revoke my CISSP anyway?

---

2.2 Certification Revocation. (ISC)² may, at its sole discretion, revoke a Certification Candidate's certification under the following circumstances:
...edited...
2.2.5 Upon (ISC)²'s determination at its sole discretion that Certification Candidate has acted in any manner contradicting the (ISC)² Code of Ethics, that sullies or reflects poorly on the Mark, or involves any form of dishonesty or the giving of a false statement...

---

What should I do? Have you accepted this new "agreement?"

Read More

Demand for a BSD Associate Certification Guide

I have an idea for a new book. For the last year I have been part of
the BSD Certification Group (BSDCG). I started out as a Group member, but moved to the Advisory Board when TaoSecurity business occupied too much of my time.

Last month the BSDCG published its BSD Associate Exam Objectives (.pdf) The document outlines all the skills a candidate for the BSD Associate cert is expected to have. However, no specifics are given. For example:

3.2.12 Change the encryption algorithm used to encrypt the password database.

Concept:

Given a screenshot of a password database, the BSDA candidate should be
able to recognize the encryption algorithm in use and how to select
another algorithm. The candidate should also have a basic understanding
of when to use DES, MD5 and Blowfish.

Practical:
login.conf(5); auth.conf(5); passwd.conf(5); adduser.conf(5) and adduser(8)

I am considering writing a BSD Associate Certification Guide. The guide will cover all of the 7 domains on the cert:

1. Installing and Upgrading the OS and Software
2. Securing the OS
3. Files, Filesystems, and Disks
4. Users and Accounts Management
5. Basic System Administration
6. Network Administration
7. Basic Unix Skills

Half of the work is already done. I know everything that needs to be covered. What I need to do now is provide answers to the questions.

What do you think? Would you like a book that addresses all of the seven domains for all of the BSD OS' covered by the cert (FreeBSD, NetBSD, OpenBSD, DragonFly BSD)?

Read More

BSD Certification Group Solicits Donations

The BSD Certification Group is soliciting donations to offset the costs of creating the certification. The main expense is psychometric analysis of the proposed certification exam. This is fancy talk for ensuring the test assesses what the BSD Certification Group expects to measure. The BSDCG was incorporated as a non-profit corporation (a 501(c)(3) scientific and educational charitable organization) in the state of New Jersey, but the IRS has not validated their status yet.

Read More

BSD Certification Group Publishes BSD Associate Exam Objectives

Last week the BSD Certification Group published its BSD Associate Exam Objectives (.pdf). The preface of the document explains its purpose:

"This document introduces the BSD Associate (BSDA) examination and describes in considerable detail the objectives covered by the exam. The exam covers material across all four major projects of BSD Unix - NetBSD, FreeBSD, OpenBSD and DragonFly BSD.

While the testing candidate is expected to know concepts and practical details from all four main projects, it is not necessary to know all the details of each one. A thorough reading of this document is recommended to understand which concepts and practical details are expected to be mastered.

Throughout this document, a clear distinction is placed on 'recognizing' and 'understanding', versus 'demonstrating' and 'performing'. Certain objectives call for the mere understanding of certain topics, while others call for the ability to demonstrate performance level knowledge of the topic...

Successful mastery of the BSDA examination will, in most cases, require study and practice. The requirements for the exam encompass more background in BSD than is common among casual users or those new to BSD. This is a deliberate decision by the BSD Certification Group- to encourage more cross learning among BSD systems so that breadth of understanding of BSD is as heavily tasked as depth of understanding. The result will be a more well-rounded BSD advocate and a more knowledgeable system administrator."

The objectives describe seven domains:

1. Installing and Upgrading the OS and Software


2. Securing the OS


3. Files, Filesystems, and Disks


4. Users and Accounts Management


5. Basic System Administration


6. Network Administration


7. Basic Unix Skills

Inside the document describes the audience for the certification:

"The BSDA certification is designed to be an entry-level certification on BSD Unix systems administration. Testing candidates with a general Unix background, but less than six months of work experience as a BSD systems administrator (or who wish to obtain employment as a BSD systems administrator) will benefit most from this certification."

Also:

"[T]he SDA certification is only valid for 5 years. Existing BSDAs who wish to maintain their certification will need to recertify every 5 years. Details on how to recertify will be publicly available in a document to be published in 2006."


I like this approach. I disagree that DragonFly BSD should be included, since something like 2% of all BSD administrators use DragonFly.

The guide is 57 pages long, so I will need time to read everything. At first glance it looks like great work.

Although I am still listed on the about us page, I have requested resignation as I have absolutely no time to work on the project while running TaoSecurity.

Read More

BSD Certification Group Publishes Usage Survey

The BSD Certification Group is looking for people to complete a BSD Usage Survey. The survey consists of 19 questions. It took me less than five minutes to complete it. You can read more about the survey in this press release and the news section. Please complete this survey if you use any of the BSDs. It will help us better design a BSD Certification for you. Thank you!

Also, the August newsletter has been published, and you can track BSD certification progress at our BSD Certification Group Blog.

Read More

Thoughts on NSA IAM Course

Today I finished the NSA INFOSEC Assessment Methodology (IAM) class taught by two great instructors from EDS and hosted in the beautiful Nortel PEC building in Fairfax, VA. I attended because the rate offered by EDS through my local ISSA-NoVA chapter was an incredible bargain. I did not realize prior to the class that NSA posts the exact slides used to teach the course online.

The course was much more applicable to my line of work than I realized. I've decided to apply the methodology to the assessments I perform on customer network security monitoring / intrusion detection / prevention operations. Rather than use my own methodology, I plan to use the IAM system to perform hands-off assessments of the operations customers conduct to detect intrusions. I will be performing one of these assessments in the near future, so I look forward to applying lessons from IAM to this consulting work.

I am scheduled to attend the two-day INFOSEC Evaluation Methodology (IEM) class next month through ISSA-NoVA again. The IEM is a hands-on affair where technical means are used to discover vulnerabilities.

Read More

What the CISSP Should Be

Today I saw a new comment on my criticism of the ISC2's attempt to survey members on "key input into the content of the CISSP® examination." Several of you have asked what I would recommend the Certified Information Systems Security Professional (CISSP) exam should cover. I have a very simple answer: NIST SP 800-27, Rev. A (.pdf).

This document, titled Engineering Principles for Information Technology Security (A Baseline for Achieving Security), is almost exactly what a so-called "security professional" should know. The document presents 33 "IT Security Principles," divided into 6 categories. These principles represent sound security theories. For future reference and to facilitate discussion, here are those 33 principles.

1. Security Foundation




• Principle 1. Establish a sound security policy as the “foundation” for design


• Principle 2. Treat security as an integral part of the overall system design.


• Principle 3. Clearly delineate the physical and logical security boundaries governed by associated security policies.


• Principle 4. Ensure that developers are trained in how to develop secure software.




2. Risk Based




• Principle 5. Reduce risk to an acceptable level. [Note: It does not say "eliminate risk;" smart.]


• Principle 6. Assume that external systems are insecure. ["External" here means systems not under your control.]


• Principle 7. Identify potential trade-offs between reducing risk and increased costs and decrease in other aspects of operational effectiveness. [The wording is poor. The idea is to identify situations where information owners decide to accept risks in order to satisfy other operational requirements.]


• Principle 8. Implement tailored system security measures to meet organizational security goals.


• Principle 9. Protect information while being processed, in transit, and in storage.


• Principle 10. Consider custom products to achieve adequate security.


• Principle 11. Protect against all likely classes of "attacks."




3. Ease of Use




• Principle 12. Where possible, base security on open standards for portability and interoperability.


• Principle 13. Use common language in developing security requirements. [In other words, definitions matter.]


• Principle 14. Design security to allow for regular adoption of new technology,
  including a secure and logical technology upgrade process.


• Principle 15. Strive for operational ease of use.




4. Increase Resilience




• Principle 16. Implement layered security (Ensure no single point of vulerability).


• Principle 17. Design and operate an IT system to limit damage and to be resilient in response.


• Principle 18. Provide assurance that the system is, and continues to be, resilient in the face of expected threats.


• Principle 19. Limit or contain vulnerabilities.


• Principle 20. Isolate public access systems from mission critical resources (e.g., data, processes, etc.).


• Principle 21. Use boundary mechanisms to separate computing systems and network infrastructures.


• Principle 22. Design and implement audit mechanisms to detect unauthorized use and to support incident investigations. [In other words, from the network side, this means network security monitoring.]


• Principle 23. Develop and exercise contingency or disaster recovery procedures
  to ensure appropriate availability.




5. Reduce Vulnerabilities




• Principle 24. Strive for simplicity.


• Principle 25. Minimize the system elements to be trusted.


• Principle 26. Implement least privilege. [Note: The text also recommends "separation of duties."


• Principle 27. Do not implement unnecessary security mechanisms.


• Principle 28. Ensure proper security in the shutdown or disposal of a system.


• Principle 29. Identify and prevent common errors and vulnerabilities.




6. Design with Network in Mind




• Principle 30. Implement security through a combination of measures distributed
  physically and logically.


• Principle 31. Formulate security measures to address multiple overlapping information domains.


• Principle 32. Authenticate users and processes to ensure appropriate access control decisions both within and across domains.


• Principle 33. Use unique identities to ensure accountability.

Given these principles, the next step is to devise practices or techniques for each. For example, Principle 26 states "Implement least privilege." Practices or techniques include (but are not limited to) the following, which represent my own thoughts; NIST does not reach to this level:

• Create groups which provide functions needed to meet an operational requirement.


• Operate mechanisms which allow temporary privilege escalation to accomplish specific tasks.


• Assign systems administrators the primary task of administering systems. Assign security operators the primary task of auditing system use.

I recommend the exam not delve deeper into specific implementations or tools. One could imagine what those would be, however. Here are examples from FreeBSD; again, these are my thoughts:

• Use the group functionality and assign privileges as required. (Windows might provide a better example, given the number of groups installed by default and their variety of privileges.)


• Use sudo to execute commands as another (presumably more powerful) user.


• Configure system logging though syslog and export logs to one or more remote, secure logging hosts under the control and review of the security team. Consider enabling process accounting via acct. Also consider implementing Mandatory Access Controls.

I do not think an exam like the CISSP should delve as deep as implementations or tools. Staying at the levels of theory/principle and techniques/practices is vendor-neutral, more manageable, and less likely to become obsolete as technologies change.

While I may not be happy with all of NIST's principles, they are much more representative of what the CISSP should address. As a bonus, this NIST publication already exists, and the sorts of people who haggle over principles like these tend to gravitate toward documentation from .gov institutions. Furthermore, one of the better CISSP exam prep guides references the older version of SP 800-27: The CISSP Prep Guide: Mastering the CISSP and ISSEP Exams, 2nd Edition, by Ronald L. Krutz and Russell Dean Vines. In fact, the exact chapter mentioning 800-27 principles (albeit the 2001 versions) is online (.pdf).

A Google search of cissp 800-27 only yields 48 hits, meaning not too many people are making the link. Krutz and Vines have, which is a great start.

What do you think?

Read More

BSD Certification Group Publishes Certification Roadmap

Yesterday the BSD Certification Group published the Certification Roadmap (.pdf). I realize I have been beaten by Slashdot on this story, but I have been either teaching or in training all week! (More on that when I have time -- I return to class tomorrow.) From the press release:

"The BSD Certification Group has decided that the associate level certification, followed by the professional level certification, will be rolled out in 2006. The associate certification targets those with light to moderate skills in system administration and maps to the Junior SAGE Job Description. The professional level certification is for those with stronger skills in BSD system usage and administration and maps to the Intermediate/Advanced SAGE Job Description."

Having participated in the internal voting process for this certification, I am pleased to see a two-cert approach. We will start with the junior cert; "the test activation goal for the associate level certification is April 5, 2006."

Read More

Request for Comments on NSA IAM and NSA IEM

Does anyone have experience with NSA's Infosec Assessment Methodology and Infosec Evaluation Methodology? Through my local ISSA chapter, I've signed up to take courses on both programs for a combined price less than that offered for the IAM alone at another venue. Being a consultant in the DC metro area, I believe I am going to hear NSA IAM and IEM mentioned more frequently. Any thoughts?

Read More