CISSP

Brother Andy sums up nicely the debate that has been happening on the Security Bloggers Network (see right column) about CISSP.

He also sums up most of what I think of the Cert:

• It shows that the person is serious about security.
• It opens doors. Even Australian immigration.
  
• It is easy for headhunters to spot. And match up with.
• The ISC2 is a problematic organisation.
• CISSP is not for everyone.

Of course, I have my bit to add:

Terry Pratchett writes amazing stories with some deep concepts. One word he created (or at least a Witch of his Disk World created) is headology. Basically, a witch will never be caught without her hat because once the hat is on anything the witch does, magic or not, will be seen to have been done through the use of magic.

I believe the CISSP is our headology. For security people to be taken seriously we need the tools to make people we are serious and that includes (for better or worse) a professional organisation such as the ISC2 and a certificate of membership - the CISSP.

Having a CISSP doesn't make me very more knowledgeable about Information Security than the me before the exam but it does show that I am serious about Information Security and want to be seen as an Information Security Professional.

It also helps in Information Security debates to sign the extra little letters with a flourish. Headology.

The Wall Street Journal Followup

Since my posting on the 7th, the Wall Street Journal has posted a follow-up article here

It is by the same author who obviously was not aware of my post because she gets most of it wrong again. She chose to ignore Andy's input too. I found out about this follow-up from his Blog,thank you Andy.

My original post basically pointed out the main problem in her article which is that the Information Security policies that she is showing how to bypass are not made up by IT but by the security department. More to the point, they are signed off by upper management and by breaking them you can get into serious trouble with the Boss. Failing that the Boss himself may get into serious trouble with the law.

The author writes in this article about how "IT workers said they get blamed both by employees who feel too restricted and by company executives who, when things go wrong, fume that policies must not have been restrictive enough."

At the end of the day its not the It Guys who should be enforcing security, they have enough on their plates. It is business people themselves who should be enforcing the rules.

The IT department is usually the least respected department, it hires young people who don't know the art of dealing with people, especially those in upper management. More importantly - they are enablers. They fix things and make things work and that is how they are rated. They are also clueless (or they should be anyhow) about what information is important anyhow.

What about the fools in the Information Security department I hear you ask. They are there to make sure that Information Security is done, yes. But, at the end of the day neither them nor the IT guys will be in big trouble if Information is lost or leaked. Or wrong decisions are made using altered documents. It will be Business that pays. So, why have these lazy Information Security guys around in the first place? Really, its to inform the business people and to help them with implementing security.

If your staff are knowingly breaking rules that you have put in place... well... no Firewall, IDS or Antivirus or amazing CISSP is going to save your data.

I think that the WSJ has missed an opportunity to push the idea that Information Security is important and that the rules are there for a reason and that breaking them will not only upset the guys in IT but can make an employee lose the respect of his/her employers and possibly even his/her job.

What?

My Blog is called "Security Thoughts" which is rather plain but explains pretty much what it is about.

It is about Information Security more than physical security but those of you who, like me, have a CISSP or other such qualification know that physical security plays a big part in Info Sec. As does having a "security conscious" mindset.

I would like to just dump all the thoughts in my mind onto this page (and from now on I will use Firefox ver2 with its spell check function). But I am interested in Information Security so that will be the main focus of this Blog. But I don't want to limit myself.

Stay tuned.