Blog Elements

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

IT Security Certification (Part 2)

2012-03-20/0 Comments/in IT Certifications/by admin

According to a survey by InfoSecurity magazine that stated IT professionals’ average salaries overall decreased by 5.5%, while those in IT security increased by 3.1% show that experience in security is a valuable skill.

Furthermore, The US Department of Defense (DoD) Directive 8570.1-M requires every part-time or full-time military member or defense contractor that has access to a privileged DoD system to be held by trained and CERTIFIED personnel in a commercial certification to enhance Information Assurance (IA) of the US Department of Defense’s (DoD) information, information systems, and networks.

The Federal System’s Need for a Security Assessment Process, Part 2: Categories of Security Assessments

2012-03-20/0 Comments/in Vulnerability Assessment/by admin

Security assessments can fall into many categories and an organization’s core competency often dictates which ones management is more interested in conducting. For example, an organization that has an external presence may be very interested in how they appear to the outside world and how well they are protecting their internal resources from external entities trying to harm them. Whereas, another governmental institution maybe more concerned with their internal security posture and controls as compared to how they appear to the outside world. They may have a pressing need to verify internal access control, password compliance and proper network segmentation as opposed to what protocols are accessible from the public network. The actual type of assessment performed usually depends on the organization’s mission as well as their overall security need.

IT Security Certification (Part 2)

2012-03-20/0 Comments/in IT Certifications/by admin

The Federal System’s Need for a Security Assessment Process, Part 2: Categories of Security Assessments

2012-03-20/0 Comments/in Vulnerability Assessment/by admin

Full Sized Blog Element (Big Preview Pic)

IT Security Certification (Part 2)

2012-03-20/0 Comments/in IT Certifications/by admin

So how important is it to be certified if you want to work in the IT Security field? I would say important.

Being certified displays competency in IT security related terms and concepts. As a hiring manager, who has to interview over 100 candidates, having someone who speaks the IT Security language is helpful.

When looking into certification, you have vendor neutral and vendor specific IT security certifications. Below are a list of some of the more popular certifications:
Security+
Requires: 1 Exam
Approximate Cost = $199 ($149 for CompTIA members)

Application Security

ISC2 Certified Secure Software Lifecycle Professional (CSSLP)

GIAC Secure Software Programmer – Java (GSSP – JAVA)

GIAC Secure Software Programmer – .NET

The Show the software developer to think like an attacker

Auditing

ISACA CISA

GIAC Security Audit Essentials

Management

CISSP

CISM

Penetration Testing

CEH

GIAC’s Certified Intrusion Analyst

Certified Penetration Tester (CPT)

Certified Expert Penetration Tester (CEPT)

Wireless

Certified Wireless Security Professional (CWSP)

Windows Security

GIAC Certified Windows Security Administrator (GCWN)

Computer Forensics

CHFI

ACE

EnCe

Foote Partners’ “IT Skills and Certification Pay Index – Q3 2011 edition” indicates that the following security certifications translate into the highest pay premiums:

Certified Information Systems Security Professional (CISSP)

Information Systems Security Engineering Professional (CISSP/ISSEP)

GIAC Secure Software Programmer –.NET

CyberSecurity Forensic Analyst

Certified Information Security Manager (CISM)

Certified Information Systems Auditor (CISA)

Cisco Security Solutions and Design Specialist

GIAC Reverse Engineering Malware (GREM)

GIAC Secure Software Programmer –Java

GIAC Systems and Network Auditor (GSNA)

Information Systems Security Architecture Professional (CISSP/ISSAP)

Security Certified Network Architect

Check Point Certified Master Architect (CCMA)

The Federal System’s Need for a Security Assessment Process, Part 2: Categories of Security Assessments

2012-03-20/0 Comments/in Vulnerability Assessment/by admin

In addition, the availability of suitable security assessment equipment, technical skills and resources available to the agency plays a big part as well. Such security assessment categories include the basic security assessment, an in-depth security assessment, external vulnerability security assessment and the internal vulnerability security assessment.

Whether the assessment is conduct by internal organizational employees or outsourced through an external contractor, the results from each assessment category will provide insight to verify the level of security on network resources. The following security assessment categories have been further defined below.

Basic Security Assessment – The objective of a Basic Security Assessment is to give the agency a fundamental understanding of its security posture as a whole in three key areas: Administrative, Physical and Technical. It is meant to point out possible areas of weakness with a walk through of the facility and a briefing at the end. It is not an in-depth study, rather, a basic first step in protecting information.

In-depth Security Assessment – The In-depth security assessment is a comprehensive study of the security of the agency. An examination of all policies, procedures, hardware and software configurations, workstations, servers, websites and mail servers are examined. The results will then be presented via a written report of the findings. This type of assessment will provide the agency with a thorough understanding of how it has complied with FISMA regulations.

External Vulnerability Security Assessment – An External Vulnerability Security Assessment will test the agency’s network from the outside in respects to a “hacker’s point-of-view”. Often the assessor uses the same tools used by external malicious individuals to try to compromise a network.

Internal Vulnerability Security Assessment – This type of assessment occurs inside the organization’s network. It is essential in understanding how and why hackers, viruses and worms spread so quickly through an organization once a breach has occurred. The results of this assessment can aid in providing additional measures to prevent an incident from spreading to critical areas. The same tools used in the External Vulnerability Security Assessment are often used in the Internal Vulnerability Security Assessment as well for real world simulation and accuracy.

Read the rest here.

Read part 1 here.