Home page logo
/

pen-test logo Penetration Testing mailing list archives

RE: My Frustrations
From: Sat Jagat Singh <flyingdervish () yahoo com>
Date: Fri, 19 Dec 2008 09:39:47 -0800 (PST)

These are some good points that you raise.  I did a little bit of searching for professional associations that might 
provide unbiased information to organizations looking to engage security consultants.  I had in mind an organization 
that does not endorse a specific certification but would provide a summary of all or most of the relevant ones that 
exist and how they might fit with different kinds of job tasks.  There doesn't appear to be such an organization.  I'm 
sure various individuals have published such reviews.  I know I've seen a lot of banter about it on forums.  But I 
couldn't find such a professional association that doesn't also do certifications themselves, which they promote.  Does 
anybody know of such?  The key here is that all of the reputable organizations promote their own certification and 
don't say very much about any competing ones. I am primarily interested in associations that a U.S. company might look 
to for guidance, but it would
 be interesting to know if such a group has any clout elsewhere in the world.

ISSA might be a good forum for this.  I'm not a member.  Maybe time to go join.


--- On Thu, 12/18/08, Shenk, Jerry A <jshenk () decommunications com> wrote:

From: Shenk, Jerry A <jshenk () decommunications com>
Subject: RE: My Frustrations
To: "pen-test list" <pen-test () securityfocus com>
Date: Thursday, December 18, 2008, 4:31 PM
Is being licensed really all that different from certified? 
I don't
know too many teachers but I know a couple really lousy
ones and every
couple days, I hear some horrible story about a teacher who
had sex with
a student or....  There are bad examples in the medical
profession too
and they're all licensed.  And drivers...they all have
licenses.  My
town requires plumbers and electricians to be licensed and
they also
require that one of those guys who is playing the system
review my work
if I want to do something myself.  I'll bet we can all
come up with
electrical and plumbing stories.

No, I don't think licensure is the answer.  I think
personal
responsibility both from the practitioner and the one
needing the
service (or the checkbox;) is what's really needed.

-----Original Message-----
From: listbounce () securityfocus com
[mailto:listbounce () securityfocus com]
On Behalf Of Sat Jagat Singh
Sent: Thursday, December 18, 2008 6:54 PM
To: pen-test list
Subject: Re: My Frustrations

Having read your blog post, I would say that I share some
of these
frustrations.  But many organizations are really only
trying to cover
their asses and put a check in the box to say that, yes we
got an
assessment done to satisfy the letter of the regulations. 
These are
companies that are more concerned about the cost of the
project than the
actual security.  While such people tend to get what they
deserve, it
does create a negative reputation for the profession as a
whole.

Yes, I do think it is a "profession", but we have
not "professionalized"
ourselves by requiring licensing.  The industry reliance on
certification rather than licensing as a credential
somewhat serves to
muddy the waters because the decision makers hiring
security consultants
don't really know what a given certification covers. 
We could debate
the value of different certifications until the cows come
home but I
don't want to insult anyone and we can probably agree
that too many of
them do not guarantee that the holder has real
qualifications and the
security unsavy will never really know how to evaluate
that.  More and
more I lean toward some form of professional licensure. 
One of the
states will have to move in this direction before a serious
debate about
it will be opened.  Until then, caveat emptor.


--- On Wed, 12/17/08, Adriel T. Desautels
<ad_lists () netragard com>
wrote:

From: Adriel T. Desautels
<ad_lists () netragard com>
Subject: My Frustrations
To: "pen-test list"
<pen-test () securityfocus com>
Date: Wednesday, December 17, 2008, 11:19 AM
I recently wrote this blog entry and wanted to get
some
comments from readers of this list. I'm frustrated
with
the caliber of the people that are offering security
services and posing as experts, thats the subject of
the
post. Please comment, insult, whatever... I'm
interested.

http://snosoft.blogspot.com/


Adriel T. Desautels
ad_lists () netragard com





------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report

------------------------------------------------------------------------




------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


**DISCLAIMER
This e-mail message and any files transmitted with it are
intended for the use of the individual or entity to which
they are addressed and may contain information that is
privileged, proprietary and confidential. If you are not the
intended recipient, you may not use, copy or disclose to
anyone the message or any information contained in the
message. If you have received this communication in error,
please notify the sender and delete this e-mail message. The
contents do not represent the opinion of D&E except to
the extent that it relates to their official business.

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


      

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Security Trends Report from Cenzic
Stay Ahead of the Hacker Curve!
Get the latest Q2 2008 Trends Report now

www.cenzic.com/landing/trends-report
------------------------------------------------------------------------


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault