I say yes.

Martin McKeay from Network Security Blog disagrees. He writes:

I kind of like Daniel Miessler’s writing and think he has some good posts, but he totally misses the point of the CISSP when he complains about CISSPs who can’t program a home network. The CISSP isn’t aimed at testing someone’s ability to program their Linksys router, it’s aimed at testing someone’s ability to think about the philosophy of security.

Ok, here’s the thing: part of the CISSP is technical. They cover everything from trojans to encryption algorithms to covert channels. It’s just an overview, but it’s part of the CBK for a reason.

If the fundamental networking knowledge required to configure a Linksys router isn’t within a candidate’s grasp, then they shouldn’t be discussing security philosophy with anyone. As Martin points out, this is a management certification. Don’t we already have enough managers who learn big buzzwords like risk management and don’t know even the fundamentals of that which they are trying to protect?

Why do you think they teach generals how to fight and require them to move up the ranks before letting them command large armies? It’s because that knowledge of the lower-level capabilities is what offers the foundation for making sound decisions at the higher levels.

Think about the decisions that security managers are supposed to be making — how to implement a DMZ, host IPS vs. network IPS, DLP?, NAC?, how to publish information in a secure fashion within an extranet. Can one effectively make these decisions without basic networking knowledge? One can say, “secure that”, but if you don’t have any knowledge of what it entails then you’re not adding any value to the organization.

Quite simply, managers who don’t know the basics are dangerous. They have all the power and none of the knowledge. This combination leads to frustrated employees, poor policy making and negative outcomes for their organization.:

www.escrimaconcepts.com

After nearly 15 years of following MMA I’m finally getting physically involved.

I’ve found a Brazilian Jiu-Jitsu school in town that looks really decent. I’ve always wanted to learn the basics of this incredible martial art and the health benefits are compelling as well.

Overall it should be very positive. I’m looking forward to it and will surely have much to say about it as I progress.

plover.net

I am not a conspiracy guy, but I just had a scary thought.

Many of us have heard about some guy who is betting nearly 1 Billion dollars on a massive stock market crash. Well the trick is that it has to happen by September 21st or they won’t get their money. So their bet is that it will happen between now and then.

Naturally, insider trading comes to mind. In other words, what if someone knows that something big is about to happen? There’s a lot of speculation about this all over the Internet, but most of the talk hinges on something happening financially before then.

But what if it’s not a purely financial event? What day falls between now and then? Uh, September 11th. So what if there’s some kind of pre-planned event that’s going to go down between now and then that’s going to rock our economy? If someone were to know about that in advance it’d be pretty smart to do what they just did.

Stupid conjecture, to be sure. But with all this stuff going on in the world and September 11th coming up it’s worth thinking about for at least a few seconds before you dismiss it as lame.:

Google is releasing a phone soon (possibly Q1 2008). It’s going to run on HTC hardware. It’s going to be sick. This we know.

Google vs. Apple. I don’t see anyone else in this game right now. Everyone else will be trying to catch up via imitation. A few points/predictions:

• The overall web service integration (Google services, obviously) is going to be extremely tight. Camera -> Picasa. Compose Document -> Google Docs. Local email app -> Gmail. Etc. So they’ll present a nice “local” interface (think Gears), but the backend will tie directly to their online services.
• I see GPS/map integration like we’ve never seen. I think this is going to be their primary application. Not just better maps — better GPS with the maps. It’s going to be like the movies for the first time, i.e. more real-time and smooth.
• I see them doing some serious online syncing. All settings, contacts, etc. all being on the server side. Backing up will be automatic and transparent, and restoring will be almost as seemless as soon as the network recognizes it’s you.
• Google Docs is going to be insanely nice. It’s going to be the first REAL implementation of word processing on a phone form factor.
• Their major downside is going to be not having the hardware slickness of the iPhone. So while the OS might be incredibly awesome, stable, and efficient — the overall feel will suffer compared to the iPhone package — especially after the iPhone update.
• I see cost being around $250-$350 — purposely way below iPhone.

Overall? Google will have the features that Apple wished they had — most of which will hinge on their strong web services presence. But Google will still envy Apple’s monopoly on lust.

The overall package of the iPhone (especially after the update) will make it VERY hard for people to leave it once they’ve experienced one. But the same will go for anyone who gets used to the features on the Google phone. It’s going to become a matter of which you get spoiled on first.

So, Apple will lower their entry point for the iPhone (the cheaper version) by at least $100 and try like hell to develop some web services that can compete. Google will grumble because HTC won’t make anything as elegant as the iPhone, and they’ll start looking for a hardware platform that can compete with the beauty that is the black marble slab.:

Excellent hacking music. Check them out on iTunes under Radio -> Electronic. Oh, and they stream at 256kbps. Smile.

[ Etn.fm ]

 

So much of what I think and believe has run tangents to these core concepts. And yet I’ve only now discovered them.

[ Constructive Epistemeology ]

[ Essentialism ]

[ Realism ]

I could spend 5 lifetimes just reading.

episteme

EPISTEME

(eh-piss-TEE-mee)

“A system of understanding or a body of ideas which give shape to the knowledge of that time.”

Many have been hearing a lot about Ron Paul lately — have heard some things they like — but aren’t sure exactly where he stands on the issues. Well, he’s actually a real candidate now. He’s not some random, fringe guy anymore. He’s winning straw polls, he’s making it onto mainstream media outlets, and he’s getting people involved.

Here’s a collection of some of the main points of interest about him and his beliefs. This is why he’s so appealing, and why he’s starting to worry the competition.

• He’s a conservative libertarian who’s running as a traditional republican, i.e. he’s for small federal government, individual liberty, and states rights.
• He voted against the Patriot Act.
• He’s for re-implementing the gold standard so that our money actually means something again.
• He’s a medical doctor (M.D.), served as a flight surgeon in the Air Force, and is an active congressman from Texas.
• He’s known for impeccable honesty and for not flip-flopping on issues.
• He is pro-life, but doesn’t think the federal government should have any say in legalizing or banning abortion.
• He doesn’t believe gay marriage is a Federal issue either, and thinks they should stay out of it.
• He’s also against capital punishment for the same reason he’s pro-life (he’s pro-life).
• He’s for lowering taxes.
• He introduces numerous pieces of substantive legislation each year, probably more than any single member of Congress.
• Supports the medical use of cannabis (marijuana).
• Believes in allowing the hemp industry to thrive.
• Doesn’t believe in the effectiveness of a “war on drugs”.
• He doesn’t participate in the lucrative congressional pension program.
• He wants to get out of other peoples’ business and focus on our own problems.
• He is against the Iraq war, and always was. He wants us to come home as soon as possible.
• He’s serious about fixing the immigration problem.
• He believes in, and has voted consistently for, an open and free Internet.
• He strongly supports the concepts of privacy and personal freedom laid out by the forefathers of this country, and would rigorously defend Habeus Corpus.
• He’s strongly pro-second-ammendment.
• He also supports property rights and the eminent domain, meaning the government shouldn’t be allowed to simply confiscate people’s land and homes out of greed.

My point to those of you reading this is simple — get involved this time around. 2008 is the year for you to participate, and the best way you can do that is by wielding the Internet to share ideas.

There are so many of us out there who bitch and moan and don’t do anything about it. We have representation in congress and in the senate, but we don’t contact them. Many of us don’t even vote. Well it’s time to get involved. There is momentum behind the little guys with big ideas this time. Let’s not waste it.

If Ron Paul is the type of candidate that actually inspires within you a glimmer of hope in our democracy, the way he does in me and many others, I ask you to please pass this link, the sources below, his videos on YouTube, etc. on to others. Watch the debates, learn about the candidates, get involved.

If we fail, we fail. But at least we will have tried. We can’t complain about a failed democracy in which we never participated. Please participate.:

–

Ron Paul Website http://www.ronpaul2008.com/html/Issues_fx.html

The Political Positions of Ron Paul http://en.wikipedia.org/wiki/PoliticalpositionsofRonPaul

Austrian Economic Theory http://www.mises.org/

The Ron Paul Archives http://www.lewrockwell.com/paul/paul-arch.html

aotmp.com

I’ve had some discussions about how the GIAC GSEC credential compares to the CISSP in terms of difficulty and respectability. Here is one such discussion from a forum I frequent.:

The main reason the CISSP in more respected is because of the standards the ISC2 has established, such as proving the identification of the applicant, verifying they meet the experience requirements, and the way the exam is hosted.

That definitely earns the exam some respect, to be sure, but keep in mind that the first time pass rate is over 70%.

I would give you this analogy: The CISSP is like taking the SAT’s You walk into a room with just a pencil and take a 6hr, 250 question exam that many of the times has more than 1 right answer but you have to draw on your experience to determine which one is “more right” The GSEC is like creating and turning in an Essay and taking an open book test.

Ok, let me put it this way, which of those two scenarios do you think represents reality in the infosec world? Cramming facts and regurgitating them via #2 pencil, or dealing with harder, more technical questions with access to any book and any search engine you want?

It’s the latter.

That’s what problem-solving is — you have Google, you have the text books, you have anything you want. That doesn’t make complex problems easy, it just makes them possible. That’s how the real world works.

Put it this way, I’d be willing to bet that 50% of all CISSPs don’t know what netcat is. What does that say about their infosec skills? What percentage of GSEC holders know what it is? Probably 99%.

Don’t confuse world-wide acceptance with proof of superiority. CISSP is standard, it requires experience, and it’s got a good, broad base of questions, but it’s the kind of test people cram for, pass, and then forget the material it was made up of. That’s not a good measure of a dedicated, technical infosec professional; it’s more a measure of someone who takes their career seriously and knows how to study.

I’ve met CISSPs who can’t configure a home network — no joke. Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials.

More than I can a test that has a 70% first-time-pass rate that’s explicitly designed for managers and non-technical types. It’s for a wide, wide base of knowledge - not for testing whether or not you’d be qualified to actually do anything.

Don’t get me wrong, if you are going to do one first, or only one of the two, I’d say get the CISSP. It’s more recognized and more respected than any other cert out there. All I am saying is that you shouldn’t confuse this with its difficulty. Almost nobody knows anything about the GSE certification either, but the two PhDs that have it said it was harder to get than their degrees.

I think after you have both you may see it more the way I do. I’d hire a GSEC holder to do some security on a network with significantly less reservation, whereas a CISSP-holder would have to go through the same sorts of checks that someone with nothing more than a 4-year degree would. Just because they can study and take themselves seriously doesn’t mean they know or love their discipline.:

Philosophy should be taught starting at a very early age, and should continue all the way through college. Nothing is more important than learning how to approach…thinking. Logic, reason, debate, and most importantly — resistance to manipulation.

I think young students versed in philosophy and history have a solid foundation on which to take on additional education.

Can you think of a better way to articulate what I’m saying here?