raesene6

18 ms·

121.
by raesene6 9y ago
Interesting, although not particularly surprising, results there. I'm afraid that the InfoSec community has been unsucessfully persuing the idea of "RoI" for security activities for a long time (I remember debating the idea 1
122.
by raesene6 9y ago
For me the problem that this article describes, people using the OWASP Top 10 as a checklist, isn't that checklists are innately a bad idea, but that the OWASP Top 10 isn't meant to be a checklist. The Top 10 is a document designe
123.
by raesene6 10y ago
The challenge that I've been trying to express is that individual excellence is hard to replicate at scale. Sure in sports, that works ok, the numbers are small and the rewards are great, the incentives are there for people to comb th
124.
by raesene6 10y ago
Interesting, so what's your view of how professionalization of the industry should get started?
125.
by raesene6 10y ago
Obviously it takes time to build a profession, but you've got to start somewhere, and part of that path is certification. Unfortunately the industry is growing far faster than perhaps happened for previous emergent professions, so the
126.
by raesene6 10y ago
The original article it titled "Information Security Certifications are Worthless and Causing More Harm than Good" yes? The top comment expressed quite clearly discouragement that this attitude of negativity to certification would
127.
by raesene6 10y ago
Ah ok, so would it be fair to say that you're not opposed to the concept of certifiation, per se, but that you're not a fan of existing options in the field? Of course one problem is "how does a certification become recognize
128.
by raesene6 10y ago
<sigh> it's not a false dichotomy. The comment I was replying to was specifically expressing disappointment that his efforts in getting certificate would be overlooked because of a negative attitude in the industry to those cert
129.
by raesene6 10y ago
so, out of curiousity, that implies to me that you don't rate any IT security certifications? So would I be right in thinking you don't think that any of the Offsec certs (OSCP/OCSE), CREST certs (CCT etc) or SANS certs are u
130.
by raesene6 10y ago
Yep I think apprenticeships can help too, there's no one thing that's going to help bring a load of people on, I think it's got to be multiple paths.
131.
by raesene6 10y ago
Sounds to me like you're doing the right kind of thing to break into the industry. Whilst there are people that, unfortunately, take the attitude in the article, I think that there's a load of others that take a more balanced appr
132.
by raesene6 10y ago
Yep the problem is that some of the well known certs are bad, not that the concept of IT security certifications are bad. I've been in IT/Infosec for 17 years now. I have certs that I literally maintain as a HR/sales checkbox
133.
by raesene6 10y ago
some are bad certs (rote learning, multiple choice), others are not (they have good practical elements). One problem is that some of the "bad certs" e.g. CEH, CISSP , are well established. My feeling is that the answer isn't
134.
by raesene6 10y ago
the original article, I felt, made that point. It provided several examples of people learning on their own and provided those as an argument for why certifications were unecessary. So not my dichotomy.
135.
by raesene6 10y ago
Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified
136.
by raesene6 10y ago
So how would you approach scaling the IT Security industry without some form of industry certification process? I'm definitely not trying to defend the CISSP/CEH style certs here but I don't see how you reliably expand the in
137.
by raesene6 10y ago
OSCP is a bit more than that to be fair, you're not going to pass with copy/paste of existing exploits.
138.
by raesene6 10y ago
I'd agree that the problem isn't so much that certification has to be bad, but that bad certifications (e.g. those that examine though purely multi-choice) aren't appropriate/good for the industry... For me the answer is
139.
by raesene6 10y ago
I'm going to partially disagree with the article. the problem with the approach of "just learn to be a good security person" is that it doesn't scale. Sure back when I, and a lot of other people who are a bit older, lea
140.
by raesene6 10y ago
So just to chime in on this, I'd echo others in saying that "call for pricing" or any variants thereof, are a huge turnoff to me in terms of buying software. It instantly makes me think "this will be expensive" and
141.
by raesene6 10y ago
From what I've seen there are still a lot of banks who haven't yet realised that they are software houses. Anything that gets outsourced obviously isn't seen as part of the core functionality of the organisation and yet we s
142.
by raesene6 10y ago
Well Microsoft did hire one of the Kubernetes Founders last year ( http://www.crn.com/news/cloud/300081316/microsoft-hires-goog... ) and have been working on getting Kubernetes running on Azure, so it doesn&#x2
143.
by raesene6 10y ago
well the lawsuits that Barclays and others are facing seem to indicate there was rather more harm than that. One example, from https://en.wikipedia.org/wiki/Libor_scandal "Early estimates are that the rate manipul
144.
by raesene6 10y ago
From https://en.wikipedia.org/wiki/Libor_scandal , looks like it was pretty relevant from 2000 onwards at least. The excerpt below seems to strongly indicate manipulation designed to improve banks profits over a long
145.
by raesene6 10y ago
So your suggestion is that no-one in any of the risk functions or internal audit functions (or the external auditors of the bank) ever thought to look at Libor in the years from it becoming important until the scandal emerged? And that seni
146.
by raesene6 10y ago
You don't think that people on the other ends of trades that depended on Barclay's Libor rate were depending on it being objective or accurate? So those people on the other end of the trades, literally were aware that Barclays wer
147.
by raesene6 10y ago
Given the level of compliance & audit work required in the UK FS industry (look for example at the sizes of regulatory and operational risk teams) and the nature of career paths in the industry (senior figures tend to come up from the r
148.
by raesene6 10y ago
The BoE rigging might not have been to make money, but the rigging done by individual traders at the participating banks definitely was.
149.
by raesene6 10y ago
Well in banking, it's very important that there's trust in the system. Senior staff in UK financial institutions risk being barred from the industry if they're found to have broken rules and there's a reason that kind of
150.
by raesene6 10y ago
Well they'd have to be pretty stupid to put it in writing, given that it was against the rules. It seems to me a shame that people lower down the chain, who didn't stand to personally profit from the manipulation are going to be t

More ›