It seems that CEH, CISSP, and CISM are one of the most cost-benefit combinations for security professionals to invest. (Please be reminded that the table lists only part of the DoD 8570 Approved Baseline Certifications.)
After studying for 35 hours within 12 days (from 2018/11/15 to 2018/11/26), I cleared the ISACA CGEIT (Certified in the Governance of Enterprise IT) exam today. Because of distractions, I spent only 35 hours in a period of 12 days.
For experienced managers, MBAs or entrepreneurs, I believe it won’t take you too much time to study these two.
This exam is one of my favorites. Even though it is not as well-known as CISA or CISSP, it really helps. I highly recommend CISSPs sit for this exam if management position is one of your career choices.
It’s a lovely afternoon and peaceful moment to enjoy the view looking out through the floor-to-ceiling window from the office.
When the ISSAP score report disclosed “Congratulations!”, my goal has been achieved pursuing the planned certifications from ISC2. I spent around 4 months in total studying intensively and finally passed the six ISC2 exams: CISSP, CCSP, CSSLP, CISSP-ISSEP, CISSP-ISSMP, and CISSP-ISSAP.
After studying for 40 hours within 8 days (from 2018/11/06 to 2018/11/13), I cleared the ISC2 CISSP-ISSAP (Information Systems Security Architecture Professional) exam today. This exam is one of the 3 CISSP concentrations. I would say the level of difficulty would be ISSAP < ISSMP < ISSEP.
The ISACA CGEIT is the last mile for me to declare success achieving my annual goal.
After studying for 40 hours within 8 days (from 2018/10/29 to 2018/11/05), I cleared the ISC2 CISSP-ISSMP (Information Systems Security Management Professional) exam today. This exam is one of the 3 CISSP concentrations. As its name denotes, this exam is all about basic management concepts and the difficulty level is not that high as far as an experienced CISSP is concerned.
My original plan of the year for learning and growth is scheduled to be completed by the end of October with one month buffer (November as the worst case). Since my goals are achieved ahead of the schedule, I decide to do more as final optimization using the one-month buffer, that is, the month of November.
I enrolled in the official ECSA v10 course from EC-Council on 4th Aug, attended the class delivered by Melvin Sandro from Sep 26 to Sep 30, and passed the ECSA exam today. The course ware, iLabs modules, and iWeek class are awesome. I am willing to recommend the official course before you sit for this exam.
The scope of ECSA is highly overlapped with the one of CEH. However, ECSA emphasizes the project management of penetration testing, the EC-Council LPT methodology, and specific penetration testing scenarios.
If you are a CEH already, I don’t think ECSA adds much value while OSCP, CEH (Practical), or ECSA (Practical) certification would be a better choice. ECSA, EC-Council Certified Security Analyst, as it literally denotes gives people positive image or impression compared with the CEH, Certified Ethical Hacker. Most people feel better or safer when they come across a Security Analyst than a Hacker. Of course, this is just my guess why EC-Council promotes the ECSA certification.
A modus operandi (often shortened to M.O.) is someone’s habits of working, particularly in the context of business or criminal investigations, but also more generally. It is a Latin phrase, approximately translated as mode of operating.
Rules of Behavior
Penetration testing “Rules of Behavior” is a penetration testing agreement that outlines the framework for external and internal penetration testing.
Prior to testing, this agreement is signed by representatives from both the target organization and the penetration testing organization to ensure a common understanding of the limitations, constraints, liabilities and indemnification concerns.
Release and Authorization Form
In addition to the “Rules of Behavior”, a “Release and Authorization Form” may be required that states the penetration testing will be held harmless and not criminally liable for unintentional interruptions and loss or damage to equipment.
an element that helps people to emerge from an undesirable situation.
The agreement outlines the types of activities to be performed and indemnifies the tester against any loss or damage that may result from the testing.
entails a legal agreement signed by an authorized representative of the organization.
a part of the penetration testing contract and should include an incident response plan and appropriate customer contact that can be alerted should an issue arise.
Negligence is a tort and actionable in the civil courts. Essentially, negligence is typically the failure to act with due care causing harm to someone else. Harm can include personal injury, damage to property, and economic loss.
To succeed in a claim for negligence, the claimant must satisfy the following requirements on the balance of probabilities:1. The defendant owed a duty of care to the claimant;
2. The defendant breached that duty of care;
3. The defendant’s breach of the duty of care caused damage or harm to the claimant;
4. The harm caused was not too remote.If a claimant can satisfy these requirements, they will have a valid claim. If proceedings are formally issued, the defense will either admit liability, or defend the claim.
A waiver is the voluntary relinquishment or surrender of some known right or privilege. Sometimes, the elements of “voluntary” and “known” are established by a legal fiction. Other names for wavers are exculpatory clauses, releases, or hold harmless clauses.
An example of a written waiver is a disclaimer, which becomes a waiver when accepted.
One example of a legal fiction occurs in adoption. The new birth certificate of the adopted child is a legal fiction.
One example of a legal fiction occurs in adoption. Once an order or judgment of adoption (or similar decree from a court) is entered, one or both biological (or natural) parents becomes a legal stranger to the child, legally no longer related to the child and with no rights related to him or her. Conversely, the adoptive parents are legally considered to be the parents of the adopted child; a new birth certificate reflecting this is issued. The new birth certificate is a legal fiction.
I enrolled in the EC-Council iClass Self-Paced CEH v10 Course on 25th June, 2018 and passed the CEH (Certified Ethical Hacker) exam today. I would recommend the official courses from EC-Council as the CEH v10 course ware (2294 pages) is informative and well-organized. The iLabs lab modules are fantastic; it saves you huge time to set up your own labs. (I also attended the official iWeek online live class for ECSA v10. It’s helpful and effective as well.)
The CEH v10 exam itself is straightforward, but it does take a lot of time for me to get insights to or review the technical details, say, the TCP 3-way handshaking and flags. There are a lot of commands, tools and related arguments to memorize and exercise.
Besides the official course ware, I used the following as supplements:
Concerning ethics and laws, the author’s practical suggestion is to follow your team guidance that should have a process to handle the legal issues, such as pirated software, porn, and illegal activity.
It seems that EC-Council prefers an answer that you follow the law even if you would be trapped in a law case. This seems to be against the author’s practical point of view if I don’t get it wrong.
After studying for 42 hours in 12 days (from 2018/09/14 to 2018/09/25), I cleared the ISC2 CISSP-ISSEP exam this afternoon and it’s really lucky for me, probably, to be the first exam taker who passed this exam in Taiwan.
The following is what I used to prepare for this exam: