PenTest Magazine is from Poland.
To download the full version of the magazine, you just have to create a free account on www.pentestmag.com.
Only members can download the magazine.
Wednesday, March 28, 2012
PenTest Market Magazine
I wrote an article and published it in Penetration Testing Market Magazine Vol.1 No. 1 Issue 01/2012(01), March.
CISSP or CISA?
Many people are getting confused with CISSP and CISA. But there really should be no confusion on the two because they are very different from each other.
The CISSP or Certified Information Systems Security Professional is a certification managed and governed by the International Information Systems Security Certification Consortium or (ISC)2 for IT professionals in the information security field. The CISSP falls under the IT industry and is a very popular certificate for systems security. It is very different from CISA because CISSP is strictly IT in nature.
CISA on the other hand is an auditing certification. CISA stands for Certified Information Systems Auditor. While both CISSP and CISA may contain the words Information Systems, CISSP is for security and CISA is for auditing. CISSP is needed if you are thinking of information systems security career path. This is a highly technical exam but is also in high demand these days. CISA is needed if your career path is for becoming an auditor in information systems. This is a management-type exam and based around audit management and compliance. Security does not play a major role in this certification exam.
Both the CISSP and CISA certifications, however, require a minimum of five years experience in order for you to receive the certification. CISA requires three years of education and two years of actual experience. The CISSP requires five years IT security experience (but will also accept four years experience if the candidate has a college degree). Both the CISSP and CISA certification exams are tough but not impossible to pass.
So there you are. While both are based on information systems, their major difference is that the CISSP is for security and the CISA is for audit.
Saturday, February 4, 2012
CISSP (Certified Information Systems Security Professional)
If you plan to build a career in information security – one of today’s most visible professions – and if you have at least five full years of experience in information security, then the CISSP® credential should be your next career goal. It’s the credential for professionals who develop policies and procedures in information security.
A CISSP is an information assurance professional who defines the architecture, design, management and/or controls that assure the security of business environments. The vast breadth of knowledge and the experience it takes to pass the exam is what sets the CISSP apart. The credential demonstrates a globally recognized standard of competence provided by the (ISC)²® CBK which covers critical topics in security today, including cloud computing, mobile security, application development security, risk management and more.
The CISSP was the first credential in the field of information security to meet the stringent requirements of ISO/IEC Standard 17024. CISSP certification is not only an objective measure of excellence, but a also globally recognized standard of achievement.
Wednesday, October 19, 2011
SSCP (Systems Security Certified Professional)
The SSCP credential seems to be the most misunderstood and under appreciated of
those certifications offered by (ISC)2. In actuality, it is one of the most critical and
essential in the field. This is because the work of the SSCP is where the effectiveness
of information security is implemented. Few CISSPs have the technical skills necessary
to perform the hands-on implementation of the information security controls
that they determine to be necessary to effectively protect the critical and sensitive
resources of the organization.
In a mainframe environment, the SSCP role is usually performed by systems
programmers assigned to the security department. Otherwise, it would be the
responsibility of a system or network administrator from operations.
The security role of the SSCP is twofold. First, they are responsible for the
due care activity of correctly implementing and maintaining designated security
mechanisms. Second, they are in the best position to accurately evaluate the effectiveness
of the installed controls—the due diligence side of the equation.
The SCP certification domains are named after the seven major categories of
the SSCP Common Body of Knowledge (CBK). The CBK is a taxonomy of topics
and sub-topics that is updated annually by the SSCP CBK Committee composed
of international subject matter experts. Currently, the seven categories are:
◾Access Control
◾Analysis and Monitoring
◾Cryptography
◾Malicious Code
◾Networks and Telecommunications
◾Risk, Response, and Recovery
◾Security Operations and Administration
those certifications offered by (ISC)2. In actuality, it is one of the most critical and
essential in the field. This is because the work of the SSCP is where the effectiveness
of information security is implemented. Few CISSPs have the technical skills necessary
to perform the hands-on implementation of the information security controls
that they determine to be necessary to effectively protect the critical and sensitive
resources of the organization.
In a mainframe environment, the SSCP role is usually performed by systems
programmers assigned to the security department. Otherwise, it would be the
responsibility of a system or network administrator from operations.
The security role of the SSCP is twofold. First, they are responsible for the
due care activity of correctly implementing and maintaining designated security
mechanisms. Second, they are in the best position to accurately evaluate the effectiveness
of the installed controls—the due diligence side of the equation.
The SCP certification domains are named after the seven major categories of
the SSCP Common Body of Knowledge (CBK). The CBK is a taxonomy of topics
and sub-topics that is updated annually by the SSCP CBK Committee composed
of international subject matter experts. Currently, the seven categories are:
◾Access Control
◾Analysis and Monitoring
◾Cryptography
◾Malicious Code
◾Networks and Telecommunications
◾Risk, Response, and Recovery
◾Security Operations and Administration
Monday, May 30, 2011
BackTrack 5
BackTrack 5 released on May 11.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date. Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community.
Visit http://www.backtrack-linux.org/downloads/ to download your preferable flavor.
BackTrack is intended for all audiences from the most savvy security professionals to early newcomers to the information security field. BackTrack promotes a quick and easy way to find and update the largest database of security tools collection to-date. Our community of users range from skilled penetration testers in the information security field, government entities, information technology, security enthusiasts, and individuals new to the security community.
Feedback from all industries and skill levels allows us to truly develop a solution that is tailored towards everyone and far exceeds anything ever developed both commercially and freely available. The project is funded by Offensive Security. Whether you’re hacking wireless, exploiting servers, performing a web application assessment, learning, or social-engineering a client, BackTrack is the one-stop-shop for all of your security needs.
BackTrack 5 comes in several flavours and architectures. VM & ISO come with KDE & GNOME flavors.
Visit http://www.backtrack-linux.org/downloads/ to download your preferable flavor.
Saturday, April 30, 2011
Microsoft EMET
The enhanced Mitigation Experience Toolkit (EMET) is designed to help prevent hackers from gaining access to your system.
Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.
Download EMET
Software vulnerabilities and exploits have become an everyday part of life. Virtually every product has to deal with them and consequently, users are faced with a stream of security updates. For users who get attacked before the latest updates have been applied or who get attacked before an update is even available, the results can be devastating: malware, loss of PII, etc.
Download EMET
Tuesday, March 8, 2011
Wordlists for Password Cracking
For those who are looking for Wordlists for password cracking (dictionary), you can download some good wordlists here:
http://www.outpost9.com/files/WordLists.html
http://wordlist.sourceforge.net/
http://www.openwall.com/passwords/wordlists/
and a password wordlist generator:
http://www.securiteam.com/tools/5ZP0N20GAW.html
http://www.outpost9.com/files/WordLists.html
http://wordlist.sourceforge.net/
http://www.openwall.com/passwords/wordlists/
and a password wordlist generator:
http://www.securiteam.com/tools/5ZP0N20GAW.html
Subscribe to:
Posts (Atom)