Konkuk University Medical Center and its ... - Korea IT Times

How to...
has to be reentered. You have to hire temps to come in and do the
work, meanwhile no one has access to the data. Will this day ever
end? If you had an Information Assurance (IA) or Information
Security program, then user awareness training might have prevented
the first guy from inserting the thumb drive into his computer.
Awareness training and a good security architecture might
have prevented the employee in HR form sending out unencrypted
confidential data or the former employee from intercepting it.
A robust back up strategy and routine vulnerability assessments
for the database could have saved the inconvenience of manually
updating the restored database. Did you say that auditors are
coming to check on information
handling policy compliance?
Clearly you need an
Information Assurance (IA)
professional to establish your
IA program and keep it up and
running. But where do you
find one and then how do you
know if he or she is any good?
If you run a job vacancy announcement,
you are likely to
receive the resumes of every
hacker wannabe, reformed
script-kiddie and junior James
Bond within the commuting
area. They will try to impress
you with tales of their exploits
in the underworld of computer
hackery. Intermingled with the
resumes of the these ill qualified
aspiring cyber-warriors, will be a handful resumes from true
IA professionals. But how can one tell them apart? That's where
the (ISC)² comes in.
The International Information Systems Security Certification
Consortium, Inc., or (ISC)² , headquartered in the United States
and with offices in London, Hong Kong and Tokyo, is the global,
not-for-profit leader in educating and certifying information assurance
professionals throughout their careers. They are recognized
for Gold Standard certifications and world class education
programs. In November of 1988, “The Consortium” was formed
among several professional organizations to create a global information
security certification process for professionals and address
the need for a standardized curriculum for the burgeoning profession.
A series of strategy and planning meetings were held at
Idaho State University and in Salt Lake City, Utah in the US.
By 1992 the consortium had finalized creation of what is
known as the Common Body of Knowledge, or the CBK for
Information Security Professionals. The CBK refers to the ten
“domains” of information assurance, which include Access
Control, Application Development Security, Business
Continuity and Disaster Recovery Planning, Cryptography,
Information Security Governance and Risk Management, Legal,
Regulations, Investigations and Compliance, Operations
Security, Physical (Environmental) Security, Security
Architecture and Design, and Telecommunications and Network
Security. The (ISC)² has a number of certification programs
where candidates are qualified at various stages in the development
of their Information Assurance careers. At the end of the
bad day described above, the cert holder that you are looking for
is the Certified Information Systems Security Professional, or
CISSP. The (ISC)² has established
criteria for becoming a
candidate for the certification,
which includes completion of
at least five full years of experience
in information security /
assurance and sponsorship by
someone who is already a CIS-
SP.
Once accepted as a candidate,
certification requires successful
completion of a 250
question written test of the
candidates knowledge of the
CBK, which must be completed
within six hours. Most professionals
prepare for approximately
six months prior to taking
the exam. The pass / fail
rate is about 70 percent.
Today, there are approximately
60,000 CISSPs worldwide. Just because a person has the CIS-
SP certification doesn't mean that they are an expert in all ten domains,
or any of them for that matter. In fact, that is one of the
knocks on the program. They say that the certification requires
understand these topics in a way in which a river might be described
– a mile wide and a foot deep. In other words, in order to
pass the exam a person has to have a broad knowledge of the concepts,
but it does not require deep knowledge in any in order to
pass. It's this writers experience that the person you select to implement
your IA program should at least be an expert in one of
the domains and the more the better.
Obviously, there are a great many factors that one must consider
when hiring an employee. The CISSP certification isn't perfect,
but with all things being equal, pick the person who has those initials
after their name, as opposed to the one that doesn't.
Robert E. Weimer / bob@koreaittimes.com
www.koreaittimes.com 95