Adding Security to the Cert

Adding Security to the Cert
Tim Mullen, 2003-06-09

Shiftless third-party prep courses have made MCSE certification less valuable. Is Microsoft's new security cert doomed to the same fate?

Colapse all | Post comment

Adding Security to the Cert 2003-06-09
George Capehart (1 replies)

Ever since I heard that Microsoft was adding security certifications I've wondered who is going to determine what needs to be in the certification and how they're going to test it. *Certainly* no one from Microsoft. They've just now figured out that security is important . . . there's no way there...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Anonymous (2 replies)

What a supidly arrogant statement. No one at MS could be considered an expert? Just another ignorant basher. How nice to hide behind your keyboard. ...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Anonymous (1 replies)

Okay. Fair reply. Then tell me:

1. How many CISSP certified staff work for Microsoft?

2. How many GIAC (GSEC/GCFW/GCIA/GCWN/GCUX/GISO/GSNA) certified staff work for Microsoft?

3. How many CHECK consultants work for Microsoft?

4. What Security Design and Development Methodologies do Mic...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-12
Anonymous (1 replies)

How many vulnerabilities are found in Open Source products per year? Don't tell me far less than Microsoft. Take a look at the CERT advisories if you want to start debating on that.

Microsoft's products have never been "engineered for security", but does that mean Microsoft's employees/developers...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-17
Anonymous

If micro$oft was all that good at releasing patches - then they would be regression tested, and M$ would tell you in which order they should be applied.
NT4 is a good example of this - no, it isn't the most current OS, however it is still used by many businesses worldwide and is supported by M$. Cl...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-12
Anonymous

At least he put his name. Hey, your named anonymous too? ...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? 2003-06-09
Penguinisto (3 replies)

You just don't see these problems in, say, the RHCE ferinstance. (and no, this isn't to point up Linux - most of the *ix community discards certification anyway.)

Back to the point, this is because certs like the RHCE require that you prove your skills in a classroom setting before you take any s...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? You mean like a 'brain'? 2003-06-09
Cirque du Microsoleil (3 replies)

I laid down a bet in this author's last 'column' that it will be 90 days before a vuln is found in win2003 after public. Well, all it took after all was only 60 days.

It seems anyone with a Microsoft badge will never get it. If the author of this 'column' and all the others, is any presentation...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? You mean like a 'brain'? 2003-06-10
Anonymous

The vulnerability was with IE, not 2003. But of course, it does not matter in the slightest- Your "bet" was rigged to begin with. Talk about the daily flood of *nix patches. Address that first, and we'll see if you have a point. ...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? You mean like a 'brain'? 2003-06-10
Penguinisto

Err, I wagered 90 days for Win2k3 in the "Secure by Default" column (dunno who said "60", though he was a lot closer) - check the talkbacks, eh? ;)

Having an MCSE was a requirement at the time, and I have been saddled with it ever since. However, instead of simply sitting back and laughing as man...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? You mean like a 'brain'? 2003-06-11
Anonymous (1 replies)

You guys are morons. You are making a non-issue with IE into something it is not just to say that you won your stupid childish bet. THIS IS NOT AN OS PROBLEM, plus the default configuration in IE blocks this issue. By the way, wasn't your bet that it would be a "huge gaping hole"?

You people need...

[ more ] [ reply ]

Perhaps it takes more than just more tests...? You mean like a 'brain'? 2003-06-11
Anonymous

I'm going to add "windoze" to that list....

[ more ] [ reply ]

MCSE has value, but does RHCE? 2003-06-10
Anonymous (3 replies)

You mention RHCE, but the real value of a certification is in whether or not it broadens your employment possibilities. I've never seen a job posting that listed 'RHCE' as a qualification, but I see plenty that list 'MCSE'.
...

[ more ] [ reply ]

MCSE has value, but does RHCE? 2003-06-10
Anonymous (1 replies)

I've seen a few that require RHCE. Within two years you will see a lot more. Certs are a necessary evil to get you in the door, that's all. In the next few years, boot camp grads will decrease in the workplace as they get dusted performance wise by true IT professionals....

[ more ] [ reply ]

MCSE has value, but does RHCE? 2003-06-11
Anonymous

"In the next few years, boot camp grads will decrease in the workplace as they get dusted performance wise by true IT professionals."

I have to disagree.
IT degrees and certs, while no indication of the bearer having any true IT skills, are the easiest way for HR departments to decide who gets...

[ more ] [ reply ]

MCSE has value, but does RHCE? 2003-06-10
Penguinisto

As I briefly mentioned before, most Linux and UNIX admin positions are completely dismissive of certifications. I used the RHCE as an example of a certification that proves competency, not as a bragging point for Linux/UNIX. You can replace "RHCE" with "CCIE" or better if you'd like, or any other ce...

[ more ] [ reply ]

MCSE has value, but does RHCE? - RHCE? What's that? 2003-06-10
Anonymous (4 replies)

That's because in 99% of the corporate world, *nix doesn't exist, yet all of the fanatics out there seem to think that there is some big "Linux revolution" going on, where all Windows boxes are being phased out. I find this very amusing considering every company I've ever worked for has been a Windo...

[ more ] [ reply ]

You'll learn once you get RIF'ed 2003-06-11
Anonymous (2 replies)

Merill Lynch. NASA. Amazon.com. Munich, Germany. The 4th fastest supercomputer on Earth, just under three other specialized *ixes. 2/3 of all webservers of all sizes on the Internet. Literally a million other examples, great and small.

That's one hell of a basement.

A cheap $1m mainframe can ...

[ more ] [ reply ]

You'll learn once you get RIF'ed 2003-06-11
Anonymous

Perhaps you should read this.

http://netscape.com.com/2100-1103-1008943.html

There goes your typical *nix "Windows performance sucks" argument. What's wrong? Sorry loser?...

[ more ] [ reply ]

You'll learn once you get RIF'ed 2003-06-13
Anonymous (1 replies)

Ooohh, you sure are special! Small businesses really need that stuff. Everyone go home now and buy a mainframe to support this guys tiny little weener....

[ more ] [ reply ]

You'll learn once you get fired... 2003-06-19
Anonymous

"Ooohh, you sure are special! Small businesses really need that stuff." - typical *nix way of looking at things - provide management with the bare minimum to perform their jobs and nothing more. Sorry kid, we are talking real life here, not your parents basement....

[ more ] [ reply ]

Actually... 2003-06-11
Anonymous (1 replies)

I really shouldn't play into this obvious troll, but the majority of job postings I've been seeing lately are for places running mixed shops -- HP/UX and Windows, Linux and Windows, or Solaris and Windows. Microsoft's restrictive client licensing scheme and their "security is an afterthought" attit...

[ more ] [ reply ]

Actually... 2003-06-12
Anonymous

I find it funny how anyone who doesn't agree with your specific point of view and likes working on a Microsoft Operating system is automagically a "troll". Is this your way of dismissing and discrediting this person in your head so that you can feel smarter and keep your inflated ego to boot?...

[ more ] [ reply ]

MCSE has value, but does RHCE? - RHCE? What's that? 2003-06-11
Anonymous

You are not as aware of the world as you percieve yourself to be. My company is moiving away from Microsoft, at least as fare as the web goes, and as 90% of our information is stored on a mainframe I totaly agree with the idea....

[ more ] [ reply ]

MCSE has value, but does RHCE? - RHCE? What's that? 2003-06-17
Anonymous

it's so plain to see the transparent try-hard gimp who has not experienced, used or thought about anything other than the mainstream microsoft model.. linux has a place, and come licensing 6 you will see it begin to replace 'M$ shops..
unix doesn't exist?? pull your head in, matey. the best system...

[ more ] [ reply ]

Perhaps it takes more than just more tests... ungh, you again? doesn't this happen EVERY TIME? 2003-06-11
Anonymous (1 replies)

You know, Penguinisto, I bet you just wait in antisipation until Mullen posts a new column so you can pollute it with useless, uninformed and so obviously made up information. Really, you make up a large percentage of the wasted conversation on this thread, there should be limits....

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-11
Penguinisto (1 replies)

So, how is your heavily forested 200-user network going these days? ;)

By the by, I merely desire to help out here... the main jist of Tim's article is the fact that the MCSE cert has lost value, and he's worried that it will rub off onto security with the addition of the MS "security" emphasis....

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-12
blacklight (1 replies)

Good shot, Penguinisto!...

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-12
Anonymous (2 replies)

Awww... come on blacklight, I enjoy your intelligent responses. Your always willing to look at both sides of the story and be fairly neutral. Don't ruin it now by siding with penguin boy....

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-16
Penguinisto

So IOW, you had no substance to your posts and are out to merely (f)lame actual contributors for no reason.

Thx for playing!
/P...

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-17
blacklight (1 replies)

I look at both sides of the story, because that's my job as a security professional. I am certainly not neutral in the Linux vs. M$ dispute - in fact, I could be standing opposite Timothy Mullen for all I know. I don't know for sure, because in 12 months of follwing his columns, he has yet to say o...

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-17
Anonymous (1 replies)

err, actually, it is normally the Linux bums who go on the offensive first. Get your facts straight....

[ more ] [ reply ]

Is that a Troytech in your pocket or are you just glad to see me? 2003-06-19
blacjklight

"err, actually, it is normally the Linux bums who go on the offensive first. Get your facts straight."

Your argument is essentially that "It's the other guys who started the fire. All I did was pour the gasoline, and therefore it's not my fault ..." and makes about as much sense. It reflects the ...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-09
Anonymous (3 replies)

MCSE means Must Call Someone Else. I remember a book, yellow and black : MCSE for dummy!

It's exactly that : MCSE is for dummy and I know many company that refuse to work with MCSE because they had too much bad experience with them.

And also, remember that only Windows needs to work before bei...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-09
Anonymous

You're wrong in saying that Unix is more secure then Windows. The fact is both are left up to the person that is in the security driving seat. Things like null sessions are very easy to fix (2k+) if you know what you're doing. The real difference is that normally Unix admins have the experience a...

[ more ] [ reply ]

Adding Security to the Cert - Feeding the Trolls 2003-06-10
Yet Another AC...

Yes, I realize this guy is a Troll, but I'm gonna feed him anyway.

[Quote]
And also, remember that only Windows needs to work before being secure. Windows needs its own security holes for working.
[/Quote]

Neither Windows nor *nix is bulletproof out of the box (OpenBSD comes really close, th...

[ more ] [ reply ]

Adding Security to the Cert, then watching the *nixers complain about it. 2003-06-10
Anonymous (1 replies)

"MCSE means Must Call Someone Else. I remember a book, yellow and black : MCSE for dummy!"

Are you joking? There are 250 page books on the preparation for taking a Win2K MCSE. If there is an "MCSE for dummies" book then it would be pretty useless, but somehow I think you were just being a smartas...

[ more ] [ reply ]

Adding Security to the Cert, then watching the *nixers complain about it. 2003-06-10
Anonymous (1 replies)

"Yeah, right... I bet the board members at my company would really go for "Hey, let's install UNIX!". They would take one look at it and laugh their heads off. They would probably say, "Hey, while we're at it, let's bring back the IBM green-screen Mainframe's!". I agree, UNIX machines are necessary ...

[ more ] [ reply ]

Adding Security to the Cert, then watching the *nixers complain about it. 2003-06-11
Anonymous

Funny, the board at my company didn't laugh at all when they approved the purchase of our Tru64 database cluster, or the purchase of several hundred linux machines that we run our hosted applications from......

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-09
Heinz the Mercedes Benz Mechanic (2 replies)

>I disagree. I don't go to my favorite >mechanic because he is a good driver. I go >to him because he can make my truck run the >way I want it to. Driving it correctly is >up to me.

This has to be the stupidest thing I have ever read.

Not surprised though....

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-10
Anonymous (1 replies)

It made perfect sense to me. Actually, I thought it was perceptive. Like a network engineer, a mechanic is responsible for maintaining the vehicle, not making sure it is operated securely.

I agree with that. But then again, I am a network engineer.

I hope that helps you figure out the exam...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-10
Heinz the Mercedes Benz Mechanic (3 replies)

It's not perceptive, its the whole reason you are in this mess. You simply don't get it. It explains precisley why it is the stupidest thing ever written.

You see, I as the mechanic notice that your transfer case on your M-Class has an unusual amount of burn in the oil, or I notice you unusual we...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-11
Anonymous (2 replies)

I guess I'll feed this troll.

I can't speak for the other guy, but I don't have an M-5. So, you wouldn't see me anyway. I have a BMW, and could care less about the M-5. But that is all you know- your nitch product. My mechanic does what I tell him to do. I pay him for his work. And if he do...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-11
Penguinisto

"I do whatever I want to my car, and grease monkeys like you do what ever I tell you to."

...and the grease monkeys will happily hand you a multi-thousand dollar bill for parts and labor when you eventually have to repair the thing, and your car will incidentally be out of commission for a week i...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-11
Heinz the Mercedes Benz Mechanic

>It is not that people like us "don't get >it" it is that we make lots of money >selling technology, and that peon admins >like you are stuck.

Sadly it is because people like you "don't get it".

You see as the "expert" mechanic, I will go beyond my duty of just fixing your car, I am going to...

[ more ] [ reply ]

"Microslop"? Exactly how old are you? 10? 2003-06-11
Anonymous

Please don't tell me this is how you speak to your clients. Oh wait, I forgot, your still in junior-high....

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-11
Anonymous (1 replies)

Hi

You have made several assumptions without any fact, and I am confused at that. One, I am not an any "mess" at all. I'm not sure why you would say that. I actually have a great job, and enjoy what I do. Our network runs perfectly, is secure, and I get to work with talented people. Further,...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-11
Wolfgang...friend of Heinz the Mercedes Benz Mechanic (2 replies)

>It made perfect sense to me. Actually, I >thought it was perceptive. Like a network >engineer, a mechanic is responsible for >maintaining the vehicle, not making sure it >is operated securely.

What you said was as above. Your exact words. The point is you're either incapable or not interested t...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-12
Anonymous (1 replies)

So you make up a stupid four wheel drive analogy, then you make up an imaginary friend to post agreement. Wow. Stick to fixing cars man.

Hope that helps. No, REALLY! I REALLY hope that helps. You need it. ...

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-16
Bill Gates

hahaha..just because I said I am heinz the ketchup mechanic doesn't make it so.

Naive Microsoft puppy.

Now bow down to me you silly fool....

[ more ] [ reply ]

Adding Security to the Cert...and training wheels 2003-06-18
Anonymous

Lost like a ball in high weeds...keep hanging on to that hard-wired code boys, you can call MS servers insecure all day long, and on some level you have a point, but each day they continue to gain server market share, not lose it. It's less expensive, and easier to maintain.. at least if you have an...

[ more ] [ reply ]

You ALL need training wheels 2003-06-11
Brett F. Jones (2 replies)

"Tim is stupid."
"No he's not."
"Yes he is, and so are you."
"Huh-un! YOU are!"
"Huh-un! I get it you don't."
"Hun-uh! *I* get it and *you* don't!"

You are all like a bunch of whiny little children. My god, is this all you people have to do? Take it to /....

[ more ] [ reply ]

You ALL need training wheels 2003-06-12
Anonymous

You are like a whiny adult complaining about whiny children. My god, is this all you have to do? Take it to /....

[ more ] [ reply ]

You ALL need training wheels 2003-06-12
Anonymous

But HE started it!!!! ;^)...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
blacklight

I guess Tim and I have a honest difference of opinion: if any one wants anything that changes the configuration of the network I am responsible for, my first consideration will be "what is the impact on security of the desired change?". If the impact is a weakening of the security posture, my next q...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Anonymous

Mr. Mullen:

As I continue to read your columns, I become more impressed with your real world experience. I battle with legacy network problems on a daily basis, and my job is difficult. For different reasons, we have had to call in a security person. Basically all they do is tell us to do some...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Gunter Geißler

AFAIK, what Mr. Mullen is talking/writing about for sure makes me cry. Yes cry because it is true.
When field practice is gathered, you have best practice for different networks, too. So when you earn your MCSE you still can count on what you have learned over the years.
There is no need for kind ...

[ more ] [ reply ]

Wrong attitude about security, but typical of Microsoft's outlook 2003-06-10
Anonymous (2 replies)

> The reality of our networks is that they
> have to work before we can worry about
> security.

But a network that's insecure isn't likely to stay working for long in today's world.

You demonstrate *exactly* the problem with Microsoft software -- security is seen as an optional item to be s...

[ more ] [ reply ]

Can Linux trolls read? 2003-06-10
Anonymous

It is in your own quote- Tim said "before" it can be secure. He did not say to leave it "insecure." I always test our ether runs before I plug them into the switch. Same thing. No, I am not an MCSE either. I figured it out all by myself. ...

[ more ] [ reply ]

Wrong attitude about security, but typical of Microsoft's outlook 2003-06-10
Anonymous (1 replies)

You are wrong. You have no dtat to back up your statement. Most networks belong to SMBs with little to no security. Most function that way for a long time.
FUD is a terrible way to sell security, as is false claims.
Most networks will do and have done just fine with little to no security.
Buil...

[ more ] [ reply ]

Slammer worm, anyone? 2003-06-11
Anonymous

> Most networks will do and have done just
> fine with little to no security.

Did you completely miss the Slammer worm? It *crippled* networks all over the place (including inside Microsoft!) because no one had thought to patch their systems or use ingress filtering on the SQL port. That's wh...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Anonymous (1 replies)

Glock doesn't have a model 10.

...

[ more ] [ reply ]

Adding Security to the Cert 2003-06-10
Anonymous

Must be the new model only columnists get to buy......

[ more ] [ reply ]

Security Cert...Well sort of. 2003-06-10
Mullenfan (2 replies)

Mullen,
Good stuff. (You can always tell good stuff based on how much office conversation it generates).
On another note, I ran across the most ridiculous certification I have ever seen recently:

Certified Social Engineering Protection Specialist

I can't wait to see the job ad fo...

[ more ] [ reply ]

RE: Certified Social Engineering Protection Specialist 2003-06-12
Ryan

Might land a job as a receptionist....

[ more ] [ reply ]

Security Cert...Well sort of. 2003-06-12
blacklight

I let my CNE certification lapse back in 1999, and I just can't even fake the enthusiasm to renew it. I'd say that in this case that my lack of motivation is a pretty strong indicator of good sense, and dislike for throwing away time and money on a useless quest - If it ain't worth having, it ain't ...

[ more ] [ reply ]

Please create an anti-cert boilerplate article 2003-06-11
Anonymous

That way any time I feel compelled to read one of your anti-cert pieces I can keep the template
close by and simply refer to it. It's likely to change in tone and approach about as often....

[ more ] [ reply ]

design security from start 2003-06-12
Anonymous

Major weakness in this article! You can not add security after the fact -- security must be part of the design from the start....

[ more ] [ reply ]

Adding Security to the Cert 2003-06-12
Anonymous

Well MS may have good intentions, however I believe SANS/GIAC should promote and augment it's Windows NT into a seperate cert beyond it's part in GSEC. Let the security experts deal with security and let MS do want they do best, attempt to monopolize the entire industry. (All you anti-virus types be...

[ more ] [ reply ]

Field Certified Engineer? 2003-06-13
Anonymous

Some company was promoting this kind of cert last year - (actually they were looking for students under the guise of looking for FCE's) - anyone heard of them?...

[ more ] [ reply ]

MCSE raison d'etre 2003-06-13
madcow

Face it: MS created the MCSE to make money. When there was a shortage of admins, which cost their customers too much money which in turn hurt sales, MS changed the certs, and held special shows to pump up the whole MCSE thing. This included wildly exaggerated salary information (yeah I guess someo...

[ more ] [ reply ]

MCSE had value? 2003-06-13
Anonymous (1 replies)

I never could find one with an MCSE who could solve my problems with MS Products....

[ more ] [ reply ]

MCSE had value? 2003-06-16
Anonymous

NOT every MCSE is a dipstick... just because you couldn't find him means nothing. ...

[ more ] [ reply ]