This brings me to a thread on TechExams.net from a few years ago that discusses what it takes to be an industry-recognized security professional. Something to note here, this forum assumes that certifications are earned through rigorous study and hands-on experience, not through memorizing stolen test-questions or cramming a book just enough to pass the test. That being said, this particular conversation discusses the much-lauded CISSP certification, which requires professional experience and a degree, in addition to a test, in order to obtain.

Keatron, who teaches courses in network security, had the following advice for another forum-member asking how to get into security:

I’ve had many people sit my CEH class and realize they should have had Security+ level knowledge under their belts first. I by have it, I actually mean have it, not just pass the test.

I would say probably Sec+ (even if you do it self study).
Then MCSA:Sec
Then CEH
Then SSCP
At this point I’d suggest getting some Cisco in there. And you must start with CCNA, Then work the CCSP route (will not be easy, but worth it).

By this time you should be very ready to start preparing for the CISSP.

Again, keep in mind that the assumption here is that a professional would be working as he or she earns these certs, and actually learning the material in a practical way over the course of the two or three years it would take to study for all these tests.

So, the response we get from UnixGuy, another member of the forum who is interested in security-work:

Hmmm, isn’t this tooo long a way to earn a CISSP ??

And here is the big payoff, Keatron’s reasoning for all those other skills and experience:

For UnixGuy, think of it this way. Let’s say you have 6 different certifications that all deal with 6 different areas of Information Security. Think of these as your 6 cans of Coke. Now think of the CISSP as the little plastic stuff that holds a six pack of coke together. Take your 6 cans of coke (your experience and other certs) and the little plastic stuff (your CISSP), add those together and you have a solid six pack that’s held together well. For example, you might have a job as a firewall administrator. You might perform this job well for 6 or 7 years. However, you could be an expert firewall administrator, and not know squat about application security. In reality, the CISSP helps a security professional take all their years of experience, and certifications and FINALLY tie them all together and see clear relationships between it all. But there’s the old saying “garbage in, garbage out”. So in other words, if you are a person with only 1 can of coke (mimimal experience and minimal exposure to certifications), then the little plastic thing (CISSP) wont really do you much good, because you don’t have any cans (experience and certs) to tie together. The CISSP is often described as a mile wide and an inch deep. But it should be understood that you don’t go a mile deep because theoretically, you’ve already been 20 miles deep in several of the domains. I always stress experience first, then certs. However, sometimes you need the cert, to be awarded the opportunity to get the experience. But I often recommend people in the security field get vendor specific certs related to operating systems or network equipment they may be responsbile for securing. You can’t possibly secure a large building if you don’t know where all the doors and windows are. Additionally you need to know how to open and close these doors and windows. Same goes for systems and networks. Here’s a few examples;

How can one possibly understand group policy if they’ve never implemented or least labbed it out in preperation for MCSE? How could you know that group policies only apply to computers that are a member of the domain, OU, or site that group policy was applied to if you haven’t done it, or again labbed it out. Not to mention you have to remember to give groups read and apply group policy permissions to the group policy object if it is to have any effect at all. If one doesn’t understand these basics, then how could they possibly even start to secure a Windows based network? How does Kerberos work (in Windows world). What’s sent in clear text and what’s encrypted? How feasible is it for an attacker to forge a ticket and fool another device or computer in the realm to believing it’s legit? If you’ve never implemented a Pix or an ASA then how could you know what it’s default inspection rules for the FTP protocol is? We’re taught that FTP uses ports 20 and 21 only. But is that actually accurate? Is is true that FTP actually uses dynamically allocated ports to actually do the data transfer part of an FTP session? How does the ASA default inspection rules allow for this? And if you know the answer to that, then what security concerns does this behavior and allowance or disallowance by ASA introduce or expose your organization to? Have you observed it’s behavior via ethereal or some other analyzer or sniffer? What about the bazillion other protocols you’re forced to allow into your network? Are you sure DNS only uses port 53? TCP or UDP? Both? When you perform a query for a resource on the web, does the response to query come back in on UDP port 53? What about zone transfers? Is that via port 53 as well? TCP or UDP? Are these zone transfers in cleartext? If they are, what can you implement to encrypt these zone transfers? How does Checkpoint Firewall solutions deal with this behavior? (And saying it just works doesn’t count). Are the ways in which it deals with this behavior introducing unique security considerations? Isn’t it true that the biggest problems with firewall, IDS, and other mechanisms is that they act and behave in a very predictable manner? How does NTFS file systems store data and files? What about NFS? FAT? What about ZFS? So how do ZFS and EXT2 differ in how they store and catergorize data? From a confidentiality perspective, which is more feasible? If you haven’t worked with these file systems you might not know the answers. However, getting certifications can expose you to this very information and least give you some level of knowlegde in those areas.

This list could go on and on. And obviously a CISSP that thinks they only utilize port 21 when they go to an FTP site and download files probably could have benefited from getting little more experience (or getting more cans) before getting the plastic peice (CISSP) to pull it all together. Because pulling it all together with too few cans causes us to have huge “knowledge gaps” and therefore renders us less effective in our roles as information security professionals.

So UnixGuy, the above is some of the major reasons I suggest a path to the CISSP that’s probably a little longer than what you normally hear. Thanks for reading. And I hope it helps. 

Keatron.

I agree with every word of it. You cannot secure a network, a server, a website, or even a stand-alone PC, if you don’t know how those things work in the first place. Security is a second-tier skillset, you have to learn how it works before you can learn how to protect it. ”Security” isn’t some additional field that was invented for us to work in, it’s a term for the in-depth knowledge we gain as we work and learn about these systems that helps prevent exploits and hacks from being executed. UnixGuy’s question is a common one, and he’s not stupid or self-entitled for thinking that the road is too long. Unfortunately, I think that security isn’t taken seriously enough as a whole by this industry, (and many others,) and the result is that most of us don’t know how much work and effort goes into becoming an expert on that level.

Given, even experts make mistakes and sometimes the black-hats (bad guys) are sometimes smarter than the white hats (good guys), but that’s all the more reason to study, train, and prepare yourself if you want to be a CISSP, for example. Some people think the road is too long. . . I think that the road isn’t often long enough. It’s a big, bad world out there full of threats and people who want to steal our information. The more you know, the fewer times you’ll get caught with your pants down.

So far, I’ve done a bare-bones install of Exchange 2010 three times, (once almost without any screw-ups,) in a lab environment consisting of a domain controller and a member server both running Windows Server 2008 R2. Baby steps, baby steps.

In the words of the great Ben Croshaw: “Allow me to hold your head under the putrescent waters of knowledge.”

Is the IT industry elitist? In a word: yes. It’s one of the few industries where the words “entry level” actually mean you should have several years of experience before applying. It’s an industry where there is always someone younger, someone smarter, someone willing to work longer hours out to take your job and steal your promotion. It’s an industry notorious for its demand that we update our skills faster and faster with each passing year, and that’s simply to stay current with the job(s) we already work in.

However, there are some pretty good reasons.

The first reason is that, in IT, the spectrum of responsibility you are expected to carry can range from simply making sure a few office-workers can connect to the internet and download their email, to keeping system-critical servers and equipment working for hospitals and banks. We need to stay sharp, we need to keep ourselves up to date, and we need to grow with technology or we can’t do our jobs and maintain that technology. That, of course, brings me to another reason.

Technology changes, the needs of businesses and users change, and we have to change with them. There is no way to do business today the way we did in the 80′s, the 90′s, or even the way we did in 2005. If you want to complain because you’re just now learning what a server is, and most companies want someone who understands virtualization, that’s nobody’s problem but yours. One of the points that Ayn Rand once made is one I whole-heartedly agree with: a person is not hired for a job to his or her best, they’re hired to do what is necessary to complete that job. This industry requires a VAST amount of knowledge on our part, a great deal of flexibility, and a practical understanding of how to use that knowledge to keep the world running. On to the next point.

As Sabalo mentioned, there are lots of people who get into IT thinking it’s easy money, then complain when they find out it’s harder than they thought. Oddly, no one expects to be a doctor, physicist, astronaut, firefighter, or engineer without a lot of work beforehand, and this industry is no different. And, honestly, it’s not for everyone. Not everyone “has the right stuff”, and some people even spend anywhere from two to eight years in school before they figure out that IT isn’t for them. (This is also true for those other professions I mentioned, as well as many others, like computer science.) You keep working, you keep learning, and then you figure out if this is the path for you or if your best simply isn’t good enough and another path is a better choice.

It sounds like you’re fresh out of college, so you’ve got plenty of time to decide what to do with your life. You were told you weren’t a good fit for the job(s) you applied for, so right now you’ve got a choice:

A.) Blame the hiring manager(s) that turned you down for being unfair not realizing your genius.

B.) Figure out why they didn’t want to hire you, and work on those things.

Maybe you need more experience? Volunteer your time. Maybe you need more certs? Study and earn them. Maybe you need to work on your interviewing skills? Talk to professionals, (like the ones on this board,) and ask them for help. Maybe your communication skills are rusty? Take some writing and speech courses. There are lots of things we all need to improve on, don’t expect to be the exception to the rule.

If all this sounds a little harsh, it’s because it is. IT is a competitive industry, and it doesn’t suffer fools. It’s better to know what you’re getting into and try to live up to that, than it is to get thumped on the head a few times and grow bitter because of it. We’ve all been new to IT, and most of us are here to offer help. . . but only if you can accept that you just might need it.

Check out Keith’s blog for the full description of the following videos:

• AD Domain Join
• User Authentication
• Bow to Group Policy (Desktop Management)

Microsoft just announced that Visual Studio 2010 Beta 1 is available to evaluate. Channel 9 also has some great tutorials and discussions, including this one which involves the download and installation of the beta.

You can find some great resources on the page linked to above, as well as from this blog. It follows the objectives outlined by CompTIA’s Server+ site.

The following is the current information linked from JDMurray’s entry on the TechExams.net blog.

A group of members here at TechExams.net are a little excited about the new beta exam for the revised CompTIA Server+ certification for 2009. OK, we’re excited at the prospect of picking up yet-another-certification for free while helping CompTIA test-run its latest revision of the Server+ exam. I already have the Server+ cert from way back in 2003, but my opinion is apparently as valuable a non-cert holder, so I was granted an opportunity by CompTIA to participate as well.

The objectives for the 2009 Server+ exam certainly show quite an improvement over the exam I took. I remember the big areas I had to study-up on were tape backup strategies, the numerous levels of RAID,  and the various types of SCSI technology. The revised Server+ exam adds objectives about networks and networking devices, file systems, motherboards and components, electronic media storage systems, and virtualization. There are also sections on physical security, disaster recover, and troubleshooting. The new Server+ is a lot like the A+ and Network+ certs combined, but from the server room tech’s point of view.

Anyway, I don’t want to review the new Server+ exam before I actually take it. Instead, this article presents a study reference for the Server+ exam for those people who are participating in the beta test, and for those who will take the exam after it is formally released. The following (long) listing is derived from the 2009 Server+ objectives and contains links to external Web sites (mostly Wikipedia) that provide information about each objective. Remember that CompTIA exams are entry-level, so it’s not necessary to become an expert on each objective, but please do try and learn a few new things along the way.

1.0 System Hardware

1.1 Differentiate between system board types, features, components and their purposes.

• Dip switches / jumpers • Processor (single and multi) • Bus types and bus speeds • On board components

o NICs o Video o Audio o USB o HID o Serial o Parallel

• Expansion slots

o PCI o PCIe o PCIx o AGP o ISA

• BIOS • Riser Card / backplane • Storage connectors

o SCSI o SATA o IDE o Floppy

1.2 Deploy different chassis types and the appropriate components

• Cooling

o Fans o Water cooled o Passive o Active o Shroud o Ducts o Redundant cooling o Hot swappable o Ventilation

• Form Factor (tower, rack, blade)

o Space utilization (U size, height, width, depth)

• Power

o Connectors o Voltages o Phase

• Redundant power • Shut off switches – chassis intrusion • Power buttons • Reset buttons • Diagnostic LEDs • Expansion bays

1.3 Differentiate between memory features / types and given a scenario select appropriate memory

• Memory pairing • ECC vs. non ECC • Registered vs. non-registered • RAID and hot spares • Types

o DDR o Fully buffered DIMM o DDR2 o SDRAM o DDR3

• Memory compatibility

o Speed o Size o Pins o CAS latency o Timing o Vendor specific memory

• On board vs. riser card

1.4 Explain the importance of a Hardware Compatibility List (HCL)

• Vendor standards for hardware • Memory and processor compatibility • Expansion cards compatibility • Virtualization requirements

1.5 Differentiate between processor features / types and given a scenario select the appropriate processor

• Multicore • Multiprocessor • Cache levels • Stepping • Speed • VRMs • Execute disable (XD) or not execute (NX) • Hyperthreading • VT or AMD-V • AMD vs. Intel (non-compatible CPUs) • Processor architecture (RISC, CISC) • Vendor slot types • 64-bit vs. 32-bit • Heat dissipation (heat sinks, fans, liquid cooling)

1.6 Given a scenario, install appropriate expansion cards into a server while taking fault tolerance into consideration.

• Manufacturer specific

o Fax cards o PBX cards o Camera cards o VoIP

• HBAs • NICs • Video • Audio • Storage controller (SCSI, SATA, RAID)

o SCSI low voltage / high voltage (LVD/HVD) o SCSI IDs o Cables and connectors o Active vs. passive termination

• Port expansion cards

o USB o IEEE 1394 o Serial o Parallel

1.7 Install, update and configure appropriate firmware.

• Driver / hardware compatibility • Implications of a failed firmware upgrade (redundant BIOS) • Follow manufacturer instructions and documentation

2.0 Software

2.1 Install, deploy, configure and update NOS (Windows / *nix).

• Installation methods (optical media, USB, network share, PXE)

o Imaging – system cloning and deployment (Ghost, RIS/WDS, Altiris, virtualization templates)

• Bootloader • File systems

o FAT o FAT32 o NTFS o VMFS o ZFS o EXT3

• Driver installation

o Driver acquisition o Installation methods o Require media

• Configure NOS

o Initial network o User o Device o Roles o OS environmental settings o Applications and tools

• Patch management

2.2 Explain NOS security software and its features.

• Software firewall

o Port blocking o Application exception o ACL

• Malware protection software

o Antivirus o Antispyware

• Basics of file level permissions vs. share permissions

2.3 Given a scenario, implement and administer NOS management features based on procedures and guidelines

• User management

o Add and remove users o Setting permissions o Group memberships o Policies o Logon scripts

• Resource management

o ACLs o Quotas o Shadow volumes o Disk management o Performance monitoring o Baselining

• Monitoring (tools and agents)

o SNMP (MIBs) o WBEM (WMI)

2.4 Explain different server roles, their purpose and how they interact

• File server and print server • Database server • Web server • Messaging server • DHCP server • Directory services server • DNS server • Application server

o Update server and proxy server o Filtering server o Monitoring server o Dedicated o Distributed o Peer to peer

• Remote access server • Virtualized services • NTP server • Explain the different between a workstation, desktop and a server • Server shut down and start up sequence (one server vs. multiple servers vs. attached components)

2.5 Summarize server virtualization concepts, features and considerations

• Resource utilization • Configuration • Interconnectivity • Management server • Reasons for virtualization

o Cost benefits o Redundancy o Green initiative o Disaster recovery o Testing environment o Ease of deployment

2.6 Describe common elements of networking essentials

• TCP/IP

o Subnetting o DNS o DHCP o Classes o Gateways o Static vs. dynamic o IP stack o Ports

• Ethernet

o Types o Speeds o Cables

• VPN • VLAN • DMZ

3.0 Storage

3.1 Describe RAID technologies and its features and benefits

• Hot spare • Software vs. hardware • Cache read/write levels (data loss potential) • Performance benefits and tradeoffs

3.2 Given a scenario, select the appropriate RAID level

• 0, 1, 3, 5, 6, 10, 50 • Performance benefits and tradeoffs

3.3 Install and configure different internal storage technologies

• Hot swappable vs. non-hot swappable • SCSI, Ultra SCSI, Ultra320 (termination), LUNs • SAS, SATA • Tape • Optical

o DVD o DVD-R o CD-ROM o CD-R o CD-RW o Blu-Ray

• Flash • Floppy (USB) • Controller (firmware levels) • Hard drive (firmware, JBOD)

3.4 Summarize the purpose of external storage technologies

• Network attached storage • Storage area network • Tape library • WORM • Optical jukebox • Transport media

o iSCSI o SATA o SAS o SCSI o Fiber Channel

4.0 IT Environment

4.1 Write, utilize and maintain documentation, diagrams and procedures

• Follow pre-installation plan when building or upgrading servers • Labeling • Diagram server racks and environment topologies • Hardware and software upgrade, installation, configuration , server role and repair logs • Document server baseline (before and after service) • Original hardware configuration, service tags, asset management and warranty • Vendor specific documentation

4.2 Given a scenario, explain the purpose of the following industry best practices

• Follow vendor specific server best practices

o Documentation o Tools o Websites

• Explore ramifications before implementing change – determine organizational impact • Communicate with stakeholders before taking action and upon completion of action • Comply with all local laws / regulations, industry and corporate regulations • Purpose of Service Level Agreement (SLAs) • Follow change control procedures • Equipment disposal

4.3 Determine an appropriate physical environment for the server location

• Check for adequate and dedicated power, proper amperage and voltage

o UPS systems (check load, document service, periodic testing) o UPS specifications (run time, max load, bypass procedures, server communication and shut down, proper monitoring)

• Server cooling considerations – HVAC

o Adequate cooling in room o Adequate cooling in server rack o Temperature and humidity monitors

4.4 Implement and configure different methods of server access

• KVM (local and IP based) • Direct connect • Remote management

o Remote control o Administration o Software deployment o Dedicated management port

4.5 Given a scenario, classify physical security measures for a server location

• Physical server security

o Locked doors o Rack doors o CCTV o Mantraps o Security personnel

• Access control devices (RFID, keypads, pinpads)

o Biometric devices (fingerprint scanner, retina)

• Security procedures

o Limited access o Access logs o Limited hours

• Defense in-depth – multiple layers of defense • Reasons for physical security

o Theft o Data loss o Hacking

• Secure documentation related to servers

o Passwords o System configurations o Logs

5.0 Disaster Recovery

5.1 Compare and contrast backup and restoration methodologies, media types and concepts

• Methodologies (full, incremental, differential)

o Snapshot o Copy o Bare metal o Open file o Databases o Data vs. OS restore o Rotation and retention (grandfather, father and son, leaning tower)

• Media types

o Tape o Disk o WORM o Optical o Flash

• Backup security and off-site storage • Importance of testing the backup and restoration process

5.2 Given a scenario, compare and contrast the different types of replication methods

• Disk to disk • Server to server

o Clustering o Active/active o Active/passive

• Site to site • Site types

o Cold site o Hot site o Warm site o Distance requirements

5.3 Explain data retention and destruction concepts

• Awareness of potential legal requirements • Awareness of potential company policy requirements • Differentiate between archiving and backup

5.4 Given a scenario, carry out the following basic steps of a disaster recovery plan

• Disaster recovery testing process • Follow emergency procedures (people first) • Use appropriate fire suppressants • Follow escalation procedures for emergencies • Classification of systems (prioritization during recovery)

6.0 Troubleshooting

6.1 Explain troubleshooting theory and methodologies

• Identify the problem and determine the scope

o Question users/stakeholders and identify changes to the server / environment o Collect additional documentation / logs o If possible, replicate the problem as appropriate o If possible, perform backups before making changes

• Establish a theory of probable cause (question the obvious)

o Determine whether there is a common element of symptom causing multiple problems

• Test the theory to determine cause

o Once theory is confirmed determine next steps to resolve problem o If theory is not confirmed re-establish new theory or escalate

• Establish a plan of action to resolve the problem and notify impacted users • Implement the solution or escalate as appropriate

o Make one change at a time and test/confirm the change has resolved the problem o If the problem is not resolved, reverse the change if appropriate and implement new change

• Verify full system functionality and if applicable implement preventative measures • Performa a root cause analysis • Document findings, actions and outcomes throughout the process

6.2 Given a scenario, effectively troubleshoot hardware problems, selecting the appropriate tools and methods

• Common problems

o Failed POST o Overheating o Memory failure o Onboard component failure o Processor failure o Incorrect boot sequence o Expansion card failure o Operating system not found o Drive failure o Power supply failure o I/O failure

• Causes of common problems

o Third party components or incompatible components o Incompatible or incorrect BIOS o Cooling failure o Mismatched components o Backplane failure

• Environmental issues

o Dust o Humidity o Temperature o Power surge / failure

• Hardware tools

o Power supply tester (multimeter) o System board tester o Compressed air o ESD equipment

6.3 Given a scenario, effectively troubleshoot software problems, selecting the appropriate tools and methods

• Common problems

o User unable to logon o User cannot access resources o Memory leak o BSOD / stop o OS boot failure o Driver issues o Runaway process o Cannot mount drive o Cannot write to system log o Slow OS performance o Patch update failure o Service failure o Hangs no shut down o Users cannot print

• Cause of common problems

o Malware o Unauthorized software o Software firewall o User Account Control (UAC/SUDO) o Improper permissions o Corrupted files o Lack of hard drive space o Lack of system resources o Virtual memory (misconfigured, corrupt) o Fragmentation o Encryption o Print server drivers/services o Print spooler

• Software tools

o System logs o Monitoring tools (resource monitor, performance monitor) o Defragmentation tools

6.4 Given a scenario, effectively diagnose network problems, selecting the appropriate tools and methods

• Common problems

o Internet connectivity failure o Email failure o Resource unavailable o DHCP server mis-configured o Non-functional or unreachable o Destination host unreachable o Unknown host o Default gateway mis-configured o Failure of service provider o Can reach by IP not by host name

• Causes of common problems

o Improper IP configuration o VLAN configuration o Port security o Improper subnetting o Component failure o Incorrect OS route tables o Bad cables o Firewall (mis-configuration, hardware failure, software failure) o Mis-configured NIC, routing / switch issues o DNS and/or DHCP failure o Mis-configured hosts file

• Networking tools

o ping o tracert / traceroute o ipconfig / ifconfig o nslookup o net use / mount o route o nbtstat o netstat

6.5 Given a scenario, effectively troubleshoot storage problems, selecting the appropriate tools and methods

• Common problems

o Slow file access o OS not found o Data not available o Unsuccessful backup o Error lights o Unable to mount the device o Drive not available o Cannot access logical drive o Data corruption o Slow I/O performance o Restore failure o Cache failure o Multiple drive failure

• Causes of common problems

o Media failure o Drive failure o Controller failure o HBA failure o Loose connectors o Cable problems o Mis-configuration o Improper termination o Corrupt boot sector o Corrupt file system table o Array rebuild o Improper disk partition o Bad sectors o Cache battery failure o Cache turned off o Insufficient space o Improper RAID configuration o Mis-matched drives o Backplane failure

• Storage tools

o Partitioning tools
o Disk management
o RAID array management
o Array management
o System logs
o Net use / mount command
o Monitoring tools

The subscription page can be found here.

Select Microsoft TechNet Plus Direct Subscription, enter the promo code TW7OBA in the field that reads If you have a Promotion Code, please enter it here and then hit the button to go to the next page. Enjoy!

Register with Prometric starting April 27th. The actual testing window is from May 5th – May 18th. Oh, and you have to use promo code WIN7J in order to sign up for the exam.

Also, today is National High-Five Day.

You can download SharePoint Designer 2007 here.