cissp exam Archives

Home » cissp exam

Security+ vs CISSP

Dave Farquhar security September 27, 2016October 10, 2017buffer overflow, certifications, cissp, cissp exam

Someone asked me to compare Security+ vs CISSP, particularly the difficulty. I’m glad to oblige. I have both certifications.

Let’s start by looking at a couple of hypothetical questions. Don’t expect to see either of these on the test; I’m making them up as I go. But don’t be surprised if you see something similar.

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

How a dictionary attack works

Dave Farquhar security September 19, 2016July 15, 2018cissp, cissp exam, NSA, passwords

A dictionary attack is a common way to steal a password. Here’s how a dictionary attack works, in layperson’s terms. More importantly, here’s how to beat the attack.

A dictionary attack is a much more efficient alternative to brute force hacking, but it requires a local copy of the user database to work. That usually means stealing the database first, if a bad guy is doing it. But nothing stops a company from doing a dictionary attack on its own user accounts to make sure people aren’t using insecure passwords. It’s unusual, but not unheard of.

Dave Farquhar

dfarq.homeip.net

SSCP vs CISSP

Dave Farquhar security June 30, 2016August 11, 2018certifications, cissp, cissp exam, isc, SSCP

SSCP and CISSP are both (ISC)² certifications. I get a lot of questions about the two of them, especially about SSCP, as CISSP overshadows it. So let’s look at SSCP vs CISSP.

CISSP definitely pays better, but that’s not to say SSCP doesn’t have merit.

Dave Farquhar

dfarq.homeip.net

How to become an Info Assurance Analyst

Dave Farquhar security February 11, 2015November 30, 2016CERT, certifications, CISO, cissp, cissp exam, excel, Information Assurance, information security, Liquid Matrix, podcast, trolls, unix, vulnerability

So, CNN/Money ran a story on the best 100 jobs in the United States, based on pay, projected job growth over the next 10 years, and quality of life ratings. And there was my job title, at #9. I think you should want to become one, so here’s how to become an Info Assurance Analyst.

The field desperately needs more of us, so I’m happy to share with you how to become someone like me. Read more

Dave Farquhar

dfarq.homeip.net

CPE opportunity: Exploding the Phone

Dave Farquhar security February 17, 2013July 4, 2018AT&T, CBK, cissp, cissp exam, CPE, isc, phone phreaking

This week Cnet interviewed Phil Lapsley, the author of Exploding the Phone, a book about the early history of phone phreaking.

Phone phreaking is absolutely fair game for the CISSP exam. I couldn’t tell you anymore how many phone phreaking questions I had to answer, but let me just say I’m glad I’d read those pages in the CBK about phone phreaking.

Dave Farquhar

dfarq.homeip.net

Is it better to be a consultant or an employee?

Dave Farquhar Careers October 16, 2012May 18, 2022christmas, cissp, cissp exam, home depot, mercenary

I ran into a former supervisor from many years ago at the local Home Depot this evening. We had a pleasant discussion. It reminded me of a question I asked, right around the time he and I last talked. I asked whether it’s better to be a consultant or an employee.

Here’s what I would say to my 2005 self if I could, somehow. I present it here since I know someone else must have the same question.

Dave Farquhar

dfarq.homeip.net

Did I violate my code of ethics?

Dave Farquhar security June 18, 2012June 17, 2012cissp, cissp exam, isc

The CISSP exam (and any other (ISC)² exam) asks a few ethical questions. This question isn’t quite clear-cut enough for the test, I don’t think. But if you’re wondering what the test is like, this actually isn’t a bad thing to work through. My ethical questions on the test were more clear-cut than this, but the security questions weren’t.

Dave Farquhar

dfarq.homeip.net

Quit sniveling about a tech skills gap and train your workers

Dave Farquhar Uncategorized March 14, 2012certifications, cissp, cissp exam, infoworld

Infoworld tells employers to quit sniveling about their workers not having enough skills and train them.

Sounds good. It worked in the organization where I work.

Dave Farquhar

dfarq.homeip.net

Open-source licenses, the CISSP, and the real world

Dave Farquhar Copyright, security February 4, 2012July 14, 2017BSD, buffer overflow, cissp, cissp exam, debian, demonstration, firewall, project management, vulnerability

You may have a question about open-source licenses on your CISSP exam. I don’t remember the specifics and wouldn’t be able to repeat them anyway, but I had a question on my exam where knowing the differences was helpful in finding the right answer.

And I had to deal with an issue this past week involving open-source technologies where the licenses made a big difference.

Dave Farquhar

dfarq.homeip.net