certifications

Remembering Michelangelo

Dave Farquhar security , , , , , , , ,

Yesterday was the 20th anniversary of the Michelangelo virus. If you don’t remember, on March 6, 1992, Michelangelo was programmed to overwrite the first 100 sectors of a hard drive–not quite as destructive as formatting a drive, but to the average user, the effect is the same. It was a huge scare–John McAfee predicted five million computers would be affected–but largely was a non-event.

Those of you studying for security certifications would do well to remember that Michelangelo is a prime example of a virus and a logic bomb. Viruses replicate; logic bombs do something when an event triggers. Malware doesn’t always fit neatly into specific categories–crossovers are common.
Read more

Taking things to the next level

Dave Farquhar Uncategorized ,

I got a comment over the weekend suggesting that I could really take things to the next level with photos, illustrations, and videos. I don’t know if it was a serious comment or spam (the link provided looked very suspicious), but I’ll address the comment.
Read more

What I would say to someone starting to study journalism today

Dave Farquhar Journalism , , ,

One of my former classmates sent out a query, asking what we’d tell someone who was thinking about studying journalism today. Predictably, a lot of people wrote “Don’t do it!” or “Newspapers aren’t hiring anyone,” or something similar. I never had time to change careers; my IT career essentially started a week after I started taking journalism classes and I was working full-time in IT a good three months before the dean of the school shook my hand and gave me my diploma.

Although I’ve had to explain my education virtually every time I’ve been interviewed for a job, I don’t regret it.
Read more

If you don’t know what SOPA and PIPA are

Dave Farquhar Copyright , ,

If you don’t know what SOPA and PIPA are, I urge you to visit this site. SOPA and PIPA, among other things, completely undermine the idea of due process, without which we might as well still be constituents of King George III.

If we want a government of the people, for the people, and by the people, SOPA and PIPA have to be stopped. If we want a government of the corporations, for the corporations, by the corporations, SOPA and PIPA are a tremendous jump in that direction.

Write your congressmen. You can do it from the site linked above. If you have certifications, sign off with them. Any little extra bit of weight you can throw behind your argument helps.

Copyrights can be useful things, but SOPA and PIPA have too many unintended consequences. It’s like treating an illness with hemlock. It’ll cure the illness, but there’s this one side effect that’s a doozy.

The worst test I ever took

Dave Farquhar Personal , , , , , ,

I’m gearing up (finally) to take the CISSP, a 250-question marathon of an exam that covers everything from firewalls and intrusion detection systems to how tall the fence or wall around a building should be and what kind of lights to use in a parking garage.  And everything in between. Three of my colleagues have had CISSP certifications for several years, and on Friday two of them were telling me what to expect.

And the worst test I’ve ever taken came to mind. No, it wasn’t Security+. I had a pretty good idea I was going to pass that one, which I did. The worst test I ever took was Dr. Walter Johnson‘s Fundamental Macroeconomics (Economics 1) makeup final at Mizzou, circa Winter 1994.

Read more

That’s David L. Farquhar, Security+ now

Dave Farquhar Personal ,

I got a few letters behind my name this afternoon. I passed the CompTIA Security+ exam with flying colors. And that means two things: I get to keep my job, and I was qualified to have the job in the first place, but now I have a certificate that says a third party agrees.My personal opinion on the test: You have to approach it like any other test. Another coworker took the test at the same time I did. He was joking around with other people and talking up a storm beforehand. Meanwhile, I was pacing, counting on my fingers and not talking to anyone. I had five things I needed to remember until the clock on the test started and I could scribble them down, so I was focused solely on those five things.

My coworker said he was worried about me because I appeared to be nervous. But that’s just how I am before tests. I review a few things up until the time I’m supposed to walk in, and I take any aid the system provides. If I can carry in an index card, I do that. In the case of CompTIA tests, you can ask for a pencil and piece of paper and scribble down whatever you want on it after the test starts. So I did.

I probably would have passed without that, but I didn’t want to score a 765 on the test (passing is either 764 or 765 out of a possible 900). I wanted an 899. For what it’s worth, my score was a lot closer to 899 than 765.

My coworker and I also both believe the test is designed to frustrate you. The first 30 or so questions were pretty easy. Then my coworker missed 18 questions in a row. He knew he missed them, and there wasn’t anything he could do about it. I was pretty confident about my test, but most of my questionable questions came in bunches too. The real key is to not get bogged down in those rough stretches. It gets better.

Of the 100 questions on the test, only 85 count. The contents of the other 15 are anyone’s guess. Some are questions they’re considering to add to the test’s question pool, and based on how people answer them, they’ll decide if they’re fair or unfair. Some are just plain garbage. I had two questions, I think, that had no right answer out of the four options. I think those are control questions to thwart the companies who pay people to take the test and remember a few questions verbatim so they can build up a bank of test questions to sell. If, for example, you pay for some questions and see one asking where the password hashes are stored on a Linux system, and all four responses start with C:\, you’re going to lose confidence in that provider.

As for classes and books… CompTIA’s official class and book cover a lot of material, but there’s an awful lot of middle-management bull in the book and class that isn’t on the test. We had a manager take the test, and he knew the book forward and backward and paid attention in class, but he didn’t pass.

By the same token, every sysadmin who attended the same class and took the test has passed so far. Having lots of recent experience to draw on helps. I can harden Windows systems in my sleep because that’s been my job description for the last couple of years, and no week-long class can cover that kind of depth.

But the interesting thing is, I got very few questions about system hardening. I got a lot more questions about encryption and firewalls, where my knowledge is weaker. I don’t know if the test determines all of your questions at the start or if it uses the first few questions to figure out your weaker areas and then tries to concentrate on those, but I suspect it might be the latter.

But with Security+ out of the way, I’m thinking about other certifications. Network+ is supposed to be easy when Security+ is fresh in your mind. Given my hardware and operating systems background, A+ should be easy.

Dave goes to the doctor

Dave Farquhar Personal , , , ,

After spending the weekend in bed… wait, that sounds bad. After spending the weekend burning up and feeling like my tonsils were on fire… wait, that’s not much better. After spending the weekend sick, I called my doctor.
Actually, my girlfriend made me do it. From me describing the symptoms, she thought I probably had strep throat. Since she’s had it three times and since I would like to see her again sometime in the near future, I made the call this morning. He had an opening at three o’clock. I said I’d take it. I popped a couple of ibuprofen and crawled back into bed.

At 2:15, I ventured out into the bad, bad world. Let me clarify: Right now, anything that isn’t my bedroom or my bathroom qualifies as the bad, bad world. I went out Sunday for some sickie necessities and that was a big mistake. Not that it’s the worst thing that ever happened to me. I can think of worse things that have happened to me. Getting my wisdom teeth taken out wasn’t one of them, however. I stopped off at the ATM to get some fast cash, which I hoped would cover my copay and my script. Then I headed for the doctor’s office, which thanks to the usual spectacular driving on Telegraph Road, took me the better part of half an hour. The doctor’s office is less than five miles away.

Apparently I hadn’t been there since 1999. Or that was the last time I filled out any paperwork, at least. I was pretty sure I’d been in more recently than that. But I wasn’t in any mood to argue. I wasn’t in much mood to fill out forms either, but that doesn’t have anything to do with being sick. I remember one time, early in college, when I had to fill out a questionaire. One of the entries asked us about our favorite activities. I wrote down, “filling out forms.” (Those who know me well know that I’m never, ever sarcastic. Never. Nunca jamas. I don’t even know the meaning of the word, or I wouldn’t if it hadn’t been a dictionary.com word of the day.)

So I filled out the form, including questions about my insurance coverage I had no way of knowing. Some of it was on my insurance card. I guessed about the rest. The time that passed between me filling it out and handing it in would be ample time for it all to change anyway. For all I knew, Aetna wouldn’t be my insurance provider five minutes later. For all I know, it hasn’t been since 2001 and I’ll be getting a really nice phone call in the morning.

But the form satisfied everyone enough that I got to go in to see my doctor. If I committed fraud in the process, well, hopefully they still allow one phone call after they haul you off to jail. I’ll call Benefits and tell them to make sure the doctor gets paid. And I’ll politely ask someone to let my Pastor know I’m in jail. You know Lutherans. They take an offering every opportunity they get, so they’ll welcome an opportunity to take up a collection to bail me out. I hope. He’ll probably do it if I say I’m supposed to be an usher on Sunday.

They put me in a little room with a padded table, a sink, and a couple of chairs. There were certificates on the wall that said my doctor had been in the Army in the early 1980s and had studied at various military academies. There were a couple of expired AOA and AMA certifications. And nowhere was there any indication of where he’d gone to school. There are only two places for a doctor to go to school, of course: Kansas City and Kirksville.

The doctor came in and asked how I was feeling today. In that usual cheerful voice that people expect a terse “fine.” But I didn’t feel fine. I felt like I had a basketball in my throat and I wanted it out. So I told him my throat hurt. He asked how long my throat had hurt. I said since Saturday. He shined a light into my mouth and told me to say ah. After two minutes of trying to see what he needed to see, he gave up, got a tongue depresser, and shoved whatever had been blocking his view out of the way. I could tell you what he said he saw, but it’s gross. It also was something I could have told him if he’d just asked.

As he got out a long cotton swab, he consulted my records to get some basics on my life so he could ask the kinds of questions that made it sound like he knew me. His acting skills didn’t impress me. Then he took a culture. I didn’t quite cough up a lung while he was doing that, but I tried.

He told me there lots of diseases that can cause a throat to hurt. Then I got an 8th grade Biology lesson. He told me there were two basic types of organisms that can infect your throat. He paused for a really, really long time as he put the culture in its test gizmo and wrote stuff down on my chart. Then he continued: “What I was getting at is that your throat can be infected by bacteria, or it can be infected by viruses.” Then I figured out that he was in the process of explaining to me why he didn’t just automatically write me a prescription for penicillin. So I finished the paragraph for him: “But if it’s a virus there’s no point in giving me an antibiotic because an antibiotic can’t kill a virus.”

I’m pretty sure that 8th grade Biology was the last A that I ever got in a science class. Well, other than Computer Science 103 in college, but that doesn’t count. Even a dumb journalist can get an A in that class.

But yes, I remember my basic biology.

I tested negative for strep. The doctor asked how old I was. I said 28. I hadn’t figured out yet where he was going. He put his hands around my throat–something a lot of people have longed to do for a very long time–and looked for enlarged glands. Then he had me lay back and he felt around my abdomen. Then he checked my breathing.

Then he started telling me about a virus that can make your throat sore: Mononucleosis.

“Mono!?” I interrupted him. I know about mono. I know it’s the bane of college students everywhere. College students tend to get it and it tends to ruin their careers. I remember an uptight health teacher citing mono as a reason why people shouldn’t kiss. Probably the same health teacher who had both of his kids through artificial insemination. With his wife. He was the donor. Yes, he was a bit paranoid. And weird. But I’m getting off topic for about the 47th time today.

“Have you been around anyone lately who has mono?” he asked.

“Not that I know of,” I said. And that’s true. No, I still won’t tell you where I work, but it’s hard to imagine anyone there running around with mono. We’re talking a place where you’re not considered an adult until all of your kids have graduated college. Not to mention that some of those guys’ attitudes about women make me wonder how they ever would have had the opportunity to ever be exposed to mono, let alone the opportunity to have kids who would then grow to college age…

And as far as–ahem–extracurricular opportunities to be exposed to mono, I come up blank there too. I’m not exactly the kind of guy who kisses everything that walks upright and breathes oxygen.

“Well, you’re too old for mono to be very likely,” he said, snapping me back to the present reality. “So I’m going to give you penicillin. But I’m going to order blood work.”

And then I was off for another one of my all-time favorite activities–having blood drawn–but there wasn’t really anything interesting about that. I didn’t look, as usual, it hurt, as usual, and I didn’t know when it was over, as usual, and they put a piece of cotton the size of Texas on it afterward, as usual, held in place by an impossibly tiny band-aid, as usual. The only thing unusual about it was the band-aid had Bugs Bunny on it. Good thing I wasn’t going to work afterward. I’d get teased about that. Good thing only the Internet’s going to know about that.

Then my Bugs Bunny band-aid and I went off to get my penicillin, where I found out that my prescription card is no good. Great, another phone call… The pharmacist said penicillin is really cheap though, so he asked if he should just check the cash price. I said fine. Not having to wait until Tuesday to start my dosage was worth a few bucks to me. The price came up $9.53, Tax Man Carnahan Holden’s cut included. I’m pretty sure my copayment would have been 20 bucks. So not having a working insurance card worked to my advantage, to the tune of 10 bucks.

Then I went home. No light blinking on my answering machine. That’s good, at least if you ascribe to the theory that bad news travels fast, which I do. I popped my first penicillin, and started to wait the 8 hours until my next.

And I checked the usual symptoms of mono. The only ones I have–sore throat, achy joints, diminished appetite–can be symptoms of absolutely anything.

So we’ll see.