Measuring company reputation

One of the bullet buttons in the (ISC)2 Security Domain 1 (security and risk management) is risk analysis (yes, you with the beard on the back row, that would be under NIST 800-53r5 Security Domain 14). There are many ways to define it but I will be lazy and steal the defition of it from NIST 800-160 because it is short and to the point:

Risk Analysis is the process to comprehend the nature of risk and to determine the level of risk.

We can subdivide this analysis into two groups based on the criteria we use in the decision process: quantitative and qualitative analysis. Without going over the details, the bottom line is a lot of people ignore qualitative analysis because it does not directly tie into money: how can you ask for fundings to executives if you cannot provide a proper cost-benefit analysis? For instance, if you are asked to measure and tie to the yearly budget, say, your company reputation (a topic picked out of blue which has absolutely nothing to do with the title of this article), what would you do? After all, this is the typical topic qualitative risk analysis is built for.

The answer is we can quatify it if we look at it in a non-direct way. If you think about it, company reputation can be "itemized" by the things that affect it:

• Your cyber insurance, which is affected by how the insurers think you are about protecting your assets. So you can say "since we have not been breached in X years and we have great security policy which is enforced and audited, our insurance is lower than from our competitors." Can you see how close this narrative now is to that associated with the Annualized Loss Expectancy (ALE)? You may be able to ask the insurers to explain how a recent loss of personal data will affect the premium. There is no guarantees they will talk, but there is a compelling argument to work together to decrease their risk.
• Customer confidence, which is affected by how many data breaches you had, how you handled them, and how you deal with the customer's data. This can be estimated by investigating the decrease of sales of other companies due to loss of personal data including credit card info. People vote with their wallets, and their letters to elected officials.
• Your suppliers confidence on you, which leads to whether they will provide you with discounts, less interest, and longer times to pay your orders. If they do not trust you, they may say any bill is due on receipt. That affects cashflow in a very definite way.

Each of these in the end of the day affects the bottom line ($), which is what matters to upper management.

Thoughts on taking the CISSP exam - 2

Plan Your Dive, Dive By Your Plan

That is the motto of the Divers Alert Network, and I think it is very appropriate here... and on job interviews.

One thing I did not add to the original post on taking the CISSP exam is that on the day before the exam, I drove to it about the same time I expected to leave. Reason is that I wanted to know where the place was and how long it would take so I would be there 30min or so before it started. In other words, I wanted to eliminate a source of pre-test stress.

Without further ado, here are the real pictures I took that day:

1. First, here is the building. After driving there on the day before, I decided to leave home 15 minutes earlier to account for the traffic I saw. Also, I am glad I did the dry run since on the exam day, when I drove into the road that leads to the parking lot the building is located, it was packed. I then realized by looking at the vehicles they were going to the construction site I noticed in the previous day, so I was able to go around them instead of sitting there and missing my appointment.
   

   If you are not driving there, it is even more important to figure out how to get to the test site well in advance. Imagine if you need to take a few trains and maybe a subway or a tram in the process? Are they schedule reliable? If you miss one of those public transports, how long will you have to wait until the next?

2. Once inside, I was very happy to find out there was a nice sign pointing to where the Pearson VUE office was. Nice touch, Pearson VUE!
   
3. The actually office where the exam took place was down the corridor. I also took the opportunity to find out where the bathroom is. Remember you can take bathroom breaks; it might be wise to find its location so you do not waste valuable exam time hunting for it when you really need to go.
   

   Incidentally, there was a water fountain across the corridor from the bathroom.

4. During exam day, I had no problem getting there ahead of time. In fact, I was so ahead of time the suit was still locked. By then a few more candidates, for other exams it turned out, had showed up. We chatted a bit until they let us in. And it was smooth sailing until the exam started.

TL;DR: Make your life easier! Eliminate as many variables before the exam as you can.

Thoughts on taking the CISSP exam

There are a lot of sites, articles, and videos with lots of useful and helpful information on how to prepare for the CISSP exam, including why you should (or not) consider getting this certification to begin with.

This is not one of them.

Everyone has a study strategy -- watching videos, reading books, taking a live/online class -- so I will not comment on that. What I did after is where I want to focus on, namely taking practice exams. Short version is learn from my mistakes. Long version is that there are

• Known knowns: what you already know from your experience and previous study.
• Known unknowns: what you know that may be in the exam but you have never studied or dealt with. For many, that would be binary math and cryptography.
• Unknown unknowns: what may be in the exam and you have no idea it even exists to begin with.

What you know, you know so no need to spend much time on that besides refreshing. What you know you do not know, you can study/practice/figure some way to learn. But, if you do not know that you do not know something that may be in the exam, it will bite you. You need to convert the unknown unknowns into known unknowns so you can work with them. To find them, focus on those practice tests at least for the last two weeks before the exam. You are using these exams to probe were you need to work on. Examine the results and explanations associated with the questions you did get wrong. In my case, they could be grouped as:

1. Rushing to read and missing a keyword. Read the entire question and all the answers. I know that sometimes the question starts with 5 sentences of story time before getting to the point, but take your time to read it all. Then read it again to identify the key points in both question and answers. Slow is fast, fast is slow. But, there is too slow; don't be James May.
   
2. Choosing an answer, second guessing, and then finding out the original answer was right. This is specially true for those questions you are not really 100% sure of the answer, and was how I missed most of the practice questions by far. Train and trust your gut.
3. Not eliminating the answers you know for sure are not right. As mentioned above, you will face questions that you are not sure of the right answer for some reason, like some encryption detail, but you may be able to deduce it. To do that, remember a Sherlock Holmes quote, "once you eliminate the impossible, whatever remains, no matter how improbable, must be the truth." First thing you need to do then is get rid of all the answers that could not possibly be true. Sometimes that will leave you with two answers, which means you have increased your chances of getting the right answer from 1 in 4 to 1 in 2 (it might be even better depening on how you want to calculate it).

   NOTE: this may not work with questions you need to select 4+ answers from a list. In one of the practice questions I took, it turned out I needed to select all of them. I read the explanation, try to understand the thought process, and then add to my study notes.

4. Trying to solve it as an engineer instead of as manager. This is reference to the famous "think as a manager" quote associated with this exam. Technical me may want to write my own solution while managerial me would refer to policy, buy a tool, or contract someone. If both technical and managerial questions are listed, pick the later for this exam.
5. (last but not least) you may be missing some knowledge. When I find those, I look at the explanation, add what I think will help me to my notes, and then check for futher info (in a book or online).

Full Disclosure: Items 1-4 were where I needed to work on.

Security and Privacy Certifications and CPEs

This may not sound like a security/privacy-related topic, but there is more to these professions than wearing hoodies with 'l337 H4ck3rz' written on its back.

Early this year I earned the ISACA Certified Data Privacy Solutions Engineer (CDPSE). They do issue pretty badges to put in your website to impress your friends and be the life of the party:

The thing is, if you want to keep your hard earned (and usually not cheap) professional credentials, you need to do some professional development, which is measured using Continuing Professional Education (CPE) credits. Before you put your surprised face on, understand this is not specific to IT and InfoSec industry. The first time I learned about that was in the medical industry: over there it is called Continuing Medical Education (CME), but the principle is the same.

ISACA is not the only place requiring CPEs; if you have a (ISC)2 (I am looking at you, CISSP holders) or CompTIA certification, chances are you too need some CPEs. Given the cost of the CISSP, the last thing you want to do is lose it because you did not spend the time to get the required amount of CPEs. For the sake of this discussion I will focus on how ISACA handles CPEs. According to this certification requirements, I need

• 20 CPEs annually
• 120 CPEs every 3 years

Two things I would like to point out:

1. The 3 year cycle you need to earn the 120 CPEs start in the year after you are certified. So, for me that would be 2022 to 2024.
2. You need to earn the CPEs for a given year X in the year X - 1. In my case, I was certified in 2021, so I need to earn and submit my CPEs in 2021 for the year 2022.
3. The math is a bit scary: you need a total of 120 CPEs in a 3 year interval; that means an average of 40 CPEs/year. If you have done the bare minimum -- 20 CPEs -- each year for years 1 and 2, in the last year you will need to come up with 80 CPEs. At the time I wrote this, my CPE count looks like this:
   
   I covered the bare minimum for 2022 but it would be better if I come up with another 9 CPEs.

So, how do we earn some nice free-range CPEs? ISACA does publish a doc on how to earn them. Some you can earn by doing things associated with them, like going to their conferences or taking their training classes. But you can also eanr them through other activities such as

• Teaching / Lecturing / Presenting: This is how I got most of my CPEs this year, thanks to the talks and the workshops I gave. You can earn a lot of them.
• Publication of Articles, Monographs and Books: Last article I wrote that was published happened last year, so it does not count. But, maybe you did something, as it earns you a lot of CPEs.
• Self-study Courses: I took a class -- Certified Cyber Security Architect -- in March of this year, so I could add some CPEs. I am also taking another class right now; I will contact the instructor to see if I can get CPEs trough it too.
• Non-ISACA Professional Education Activities and Meetings: In other words, attending monthly meetings, say the ISSA one, count as a way to earn a few more CPEs. Not much (I think one per meeting) but every little bit counts.
• Passing Related Professional Examinations: I did not realize I could also earn them this way, so I have a few more to add. Two CPEs per examination add up.
• Vendor Sales/Marketing Presentations: Suck it up and watch that infomercial webinar!

There are more events but these are the ones I have used.

Bottom Line

There is no excuse for you to lose a certification due to lack of CPEs! If I can do it, so can you!