For those of you who do not know the RSA conference is the largest IT security conference each year. Most vendors announce new products or discoveries at this event.

It should be fun! First up the Keynote presentation.

I break down IT Security into these groups;

Security Management & Governance
Security Research & Development
Security Operations
Security Forensics & Investigation
Security Consulting

Each area has different skill sets and certifications which demonstrate that skill. Now certifications are great I have several myself but keep in mind a certification will only say at some point in time I knew enough to pass a test. This is not real world experience and most employers know the difference.

As base I always tell anyone interested in security to pursue the CISSP certification this a well-respected and vendor agnostic general security certification. You will see it referenced in most IT security job postings as a requirement or “nice to have”. The CISSP is also good in that it requires an experience component to get the certification. So you need to have actually done some security before you can be certified. Something for the new security professionals to strive for.

Nothing beats good old fashion experience and the best way to get experience is to start at the bottom. If you are new to the workforce this is not usually and issue. Find some entry-level IT security analyst, network analyst, or application testing job and get started. The experience gained in these positions will apply directly to future positions and different IT security roles.

If you are seasoned professional with a few, ok several working years under your belt starting over is not always an option. I know if I told my family I was quitting my high paying job to start over at the bottom of a new career I would have some strange looks for sure. I often consul these individuals to look at the skills they already have  leverage those by looking for IT security positions with similar skill sets. For example if you have been and IT operations manager for many years switching to managing IT security operations is not a big jump. Or if you have been doing application testing for general performance learning the skills such as security development lifecycle and fuzzing is not a huge stretch either. Now the job pool is likely smaller and may take longer to find that position but they are out there.

As for certifications. There are two camps in IT Security; Certifications are a must and Who needs certifications! Hiring managers and human resources can relate to certifications and measurement of skill. I recommend them for your resume. Do not think a certification is a guarantee of a job far from it. Certifications show employers you have obtained a baseline level of knowledge and experience for which to compare you against other candidates.

Here is a list of certifications in no particular order grouped by my IT security career groups. You can google the acronyms for more details

Security Management and Governance: CISM, CISA, CGEIT, CRISC, GSLC, ISSMP, CAP

Security Research & Development: C|SP, GSSP,GREM, CSSLP

Security Operations: Vendor certifications specific to the tools you plane to use – Cisco, Symantec, Microsoft, McAfee, Websense etc., GIAC certifications

Security Forensics & Investigation: C|HFI, C|EH, C|IH, EnCE, GCFA

Security Consulting: C|NDA, LPT, C|SS, G7799, GCSC, ISSAP, ISSEP

So the long and short of becoming a security professional with career in IT security is find a way to gain some experience in a security field and start developing a resume which conveys that skill and experience. Training is good but nothing beats good old fashion experience whether you start at the bottom or translate current skills in to security skills experience and skill are paramount in this growing field.

What do you do then? Mobile computing is no longer a luxury it is a necessity for todays business. As I see it today you have two options keep everybody out and only expose the systems and data that mobile employees need through secure web portals or build an elastic perimeter which extends out around mobile systems and provides similar protections to that of the internal network.

No matter which option you choose basic online computer safety must be consider.

1) Ensure your operating system and applications are protected by applying the latest patches and fixes on a regular basis. Pay particular attention the software which you may not think of because it runs in the background and supports other applications things like Adobe Reader or the Java Runtime Environment.

2)Run Anti-malware (anti-virus/anti-spyware) software and keep it up to date.

3)Run a personal firewall. Most operating systems offer some form of personal firewall ensure it is on and learn how to use it.

Option 1 – Secure Web Portals

In this option the mobile system does not get access through the firewall rather the applications the user needs to access are exposed securely to outside world via a web site. Applications such as email, databases, and reporting tools can be published securely to external users can access them via web browser safely and securely. Strong authentication and encryption should be employed to ensure that only authorised users have access. In this option malware on the mobile system can not spread though the internal network because the mobile system is not connected directly the network. The mobile system will need to ensure it has followed the basic security listed above otherwise when they come back to the office and connect to the network they may still cause problems.

Option 2 – Elastic Perimeter

When I say elastic perimeter what I really mean is ensuring security controls similar to the network are deployed to mobile devices so they travel with them outside the network. For example stand-alone anti-malware software is great but an enterprise package which reports its events and logs to a central server allows administrators visibility into what is happening outside the walls. Host intrusion detection or prevention software will monitor traffic communicating with the mobile system and detect or block anything it sees as malicious. End-Point Data Loss Prevention tools ensure that only authorised data can be copied, printed, or transferred from the system. URL filtering software will prevent the user from accessing sites determined to be dangerous or non-business related. All of this combined with the basic security elements will extend the organizations perimeter out around the mobile system providing it protection and visibility to the administrators.

In summary todays mobile workers need new security models to protect them. The old days of put up a firewall and turn on a VPN will not cut it in todays internet connected world.

Original URL: http://myitsecurity.wordpress.com/2009/10/05/microsoft-techdays-toronto-was-a-success/

Is shorten to: http://tinyurl.com/y8z9kwo

This type of service is very helpful when you want to post links in the often character constrained environments of social networking sites like Twitter.

Convenient Yes! Safe, maybe. You see what TinyURL, Bit.ly and other shortening services are doing is recreating a database of URL, when a user requests the shortened URL from the site they look up the full URL and forward the requesting user to that site. The shorten URL obscures the final destination of the link from the user.

Now most people are using these services for legitimate reasons. I use them myself they are great and useful. But a malicious user could post a shortened URL claiming to be to a blog post on a well known site while actually sending the user to a site which is hosting malware. By the time the user notices they are not where they thought they were going it is too late the malware has started its attack and you hope your defenses are up to the battle.

What should we do about this?

First, common sense internet computing should prevail. Only trust links from people you know. Always use a personal firewall and ensure you have active current anti-virus and anti-malware software running. This will ensure that if you receive a link which is compromised you have a good chance of stopping the malware. It also adds protection in the event that someone you know has had their account compromised and it is sending out malicious links without their knowledge. 

Second, most URL shortening services offer Preview functionality which will allow you to see the full URL before it redirects you to the site. This allows you to confirm the destination is where you want to go. Now this does add time but if you are concerned about the legitimacy of a shorten URL it is worth extra time.

URL shortening is useful and convenient but like most internet technologies criminals will exploit it to their own needs. Follow the tips I have presented and practice safe computing you should be fine.

Happy shortening!

If you could not attend the Toronto sessions please look for another TechDays event happening soon. http://www.techdays.ca