Research

Our world domination tour continues. At least if you consider training for the Certificate of Cloud Security Knowledge (CCSK) part of your plan to know all things Cloud Security. As authors of the training curriculum, we are the only folks who can train and certify instructors to deliver the training, so a couple times a year we deliver the courses, live and in person. We’ve got two courses coming up, one in San Jose and the other in Milan, Italy. If you want to become certified to teach, you’ll need to attend one of these courses. And if you aren’t interested in teaching, it’s also a good opportunity to get the training from the folks who built the course. San Jose: March 27-29 Milan, Italy: April 2-4 Here is the description of each of the 3 days of training: There is a lot of hype and uncertainty around cloud security, but this class will slice through the hyperbole and provide students with the practical knowledge they need to understand the real cloud security issues and solutions. The Certificate of Cloud Security Knowledge (CCSK) – Basic class provides a comprehensive one day review of cloud security fundamentals and prepares them to take the Cloud Security Alliance CCSK certification exam. Starting with a detailed description of cloud computing, the course covers all major domains in the latest Guidance document from the Cloud Security Alliance, and the recommendations from the European Network and Information Security Agency (ENISA). The Basic class is geared towards security professionals, but is also useful for anyone looking to expand their knowledge of cloud security. (We recommend attendees have at least a basic understanding of security fundamentals, such as firewalls, secure development, encryption, and identity management). The CCSK-Plus class builds upon the CCSK Basic class with expanded material and extensive hands-on activities with a second day of training. The Plus class (on the second day) enhances the classroom instruction with real world cloud security labs! Students will learn to apply their knowledge as they perform a series of exercises, as they complete a scenario bringing a fictional organization securely into the cloud. This second day of training includes additional lecture, although students will spend most of their time assessing, building, and securing a cloud infrastructure during the exercises. Activities include creating and securing private clouds and public cloud instances, as well as encryption, applications, identity management, and much more. The CCSK Instructor workshop adds a third day to train prospective trainers. More detail about how to teach the course will be presented, as well as a detailed look into the hands-on labs, and an opportunity for all trainers to present a portion of the course. Click here for more information on the CCSK Training Partner Program (PDF). We look forward to seeing you there. Share:

I feel fortunate that I’m not haunted by the images of what I have witnessed. If I don’t sleep well at night it’s due to stress at work or at home, not dark images from the years I spent working in emergency services. I realize I sometimes abuse my past as a paramedic in my security writings, but today it is far more relevant than usual. I became an EMT at the age of 19, and was in paramedic school by 21. By 22 years of age, I was in charge of my ambulance – often with only an EMT as a partner. In retrospect, I was too young. People I’d meet, especially in college, would often ask what the worst thing I saw was. I’d laugh it off, but the answer was never blood, guts, or brains. Yes, I saw a lot of dead and dying of all ages in all circumstances, but for the most part real life isn’t as graphic as the movies, and professional detachment is something I have always been good at. The real horrors are the situations we, as a species, place ourselves in. It was seeing poverty so abject that it changed my political views. It was children without a future. Public safety officials – paramedics, cops, firefighters – and our extended community of ER nurses and doctors, corrections officers, and other support positions… all suffer high rates of burnout and even suicide. Everyone hits the wall at some point – the question is whether you can move past it. Unless you have responded to some of the “big ones” that lead to PTSD, the wall isn’t often composed of particularly graphic memories. It is built, brick by brick, by pressure, stress, and, ultimately, futility. The knowledge that no matter how well you do your job, no matter how many people you help, nothing will change overall. Those who can’t handle the rough stuff usually leave the job early. It’s the cumulative effect of years or decades of despair that hammer the consciousness of those who easily slip past nightmares of any particular incident. Working in the trenches of information security can be no less demanding and stressful. Like those of us in public safety, you gird for battle every day knowing that if you’re lucky nothing bad will happen and you will get to spend the day on paperwork. And if you aren’t your employer ends up in the headlines and you end up living at your desk for a few days. Deep in the trenches, or on the streets, there’s no one else to call for help. You’re the last line; the one called in when all hell breaks loose and the situation is beyond the capacity of others to handle. What is often the single worst thing to happen to someone else is just another call for you. One day you realize there’s no winning. It won’t ever get better, and all your efforts and aspirations lead nowhere. At least, that’s one way to look at it. But not how the real professionals thrive on the job. You can focus on the futility or thrive on the challenge and freedom. The challenge of never knowing exactly what the day holds. The freedom to explore and play in a domain few get to experience. And, in the process, you can make that terrible event just a little bit easier on the victim. I nearly burned out in EMS at one point. From the start I knew I wasn’t any sort of hero; you don’t work the kinds of calls I did and believe that for long. But, eventually, even the thrill of the lights and sirens (and helicopters, and …) wears off. I realized that if I called out sick, someone else would take my place, and neither one of us would induce any macro changes. Instead I started focusing on the micro. On being a better paramedic/firefighter/rescuer. On being more compassionate while improving my skills. On treating even the 8th drunk with a head laceration that week like a human being. And then, on education. Because while I couldn’t save the human race, I might be able to help one person avoid needing me in the first place. Playing defense all the time isn’t for everyone. No matter how well-prepared you are mentally you will eventually face the burnout wall. Probably more than once. I thrive on the unexpected and continual challenges. Always have, and yet I’ve hit the burnout wall in both my emergency services and security careers. And for those of you at the entry level – looking at firewall logs and SIEM consoles or compliance reports all day – it is especially challenging. I always manage to find something new I love about what I do and move forward. If you want to play the game, you learn to climb over the wall or slip around it. But don’t blame the wall for being there. It’s always been there, and if you can’t move past it you need to find another job before it kills you. For the record, I’m not immune. Some of the things I have seen still hit me from time to time, but never in a way that interferes with enjoying my life. That’s the key. Share: