How I got a CISSP and ended up nominated for the Board of Directors
About two years ago I was up in Toronto having dinner with James Arlen and Dave Lewis (@myrcurial and @gattaca). Since Dave was serving on the (ISC)2 Board of Directors, and James and I were not CISSPs, the conversation inevitably landed on our feelings as to the relative value of the organization and the certifications. I have been mildly critical of the CISSP for years. Not rampant hatred, but more an opinion that the cert didn’t achieve its stated goals. It had become less an educational tool, and more something to satisfy HR departments. Not that there is anything inherently wrong with looking for certifications. As an EMT, and a former paramedic, I’ve held at least a dozen or more medical, firefighting, and rescue certifications in my career. Some of them legally required for the job. (No, I don’t think we can or should do the same for security, but that’s fodder for another day). While I hadn’t taken the CISSP test, I did once, over a decade earlier, take a week class and look at becoming certified. I was at Gartner at the time and the security team only had one CISSP. So I was familiar with the CBK, which quickly disillusioned me. It barely seemed to reflect the skills base that current, operational security professionals needed. It wasn’t all bad, it just wasn’t on target. Then I looked at the ethics requirements, which asked if you ever “associated with hackers”. Now I know they meant “criminals” but that isn’t what was on paper, and, to me, that is the kind of mistake that reflects a lack of understanding as to the power of words. Or even the meaning of the word, and from an organizations that represents the very profession most directly tied to the hacker community. Out of touch content and a poorly written code of ethics wasn’t something I felt I needed to support, and thanks to where I was in my career I didn’t need it. To be honest, James and I teamed up a bit on Dave that night. Asking him why he would devote so much time to an organization he, as a hacker, technically couldn’t even be a part of. That’s right about the time he told us to put up or shut up. You see Dave helped get the code of ethics updated and had that provision removed. And he, and other board members, had launched a major initiative to update the exam and the CBK. He challenged us to take the test, THEN tell him what we thought. (He had us issued tokens, so we didn’t pay for the exam). He saw the (ISC)2 not merely as a certification entity, but as a professional organization with a membership and position to actually advance the state of the profession, with the right leadership (and support of the members). James and I each later took the exam (nearly a year later in my case). James and I each approached the exam differently – he studied, I went in cold. Then we sent feedback on our experience to Dave to pass on to the organization. We wanted to see if the content was representative of what security pros really need to know to get their jobs done. While I can’t discuss the content, it was better than I expected, but still not where I thought it needed to be. (There was one version back from the current exam). Over that time additional friends and people I respect joined the Board, and continued to steer the (ISC)2 in interesting directions. I never planned on actually getting my CISSP. It really isn’t something I needed at this point in my career. But the (ISC)2 and the Cloud Security Alliance had recently teamed up on a new certification that was directly tied to the CCSK we (Securosis) manage for the CSA, and I was gently pressured to become more involved in the relationship and course content. Plus, my friends in the (ISC)2 made a really important, personally impactful point. As a profession we face the greatest social, political, and operational challenges since our inception. Every day we are in the headlines, called before lawmakers, and fighting bad guys and, at times, our own internal political battles. But our only representation, speaking in our name, is lone individuals and profit-oriented companies. The (ISC)2 is potentially positioned to play a very different role. It’s not for profit, run by directors chosen in open elections. The people I knew who were active in the organization saw the chance, see the chance, for it to continue to evolve into something more than a certification shop. I submitted my paperwork. Then, the same day I was issued my certification, I found out I was nominated for the Board. Sorta didn’t really expect that. Accepting wasn’t a simple decision. I already travel a lot, and had to talk it over with my wife and coworkers (both of whom advised me not to do it, due to the time commitment). But something kept nagging at me. We really do need a voice. An organization with the clout and backing to represent the profession. Now I fundamentally don’t believe any third party can ever represent all the opinions of any constituency. I sure as hell have no right to assume I speak for everyone with ‘security’ in their title, but without some mutual agreement all that will happen is those with essentially no understanding of what we do will make many of the decisions that decide our future. That’s why I’m running for the Board of the (ISC)2. Because to play that role, the organization needs to continue to change. It needs to become more inclusive, with a wider range of certification and membership options, which better reflect operational security needs. It should also reach out more to a wider range of the community, particularly researchers, offensive security professionals, and newer, less experienced security pros. It needs to actually offer them something; something more than a piece of paper that will help their resume
