March 2002

WE'RE INTERESTED IN YOUR POINT OF VIEW!

Letters should be e-mailed to Andy Briney. Please include your name, title, organization and location. Letters may be edited for space and clarity.

Get a Job

I enjoyed Toby Kohlenberg's article on job-seekers in the infosec market (/2002/jan/columns_logoff.shtml). I'm a relative newcomer to infosecurity, with two years of experience after 15 years of sysadmin and network work. Kohlenberg really nailed some of the points that some people in the market don't fully realize.

I especially agree with his statements, "If you aren't scared, you don't understand the nature of the beast," and "The more you learn, the more you have to learn." I'm taken aback at the casual arrogance of some people who, having read books and installed a few systems, think they are James Bonds in the infosec arena because they can befuddle most others with their esoteric arguments.
- Jay Martin

I pretty much disagree with about everything Kohlenberg wrote. He implies that certifications, when looked at by the interviewer or as presented by the interviewee, are not worth much. As an interviewer, I would look at an applicant with a security certification as someone who took the time to take the test and who knows enough to pass it. It demonstrates knowledge of a topic, and proves he's more of a go-getter than someone who didn't have the credential. If nothing else, it's a good tiebreaker between two qualified applicants.

Kohlenberg also writes, "If you aren't scared, you don't understand the nature of the beast." But if you are scared, then you're in the wrong profession. Scared? Of what, the opportunity to have fun with computers, keeping miscreants from successfully getting into your systems? Or of being able to match wits with some of the greatest hackers, crackers and phreakers in the world?

He makes another comment: "Most important: Don't apply for a job that you have no chance of getting." Why not take the chance? Even if you don't get the job, it's good practice and you may even learn where your interview skills are lacking. Then you can improve on them.
-Gerald Kovacich

Cite Unseen

I would like to address some of the comments made by Jay Heiser in his February review of my book, CISSP Exam Cram (/2002/feb/departments_products.shtml#securereads). The list of references I provided the publisher did not make it into the final printing of the book. This has been a known issue and I have been working with The Coriolis Group (the publisher) to get a list of references included in a second printing of the book. In the meantime, the references will be available in an errata on the Coriolis Web site.

Some internal changes at Corolis have slowed this process down much more than I would like. I am working very closely with them to resolve this issue as soon as possible.
-Mandy Andress

Wireless (In)Securities

January's cover story on wireless security was riveting reading (/2002/jan/cover. shtml). As a technology strategist and advisor, I'm particularly interested in this area. However, in the sidebar "Next Generation Wireless," I think it would be worth mentioning approaches toward standardization in the wildly fragmented wireless technologies zone.

OASIS is currently working to evolve Security Assertions Markup Language (SAML). Another possibility would be to watch for the potential merger of two standards: WAP and iMode. As W3C withdraws support for HTML, iMode is now forced to announce support for XHTML, thus bridging the protocol gap with WAP.
-Shefaly Yogendra

Andy Briney and John Grossman are a real hoot (Editor's Note, /2002/jan /columns_note.shtml). Briney writes that Grossman, head of the High Tech and Computer Crimes Division at the Massachusetts Attorney General's office, has asked police to "profile" war drivers.

The first time Grossman gets a warrant and trails a ham radio operator just because he has a laptop and dish antenna, there will be such a backlash from the amateur radio community, he may wish he'd bothered to do his homework.

The 2.4 GHz band is a licensed amateur radio band. A ham can easily and legally fire up a TV or radio transmitter running over a kilowatt of power that can blanket 2.4 GHz for dozens of miles. Grossman needs to get a grip on reality before profiling and trailing innocent people.

When a disaster strikes your town, and your wires are down and your cellphone service is saturated, please remember the hams, who are doing communications to back up police, fire, hospitals and other agencies. Many of us do walk around with laptops connected to dish antennas pointed at the sky.
-Ralph Fowler

War driving in and of itself is neither more illegal nor more enforceable than cracking down on script-kiddies running port scans. By the time your access point is detected and your association logged, the war driver may have vanished.

I'm also not sure if John Grossman has any real statistics on stopped war drivers, including number of arrests and alleged charges made. It seems theoretically plausible that because they're "in the open," they'd be easier to catch. But on that note: How long have we been fighting the drug war now?
-Ian Underwood

Kudos

Ijust finished reading the February cover story on NFAT tools (/2002/feb/cover. shtml). Great is the word that describes the article. I have made it required reading for my entire staff.

As I have watched the evolution of our discipline during my 20-year infosec career, there have been some very significant achievements by our industry. Data ownership, standards, compliance, certification and now IDS forensics.

My compliments (again) on Information Security and its continuing excellent coverage and articles. Keep up the good work.
-David VanderNaalt

Not So Sensational

I'm a new subscriber to your magazine. I just received my first issue and sat down to take a look at it. I was bitterly disappointed when the first article I read, from the editor-in-chief (whom I'd imagine sets the tone for the whole magazine), was full of false sensationalism (/2002/feb/columns_ note.shtml).

For one, Briney states that the e-mail from Bill Gates "finally put in to words what we've trumpeted all along." So if Bill is now singing along with your band, why are you complaining, still?

Other statements like "the first .NET-targeted virus also made its appearance, a sure sign of things to come" further confirm a propensity for sensationalism. Anyone who bothered to investigate that issue would know that it was irrelevant. You also cite other issues concerning software that is still in beta as if it were already installed on every Windows desktop running.

I will give Briney the one on Windows XP. However, I would challenge anyone to actually exploit that vulnerability. He doesn't mention the fact that it would be extremely difficult to do.
-George Johnson

March 2002 Table of Contents

Copyright 2002 TechTarget