Passing The GSEC Exam

Passing The GSEC Exam

So, I’ve officially nailed down another Information Security certificate. And, this time a certificate from the SANS Institute with their GIAC- GSEC certificate. I thought I’d make a post for other people that plan to challenge the exam, and share my own personal experience through it all.

Is it Right For Me ?

The big question would be why are you thinking of obtaining this certificate? Does your work require it? Are you new to the information security field and want a better foothold into the industry? Do you wish to gain more knowledge and/or a higher quality of training? If it’s any of those reasons apply to you, then I would definitely point you towards getting your GSEC certificate.

Preparing For The Exam

So some may ask how they can best prepare for the exam? (more…)

Finding a Drupal Vulnerability

Finding a Drupal Vulnerability

So, I found my first official Drupal Vulnerability with Drupal Core. You can read more about it officially on Drupal’s website here –> https://www.drupal.org/SA-CORE-2016-001

For those that don’t know much about Drupal it is a Content Management System similar to WordPress and Joomla.

During my time conducting a security assessment and audit on Drupal, I found an issue. This particular vulnerability was found many months back. I had decided to hold off on publishing anything about it so it would give many Drupal users time to mitigate the issue.

What is the Vulnerability?

(more…)

When Organizations Do Not Use Email Encryption

When Organizations Do Not Use Email Encryption

For this article, I had originally written it a few months ago. However, I didn’t get the chance to post it at that time. And, in a fortunate and positive way it turns out that my post will be some what less relevant than originally intended for the readers. When I initially had started this article, I had noticed an issue which seems to crop up anytime I am working with an organization. Many important organizations still lack basic security tools and options. In the example of this article, it looks into the lack of use of email encryption and secure email systems.

Now before I get into the nitty gritty stuff I want to list out a disclaimer. Everything I conduct, list, and discuss on my blog is and has always been for educational purposes. None of my articles are made or should be used to attack machines out there. All information on my blog is for the better purpose of learning better security methods.

Disclaimer

Now this article is not meant to bash government organizations in any way what so ever. This article is here to teach that any and all types of organizations can easily lack basic security measures. (more…)

Passing the CISA exam

Passing the CISA exam – Certified Information Systems Auditor

So I though it would be interesting to post up a blog post about my experience challenging the the CISA exam last year in 2016.

I had started this blog a bit afterwards, and never really thought about posting my experience. But, many others have always asked about my experience taking the CISA exam ,and if there were any tips I could give them to better their chances of passing the exam.  My hope is this post helps those that end up reading this and gives them a better insight on the adventure of obtaining the ISACA CISA certificate.

Preparing for the CISA exam

(more…)

Russia claims they can now collect crypto keys?

Russia and the Encrypted World

So in top news many have probably already heard of Russia claiming or at least pushing to break encryption.
The initiative is to push for a wide ranging surveillance law, which would allow them access to a whole heck lot of information.

The law calls for metadata and content to be stored for at least six months, plus access to encrypted services.
This means that they also want access to decrypt Whatsapp conversations/chats, Viber & Skype calls… etc… etc…

So how do they go about this now? (more…)