Information Security

Finally I have never said anything about an IA guy not
needing networking experience I said that CCIE was too involved in networking,
CCNA suffices, that is not to say that an IA guy with CCIE is worthless on the
contrary I really tip my hat off to him that is quite the accomplishment. But
to understand what you need to, to be an effective Information Assurance guy,
you consider defense in depth in layers; that goes from the type of locks on
the door to the vulnerabilities that are on a certain server, Anti Virus
engines, to tasks as menial as ensuring users are properly trained. Also
circuit accreditation (C&A) process, accrediting servers to connect, performing scanning.


Look I am not saying that it does not help to have a certain amount of
networking knowledge as an IA guy, the same as knowledge with Microsoft
products helps to. But if you create a climate where you think an IA guy should be the SME at all areas then his credentials will be something like this;


CISSP, MCA: Windows Server: Directory, CCIE, CIW Grand Master Developer, PMP,
SNIA Certified Storage Networking Expert (SCSN-E), Oracle Certified Associate, Physical Security Professional (PSP);

To mention but a few certifications, now I am obviously speaking in extremes
but I do it to prove a point. As an Information Assurance Manager your focus is
not soley the network, you have other things that can cause security concerns
and if the bulk of your knowledge is in networking, great you will make an
outstanding Network Engineer or whatever flavor of networking you choose
(security or whatever else), but those who mean your organization harm will
simply find another way to get in. Point you learn what you need to to make
intelligent security decisions about whatever and move on. There should be
other professionals whose job it is to "network" or "configure
the Domain Controller" jobs like that are to critical to have one person
doing it all. Focus on security if you want, focus on network security but if
you are equating IA to network security then you need to talk to that database
admin who says that IA's central focus ought to be on the value of the data. OK am off my soap box now

Dude please stop. I worked for Cisco as a network engineer for several years. I know what a CCIE is. For christs sake I was studying for my CCIE Service Provider just a few years ago. If you having to keep referring to definitions, it just demonstrates how little you actually understand the big picture. Knowing vs understanding; there is a huge difference there.

I have worked or interfaced with IA at all 3 tiers. I am a network engineer by trade. I have the BS, MS, 2 Cisco certs, Sec+ and am working on my own toward the CCNP while my management is sending me to PMP training. I have about 4 or 5 years experience on the sys admin side as well. Ive literally just about done it all with few exceptions.

Chill out already. Go to WGU. Get your MS in IA. Further your career. We will all be happy for you. Personally, I dont really care what you do.

I can’t resist, I was in IA long before I got my BS and my degree is not in Information security it's in Systems Administration. I was hired because I had my certifications not my degree that was a personal goal I set for myself. To be honest before I got in IA I was misguided because I somehow thought it would be more hands on than it is. I use my knowledge on a day to day basis, but if there is something I need done on the Exchange Server I know enough (without being an Exchange Admin) to let them know what needs to be done and why, the same with a firewall configuration, there is no reason why I should be logging on to anyone those sensitive systems without the knowledge of their respective administrators and making changes (have you ever heard of separation of duties); but I do need enough knowledge to explain to them what needs to be done and I have to be able to speak their language. Now if your IA guys on your installation are all networking experts, then who secures the servers, who secures databases, domain controllers, exchange servers. By your definition they are all IA, I would counter that they are all part of the IA team but there can only be a set of individuals whose job it is to coordinate all that madness, that is the reason the title "manager" follows IA because you manage the ENTIRE program not simply the networking aspect. Please do not try to challenge me on this before you read, NIST, NSA, Department of Homeland Security, Department of State, Department of Defense, shoot even Cisco as a company all grasp this concept of defense in depth; not one layer of networking and damn the rest. Everyone plays a part, but there can only be a few who manage that, as a network manager your day should be filled with managing the network not applying patches and pushing patches across the enterprise. Nor should you as a network manager have to accredit a server to be on the domain in whatever capacity it is to be used in. If there is software that one of your units wants to purchase, it is not the network manager that determines if it should be on the network, it is the IAM that has to first research it and see what impact it may have on existing systems. What we have here is a total disconnect you think you know it all, but outside of networking you truly have no idea the title of alternate Information Assurance Manager has clouded your judgment into thinking that you are the cure all end all with information, you may have gone to a very good school and if you majored in Information Security you must have forgotten what they taught you because you are not making any sense at all.

I had a feeling your response would be something childish (creative and funny I will admit but childish nonetheless), if you are going to have a discussion have one, but if you are presenting something as fact do not be surprised if you are challenged when you have nothing but your word to back you up.

I continue to refer to government agencies that deal with Information Assurance because as it pertains to National Security they are directly impacted. If you want to pursue a career in IA I strongly caution you to get some additional training that is why CISSP, CISA, CISM, CSSLP, GIAC certifications, CEH, CEPT, CHFI, CAP, and to a lesser extent S Plus(note I said lesser because that is akin to comparing network + to CCNA, I know you understand that comparison). When you "grow up" in IA you will realize that your approach, while well meaning, is incorrect. My advice, stick to what you know and understand, you have proven yourself to be an exceptional network engineer, by virtue of your certifications, leave the job of assuring information to those who are adequately trained for it.

I am hoping this will end it, but I know better as you have throughout this thread not once provided anything tangible or substantial for that matter that backs up 10% (ok that might have been a little harsh, ok 20%) of the absurd claims you have made regarding IA, good luck to you and have a great and rewarding career.

Avoid UMUC and the similar diploma sellers- the credits do not transfer and VA is having a tough time getting Veterans reimbursed for the type of school that takes money, promises jobs, and is unaccountable.

Concentrate on Cisco, CompTIA, and Microsoft courses.  There is no easy fix and a certificate does not get you a job.  Volunteer – I actually did volunteer work at A VA Medical Center in the IT department to acquire more hands-on.