Articles

Security certifications (also) are in demand, particularly the Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA).

Security is "certainly a hotbed," says Matt Colarusso, branch manager for Sapphire National Recruiting in Woburn, Mass. "Our clients are looking for hands-on technical people who understand firewalls, VPN set-ups and router controls."

Most employers would say that technical certifications are like a great academic record: They may get you noticed and in the short stack of resumes being considered, but it’s what roles you’ve played and what you’ve done on previous jobs that will get you hired," Colarusso says. "We see technical certifications making the most difference in employers filling entry-level positions."

Technical certifications may help you get hired, but "experience matters more," says Henry Eckstein, senior vice president and CIO of York Insurance Services Group in Parsippany, N.J. "People can cram for their certifications and get their certifications. So it’s not just certifications but how long have they had them and how have they used them that matters. Technical certifications are less valuable than experience."

... "When it comes to hiring, if you have everything else -- experience with customers, functional experience -- and if you’re not certified, who cares? A lot of people never got certified because they were so busy doing [implementations]."

CISSP not required. Relevant experience must be hands-on

This is how it works: There are a bunch of constants -- fixed numbers -- in the standard used to define the algorithm's elliptic curve. These constants are listed in Appendix A of the NIST publication, but nowhere is it explained where they came from.

... to put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

... this is scary stuff indeed

If this story leaves you confused, join the club. I don't understand why the NSA was so insistent about including Dual_EC_DRBG in the standard. It makes no sense as a trap door: It's public, and rather obvious. It makes no sense from an engineering perspective: It's too slow for anyone to willingly use it. And it makes no sense from a backwards-compatibility perspective: Swapping one random-number generator for another is easy.

British High Commissioner Nick Archer recently marked the conclusion of an EU-funded project designed to enhance Malta's IT security capacity in line with EU regulations.

The two-year long Capacity Building In Information Security Programme began in June 2005.

The Northern Ireland Public Sector Enterprise Ltd (NI-CO) and its partner organisations gave assistance to Malta Information Technology Training Services Ltd (MITTS), providing operational and functional support to the Maltese government.

Among the main objectives of the project was to ensure that the government is able to communicate effectively with the EU and to enhance security capability in the Maltese public service.

Mr Archer said he believed it has been the longest and one of the most successful twinning projects that the two countries have undertaken.