Expecting better (from a CISSP)

EANx

I manage IT operations for a pretty large organization. As it should be, the guy who does oversight on IT security doesn't report to me but we do a lot of collaboration. The guy is also a CISSP.

So he comes up waving a printed email stating that his admin account was going to be disabled and wanted to know what the problem was. I looked at the email and saw the following just in the printout:

• Address was from "admin.com", not our organization.
• There was a link to a ".gr" domain (there was no html tagging to obfuscate the link destination in the print out). My organization has a presence in Greece but no IT/web infrastructure.

The guy was going on about "this is what I got when I scanned a document on your digital sender. I think that thing has been compromised."

Asking him when he scanned the document that generated the email he stated "just a few minutes ago". Looking at the printed document, the email he printed was received the week before.

The guy was seriously worked up, he wasn't trying to punk me. It turns out that he had gone into his junk mail to see if he had missed something. He then walked away, came back and forgotten he was there as opposed to his inbox.

My response was that I expected better from someone with a CISSP. Don't be this guy. If you're going to be the security person, be thoroughly engaged in being the IT security person.

Nevshi22

Always annoying when someone who's supposed to be an expert doesn't know anything. I've worked support for many years and I can't tell you how many times people who were supposed to be skilled in some area came to me with a problem they are supposed to be able to fix. I remember a head programmer who was recently hired came to me because his code wouldn't compile and was blaming the compiler. Not my area of expertise, but the thing could compile all the examples the software provided. About three months later that guy was gone.

Agree with you completely: If you are a CISSP and are in security role, understand your job and educate yourself constantly.

NetworkNewb

Lol, yea that is pretty bad... Hopefully he was just having an off day

Phalanx

Personally in that situation I would expect better from anyone who has been in IT for 6 months or more, never mind CISSP!

SteveLavoie

Just because I am over my head into my CISSP study... I can tell you there is no material covering phishing except the definition of what is phishing/spearfishing LOL!

Intelligence and common sense is not granted by certification

scaredoftests

Perhaps this was before he had his coffee. Wow.

beads

Isn't this merely the norm for many these days? I can safely assure you that I have either meet this person or someone just like this many, many times. Certifications not withstanding.

Grain of salt.

-b/eads

NuclearBeavis

Sounds scatterbrained, which unfortunately can happen to even intelligent people.

This morning I set my keys next to my phone so I would grab them both on the way out the door. Still left my phone at home and now I'm stuck at work all day with no phone. Not the first time either.

gespenstern

A lot of morons in any enterprise on any positions because humans suck at hiring based on merit. CISSP is hard, but doable with any dedication and experience, doesn't ensure that a person isn't a moron, just less likely to be an unbearable moron. In other news the grass is green.

PC509

Some times, people screw up. A lot of times, they over think the minor things. It happens. If this was an isolated incident, I'd take it as that. If it happens regularly, I'd be concerned.

We all screw up, sometimes with a larger audience. As long as we learn from it and don't repeat it, we're good. Even a CISSP screws up from time to time. Only human...

E Double U

@ EANx - Please provide his email address. I have a few phishing ideas I want to test.

ITHokie

EANx wrote: »

My response was that I expected better from someone with a CISSP.

But why?

cyberguypr

I just literally came from a talk by Chris Hadnagy, well known social engineer and phishing expert. He admitted clicking on an Amazon-themed phishing email. It happens to many at some point, even pros.

kabooter

I do agree with cyberguypr that even pros can slip sometimes. Happens to all of us but obviously taking an email too seriously about your account being locked out w/o doing due diligence is a bit ridiculous for anyone in IT let alone infosec.
The CISSP exam is still very difficult one to crack but once I joined the bandwagon, I must say, I too am a bit underwhelmed by some of the cert holders expertise. I think that over time, we will see lot more degradation. One possible reason for it is the ubiquitous demand for CISSP by HR for almost every single cyber security job that is being posted out there. There is glut of teaching shops out these promising the moon for $xxx and 3-5 days. By making it an essential barrier that has to be crossed, it has made itself a target of horde of wannabees some of whom are less interested in perfecting than in jumping over the hurdle.