You raise some interesting questions. To my knowledge, the authors did little reseach into the development of the ISSEP. I was the (ISC)2 representative to a meeting with the authors a week before the report publication. The ISSEP was not brought up. Also in attendance was ISACA, CompTIA, NIST and ANSI. The conversation was quite general in nature about better methods for testing information security professionals and lasted a bit more than an hour. The idea of licensing like doctors do was brought up by the authors however it was pointed out that doctors associations are managed at the State level, not the Federal level. I would also make the point that the licensing association is managed by doctors, in this case, it should be managed by information security professionals. The new association that you alude to is not led by information security professionals but by what appears to be a group from CSIS and Alan Paller. Interesting that the authors of the report are also on this new board which I believe raises questions about the report itself. Recently, one of the new board members raised an issue of a conflict of interest of current certification bodies doing training, doesn’t the same rule apply for a board member releasing a report that is sharply critical of their competition?

Something to ponder,

Marc Noble

All three cases say the same thing: the company owns the computers, software, and manages the services (either itself or hires someone to do it), then the company can do whatever it wants with the service it owns. So it could be said that the above cases have moved to text messaging.

I’d like to draw some similarities from this to arms regulation. The technology currently exists for users to secure their home systems relatively well for low cost, the most secure of which are difficult to use. The private market has recently release significant improvements to user systems that protect against almost all malware fairly well. I’m thinking of the default Windows firewall and Microsoft Security Essentials. Both of which, while maybe not the best, are very good programs that will leave users substantially better protected than without them.

Also, with the prevalence of wireless networking, most users are behind a NAT firewall from their home routers even if the password on that router is still ‘admin.’

The Internet is the home of information flow for now and the foreseeable future. Please forgive my reticence to yield control to the government to govern the flow of information.

Keep up the great work!

I was looking at the news on this and preparing my next post. They’ve surprised a lot of people. Haven’t they? Even though they’ve just moved to Hong Kong, it’s a clear break with the policy. The next few weeks will be interesting, won’t they?