CySA+ TTT Labs

Has anyone tried the labs from the TTT yet? I'm doing the first one and got stuck at the part where I enter the command to look at the eth0 interface. The step has you do: "ip a | grep eth0 > eth0_config.txt". When I get to the step to cat the fille, I need to find the ip4 address for this interface. The problem is, that this interface is not connected. The eth1 interface is connected and has an ip4 address. However, I still get marked "incorrect" when I use that address. Anybody else seeing the same thing?

Two project certifications - 20 years apart

I passed the CompTIA IT Project+ exam in September 2003. It was good for life, so I did not re-certify after it was renamed Project+.

Due to an employer requirement, I took (and passed) the Project+ PK0-005 exam today.

It's still hard for me to believe that it's been 20 years between those two certifications. I've really enjoyed my professional relationship with CompTIA.

Building a Cyber Program: Risk Assessment vs. Cyber Frameworks

So here 's a question that came up in my head and one that I suggested to Bjoern after the session today. Worth some noodling...

When building a cyber program do you:

A) Get a framework? - Most times, people don't know what they don't know and they end up going out to the internet to grab some kind of checklist to "cover the bases" with respect to network security. Frameworks like NIST 800-53 and 800-171 as its checklist are great because they'll cover everything.

But a framework has the tendency for those who use one to cover more than we need. Do we pick and choose which parts to use? Can we say that we used the NIST framework if we only use a part of it? Going through a framework can create a lot of documentation that no one will ever read.

(kinda like all the documentation we write, but alas)

B) Perform a Risk Assessment? - The risk assessment is the way an organization can tailor its cyber program to meet its specific needs. An organization can walk through all its assets and services and define priorities.

However, I've always seen two things when doing a risk assessment. One, the defining the risk tends to get subjective. We can put impact to a cost scale, but probability is a little more nebulous. Say you have two incidents on a risk in year 1, none in year 2, and none in year 3. High risk? Medium risk? Or do we define it ourselves in a subjective kind of way. Sure that brings in the idea of risk appetite, so its different for everyone. The other thing I see in risk assessment is making sure we've identified everything. Seems like that's an ongoing process, like one day, you're walking by an office and notice an IoT device that's been there for an age, but we forgot about it in risk planning.

So, what do you think about this? Chime in and let's see what you think.

/r

UPDATE: I might have also wrote the question a little badly - the question isn't whether we do those things - it's the approach you take first in doing a cyber program build. Some will go with the Framework first, which prescribes a risk assessment, the other will do the risk assessment first which prescribes a framework. ..

Finally, Comptia Pentest+

After an onsite bootcamp, out of curiosity, I decided to prepare for and take the Comptia Pentest+.
Mixed reactions from the result, although a very narrow win. Not sure whether to celebrate or go back and dig deeper.
Here we go guys, Comptia Pentest+

Attachments

  • Pentest.JPG
    Pentest.JPG
    76.7 KB · Views: 31

VOUCHER CTT + DISCOUNT

Hello everyone, I hope you are well.
I am preparing for my CompTIA CCT+ before the exam is withdrawn.
I would also like others to also have the chance to take this exam at a reduced price. The voucher is official from the CompTIA store

CTT+ Voucher CompTIA CTT+ (TK0-201) Essentials Voucher 230$
CTT+ Voucher CompTIA CTT+ (TK0-202) Classroom Trainer 250$
CTT+ Voucher CompTIA CTT+ (TK0-203) Virtual Classroom Trainer 250$

[email protected]

Discount limited

Project+ Vouchers Gone Out - Inflate my Ego

Okay, CIN - Looks like those Project+ vouchers have gone out to those of you that were on for my Proj+ TTT! Good luck to all of you!

Now, in a shameless post, you get to inflate my ego. This is the part where we find out if the TTT was helpful/instrumental in getting you to that shiny Project+ cert. So if you pass, post it here! If I did something really right, let me know.

And if you don't get it, it's okay! Keep at it - I'll help if you need it, meanwhile, if there was something about my training that wasn't so good, please tell me that, right here publicly, even. No instructor can improve if he does everything right, yeah? And I love to improve myself too. Or as a verse from the Good Book says, "As iron sharpens iron...". This is how we make CIN instructors the best ones out there. So, bring your eggs and tomatoes - I can handle it.

It was a pleasure having all of you on for the TTT and I sincerely wish you good luck as you all start certifying!

/r

Seeking a CYSA+ Instructor

Hi Guys,
We are a CompTIA learning partner.
We are looking for an instructor for the following class:
  • CYSA+
  • 5-day class.
  • June 26-30, 2023.
  • Start time 7:00AM (Hawaii) = GMT -10.
Experience in the CYSA+ course is a must.
We’ll use “Integrated” materials - so you’ll need to be conversant with this format.
Fluent in English language is required.
If you can do this class, and are available, please message me/us ASAP.
Thanks!
Rie

CompTIA Extends A+ Brand to Launch More Careers in Technology

CompTIA Extends A+ Brand to Launch More Careers in Technology​

May 23, 2023
DOWNERS GROVE, Ill. CompTIA, the world’s leading certifying body in information technology (IT), today announced plans to expand its CompTIA A+ brand, adding a new suite of introductory resources to prepare aspiring tech professionals for on-the-job success.

The CompTIA A+ underscore (_) technical learning and certificate programs is a series of modular programs that will offer learners greater flexibility to build the depth and breadth of their skills, while expanding accessibility to encourage more people to explore tech career pathway options. The CompTIA A+_ series centers around key knowledge domains and in-demand job roles, including the following areas:


CompTIA A+_cyberCompTIA A+_server
CompTIA A+_networkCompTIA A+_data
CompTIA A+_cloudCompTIA A+_coding



I'm getting disillusioned

Recently, I was on a CompTIA-related message board, and I noticed a disturbing trend. Most people posting were directly asking which multiple-choice questions other testers had on their exams and what PBQs they had. I was under the impression that sharing that information violated CompTIA's NDA. When I brought it up, I was met with derision and mockery.

There were also a lot of posts recommending 16-hour free video series and questionable practice exams. When I suggested taking a class, using CertMaster resources, or getting a decent book from Amazon, I was again met with mockery and ridicule.

There seemed to be a pervasive culture of encouraging cutting corners and taking shortcuts to "check the box" to get a cert and a tech career. They seemed to be mostly younger people with no experience whatsoever. It felt like a bunch of high school kids trying to share secrets on how to scam the system. None of them wanted to hear from an old geezer like me who told them they needed to study hard to have practical applied knowledge of the information and not just memorize and exam cram. My suggestions fell on deaf ears.

Does what we do as trainers really matter? Even in my 20+ years of being a trainer, I've encountered the occasional student (or class) who didn't care about learning as they did about "checking the box." I know I can't make people want to learn, but it's challenging to help them when they have a poor work ethic and attitude. There will always be people who try to cheat the system to get a certification that, quite frankly, they don't deserve. Even if they get certified and get past the recruiters and hiring managers, they'll struggle to perform the most basic tasks because they took the easy way out. Employers will see them struggle and start to believe the certifications have little value in the real world.

Maybe I'm just an idealist, but I strongly believe that certifications, or any education for that matter, have incredible value. They show that a person has a baseline mastery of a topic; for years, I've been preaching that the A+/Network+/Security+ trifecta should be the baseline level of certification for any tech job. Those three certifications are the broadest, foundational knowledge areas to cover how things work and basic troubleshooting. From there, a person can pivot into numerous different specialty areas.

Why do we do it? Why do we choose to be technical trainers? Does anyone care any more?

Filter