Skip to main content

GIAC GSE - Intro

This post is intended to summarise what I've learnt about the GIAC GSE certification so far so I don't lose my own notes and to help others make their decision. I'll try to post some updates as I study!

So early in 2011, I made the decision to take the plunge and go for the GIAC GSE certification. I wasn't sure for a few reasons -

  • I didn't think that I was good enough. The list of folk that hold the GSE is pretty elite.
  • The amount of work that I thought would be involved scarred the sh*t out of me.
  • I was unsure of the consequences of the amount of study involved, on my family, work and active, sporty lifestyle :)

However, in the end-up, I was like 'screw it' -
  • I've spent a substantial amount of money obtaining GIAC certs and at this stage, every year there was at least one cert to renew ($400 per year). The fact that the GSE renews all my certs was very appealing :)
  • Additionally, having read articles on the web posted by several GSE-holders, which reassured me. Talking with folk like Steve Sims, Chris Mohan and Ash (who've all done the GSE and provided me with great advice) as well as Jeff Pike, the main GSE man in GIAC, also spiked my interest in going for the GSE.
  • The more I thought about the reward of passing the ultimate security certification after na intensive two day lab, the more attractive this certification became. It truly does seem to be the 'top' certification in the security field and I've never failed to learn enormously from any GIAC certification attempt.
  • Moreover, there's challenges and aspects to the GSE that I don't get the play with normally so improving infrequently-practiced skills can only be a good thing.
  • Finally, obtaining the GSE is a mixture of self-fulfillment throough the actual challenge itself and it surely has to improve your CV, right?
Check out the excellent GSE presentation from Jeff Pike on the GSE certification, where all the GSE myths are exposed.

I passed the GSE written in July 2011, without any major issues. I did study pretty hard, went through every book for the GSEC (401), GCIA (503) and GCIH (504) courses page-by-page (though I did skip most of the 503 workbook, simply because I play with packet captures on a dail basis). I also (for the first time in any of my GIAC exams) created an index (though it was quite simple) and I'm not 100% comfortable with creating an incredibly-detailed index but that's just me :)

If you are preparing for the GSE or thinking about it, check out these links -
  • Kevin Bong's excellent preparation advice.
  • Ash's blogs on preparing and sitting the GSE, always honest and humourous :)
  • Roger's Information Security Blog, where he goes into more detail on using indexes.
  • Daniel Miessler's contrary but well-written article on the point of going for the GSE.
Anyway, I've 96 days (probably minus a week to enjoy Christmas) before the GSE lab in Orlando, so I've lots of studying and practicing to do.

Finally, attempting the GSE (especially outside of your own continent - I simply couldn't wait for others in Europe to get sorted) is an expensive and if your company supports you doing it, consider yourself lucky.....so far I'm on my own!!
Labels:

Comments

Post a Comment

Popular posts from this blog

Being a Support Engineer @ 10gen - Part 1

There's a mis-conception around the role of a "Support Engineer".  As a clue, it's not what Urban Dictionary   says   - A person whose job is to answer calls from customers of a small- to large-sized company...... They are teathered to a their desk all day via phone headset........ phone jockeys usually hate their jobs.......they are are paid well enough..........until they completely burn out, and hate everyone.   and doesn't always involve this - Image Source: http://half-bakedbaker.blogspot.ie/2009/11/cannoli-and-broken-computer.html As you can see  here , there's lots of open roles in  10gen  and more specifically with 10gen, in  Dublin . I thought I'd write this quick blog to explain what Support Engineers actually do and why I joined 10gen as a "Support Engineer". I could be wrong but didn't Google come up with term " Site Reliability Engineer " to do away with the stigma associated with being a
Post a Comment
Read more

MongoDB Authori(s|z)ation

Introduction Having answered numerous questions on the new and old authori(s|z)ation within MongoDB, I thought I'd write a short blog post explaining how things work as there seems to be some confusion. What's New Prior to version 2.4 , there was a very basic sense of "Role Based Access Controls" (RBAC) within MongoDB as there were only two roles - read readWrite which is quite limited. For example, if the user has "readWrite", that user is essentially "root" and the user can add/remove users as well as inserting data into the database, i.e. there is no role segregation. Version 2.4 added in the following 3 core roles - userAdmin dbAdmin clusterAdmin with a notable extension such that there are now 4 roles that apply across all databases - readAnyDatabase readWriteAnyDatabase userAdminAnyDatabase dbAdminAnyDatabase This increased RBAC is a significant improvement from a security perspective in MongoDB. It is imp
Post a Comment
Read more

Start-Up Security

After many years in Security @ Riot Games and eventually putting the "s' out there, I recently decided to jump out of my comfort circle for a new challenge and joined a   start-up   (yes, I left a comfortable, stable job in a pandemic, lunacy lol). Now that I've been here almost 6 months, I wanted to share some findings because security at a start-up is significantly different.  When you join a start-up, there's going to be so much that you can do and it will be incredibly easy to "boil the ocean", and try to fix everything. At best, this guarantees failure for the Security team, at worst, alienation from the engineering and product teams. There are some obvious quick wins that a Security team can make without slowing down iteration and innovation speed, while also reducing risk: Auth  Partner with Engineering/IT/CTO such that there's alignment on Security owning all things "auth(n|z)".  As part of this ownership, you need to be prepared to resp
Post a Comment
Read more