The other day, I spent the afternoon drafting a prototype network security policy. We don't have one, and it's something I'd been worrying about for a while, especially since we have to have a machine lying around running that notoriously secure Redhat 6.2 in order to support Websphere 3.5. At the same time, we're getting into a bit of the security business ourselves—providing external audits for other companies and trying to sell them expensive Lotus network management gear.
So, as a result, the company's going to pay for me to take the rather expensive CISSP certification. Looking through the material, and doing some of the sample questions on the web, I already know most of this shit. I mostly have to make sure I know the proper names for things (like what exactly is RAID level 10, or the Bell LaPadula model, or how does TACACS really work)
Trainrek would probably be somewhat amused at all this. It's a six-hour exam though. *shudder*
