topic Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate" in Member Support

Mis-Used Term on (ISC)2 Site - "Digital Certificate"

CraginS — Wed, 12 Sep 2018 15:34:33 GMT

This note is a request for the (ISC)2 staff to correct an error on the main isc2.org Members Only drop down from the home page.

Under the first column is the term Digital Certificates. Clicking on that term leads to a file download window, allowing download of a PDF file of the member's (ISC)2 Certification certificate.

Please change that phrase to Download Your Certificate as PDF.

Within the infosec community the term digital certificate has a very specific technical meaning with regard to the world of Public Key Infrastructure (PKI), asymmetric encryption, server certificates for Transport Layer Security (TLS), and digital signatures (not to be confused with electronic signatures). A major portion of our (ISC)2 membership deals directly with those PKI issues regularly, and has locked in on the technical definition. As a result, most of us see that item and think that (ISC)2 is running a Certification Authority (CA) server, and can issue PKI certificates to members, suitable for digitally signing and encrypting e-mail and other documents. Obviously, not so.

Since the term is used on a part of the (ISC)2 site accessible only to registered site users, that is members and certification aspirants, we should be using the correct terminology there, and not misleading members expecting a true PKI-based digital certificate.

Thank you.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Flyslinger2 — Wed, 12 Sep 2018 15:45:14 GMT

Which brings up an interesting concept. If ISC2 had their own trusted CA and issued digital certs to it's members. Those certs could be encoded on smart cards like Yubi key. We could then use our digital representation as the verification that we reviewed content and endorsed it.

Bam!

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Wed, 12 Sep 2018 16:08:40 GMT

@Flyslinger2 While an interesting hobby, Trusted CAs are really quite hard work, and Imagine the fallout from a DigiNotaring of ISC2 when someone gets drunk during a key ceremony? infamy, infamy, they’ve all got it in for me.

It could even be ‘Certificate in a Digital Format’ if it didn’t need to be wedded to PDF.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Flyslinger2 — Wed, 12 Sep 2018 16:16:44 GMT

@Early_Adopter with AWS and Safenet's HSM's in the cloud, "CAaaS" is normal. But I'm all in if it is a bourbon party.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Wed, 12 Sep 2018 16:28:10 GMT

Tempting... but Never mind Gemalto and Amazon, Thales* can build us good honest on Prem HSMs inside an aircraft carrier!

We could crew it, fuel it, generate roots, sign the intermediates, take the roots offline and than sail past the Spratlys just when we needed a trade deal the most.

*I firmly believe that this is pronounced ‘Thails’ despite what the French say...

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Flyslinger2 — Wed, 12 Sep 2018 17:03:42 GMT

I've been on sea trials with tech my company made for the Navy years ago. Loved it. especially night flight OPS.

A floating CA makes me tingly.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

amandavanceISC2 — Wed, 12 Sep 2018 17:19:57 GMT

@CraginS Thank you for your suggestion! I will bring this to management for review to see if we can update the wording.

I appreciate you providing this suggestion!

Best Regards,

Amanda Vance

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Thu, 13 Sep 2018 02:08:35 GMT

The HMS/USS/SS let’s encrypt, circumnavigating the globe fulfiling CSRs via satellite(maybe the back up on the ISS?)

in periods of of radio silence mini-tender drone subs could provide an asynchronous best effort service?

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Calv1n — Sun, 23 Sep 2018 14:22:47 GMT

Good point, while it meant the digital version of course credentials, most security folks would think first of the PKI cryptography kind. Perhaps "e-Certificate" would project the right meaning.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

crystal_waston — Thu, 04 Oct 2018 07:22:50 GMT

A digital badge is a simple way for you to share a credential online. You can attach your badge to a website, email signature, or social network, and with one simple click, employers and other interested parties can easily view and verify your credential and the skills and experience required to earn it.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Sat, 29 Sep 2018 13:57:43 GMT

@crystal_waston

In this case the term was ‘Digital Cetificate’ that has a formal meaning as part of a PKI. So it’s a bit funny the ISC2 uses it for something else - English is ambiguous for sure, but we shouldn’t let it get away with everything.

If you’re suggesting a digital badge as an alternative name for the PDF formatted certification certificate then ISC2 already have those from ‘Acclaim’.

We have a whole set of discourse on the merits of the acclaim badges, as well as the those awarded by the site for participation...

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

CraginS — Sat, 29 Sep 2018 12:03:50 GMT

@crystal_waston

@Early_Adopter

Let's not confuse three different items:

1. The Acclaim badge is a third-party authenticated confirmation that an individual holds a certification (CISSP, etc.) from (ISC)2. It is not a PDF file. It is an html code item that links back to the Acclaim web site.

2. A digital certificate is a crytpographically signed digital object issued as part of a public key infrastructure that includes identification data for a human or logical entity along with the public key(s) of that entity. It is a core part of the PKI environment, and used for both digital signatures and object decryption.

3. What (ISC)2 has erroneously called a digital certificate is nothing more than a PDF file of the frameable certificate issued to individuals holding certifications from (ISC)2.

As far as the utility of the Acclaim badge, the attempt to obtain evidence that it is useful or has ever been used effectively has drawn nothing but crickets from the Community:

https://community.isc2.org/t5/Certifications/Utility-of-Acclaim-Certification-Badges/m-p/14542

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Sat, 29 Sep 2018 14:30:05 GMT

@CraginS I think we’re in agreement, I did edit my post somwhat for readability(auto-correct is a terrible thing.)

I took @crystal_waston to be suggesting ‘a digital badge’ as an alternative to the originally mis-named digital certificates(your digital version of your ISC2 certificate providing your certification), and we’ve already got those form acclaim, we don’t really really need another. Then we’ve the forum badges.

On utility of the acclaim badges, maybe machines and people acting like machines can use it to verify a credential more quickly, but I think everyone has agreed that they are a bit rubbish and we all know who to blame:

https://www.youracclaim.com/org/microsoft-certification*

Personally I think ‘Acclamation’ is best reservered for something a bit better than professional certification, I’d say ‘Good job fella’ or similar, and reserve more effusive praise for unique achievements. Interestingly the domain ‘acclaim.com’ was not used as it had been used by a games developer and was opened by someone else.

* Ok, probably not true as there are lots of other vendors using these, but I figure that there is a certain driving factor on these and others.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

rslade — Sat, 29 Sep 2018 17:21:00 GMT

> CraginS (Contributor II) posted a new reply in Member Support on 09-29-2018

> @crystal_waston @Early_Adopter Â Let's not confuse three different items:

Hey, guys, I wouldn't bother arguing with or correcting "@crystal_waston." Like
"@nancy_perez" I'm pretty sure he/she/it is a bot.

Note that "nancy," in answering a question about "CISSP-Passed- Sharing"
https://community.isc2.org/t5/Certifications/CISSP-Passed-Sharing/m-
p/13586/highlight/true#M2744
says "Certified Information Systems Security Professional is an independent
information security certification granted by the International Information
System Security Certification Consortium, also known as (ISC)²."

"Crystal," in addressing the topic of "New exam format for CISSP"
https://community.isc2.org/t5/Member-Support/New-exam-format-for-CISSP/m-
p/15015/highlight/true#M2890
says "Certified Information Systems Security Professional is an independent
information security certification granted by the International Information
System Security Certification Consortium, also known as (ISC)². "

While it may not be apparent to the casual reader, those with keenly sharpened
senses and a background in forensic linguistics will note the subtle similarities in
structure and vocabulary.

You can check out further evidence by checking "nancy's" postings
https://community.isc2.org/t5/user/viewprofilepage/user-id/285512981
and "crystal's"
https://community.isc2.org/t5/user/viewprofilepage/user-id/1092220255

I'm not sure what the purpose of the bots is: at the moment they don't seem to be
doing any harm. They may simply be an experiment in whether they can exist,
undetected, in the "community."

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Life's a bitch ... and then you get reincarnated!!
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

Early_Adopter — Sun, 30 Sep 2018 15:16:48 GMT

Yowsers, don’t I just feel that burn? 😉

As noted elsewhere, I hadn’t looked at the other posts from Crystal in depth so got suckered in nicely, and the context seemed right for trying to be helpful.

On the bright side per your forum post, I will off course be in good standing when our machine overlords take over for assistance rendered...

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

CraginS — Sun, 30 Sep 2018 19:26:12 GMT

@rslade wrote:
Hey, guys, I wouldn't bother arguing with or correcting "@crystal_waston." Like
"@nancy_perez" I'm pretty sure he/she/it is a bot.
...
While it may not be apparent to the casual reader, those with keenly sharpened
senses and a background in forensic linguistics will note the subtle similarities in
structure and vocabulary.

Yeah, I had already noted that all Nancy can do is quote definitionally relevant but otherwise useless content from the (ISC)2 web site. Crystal is a new player in the game.I'd love to learn who is running them both, and why. If either the (ISC)2 staff or the community hosting company is doing so, several employees need to be called in on the carpet. Heck, I'd rather have more conversations with ELIZA (yes, I have chatted with ELIZA) than either of these bots.

If, on the other hand, nancy and crystal are part of a university research program AI project, I want a copy of the IRB justification and approval documents from that university.

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

rslade — Mon, 01 Oct 2018 18:53:00 GMT

> CraginS (Contributor II) posted a new reply in Member Support on 09-30-2018

> Yeah, I had already noted that all
> Nancy can do is quote definitionally relevant but otherwise useless content from
> the (ISC)2 web site. Crystal is a new player in the game.I'd love to learn who
> is running them both, and why.

>From an overall analysis of both their postings, I suspect it's ISC2's marketing
wing.

> If either the (ISC)2 staff or the community
> hosting company is doing so, several employees meed to be called in on the
> carpet.

Well, I may be overstating it with "bot." Given that various supposedly
automated aspects of the "community" are being handled manually (badges, and
seemingly some CPEs) (and possibly even the "reply via email" function--I'm
starting to have strong suspicions given what does and doesn't make it through ...)
I think these maybe be simply false flag/greenwash accounts that are being used to
post canned/boilerplate marketing pap on various topics.

> Heck, I'd rather have more conversations with ELIZA than either of these
> bots.

I've probably still got a copy of ELIZA around. I remember being amazed at how
small it was.

"Tell me more about 'these bots'."

> If, on the other hand, nancy and crystal are part of a university
> research program AI project, I want a copy of the IRB justification and approval
> documents from that university.

Would be interesting ...

====================== (quote inserted randomly by Pegasus Mailer)
rslade@vcn.bc.ca slade@victoria.tc.ca rslade@computercrime.org
Of course I'm home. I'm always home. I'm uncool.
- Lester Bangs in `Almost Famous'
victoria.tc.ca/techrev/rms.htm http://twitter.com/rslade
http://blogs.securiteam.com/index.php/archives/author/p1/
https://is.gd/RotlWB

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

rslade — Mon, 01 Oct 2018 19:17:47 GMT

> Early_Adopter (Advocate I) posted a new reply in Member Support on 09-30-2018

> As noted elsewhere, I hadn't
> looked at the other posts from Crystal in depth so got suckered in nicely

One of the advantages of the mail interface over the "social media" style Web interface (and one of the reasons I still like CISSPforum over the "community" ...)

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

rslade — Tue, 02 Oct 2018 16:49:39 GMT

California governor Jerry Brown signed a bill last week that bans automated accounts, more commonly known as bots, from pretending to be real people in pursuit of selling products or influencing elections.

Good thing we were only discussing digital certificates, and not the election.

(Oh, wait ... we can't discuss the election any more ...)

Re: Mis-Used Term on (ISC)2 Site - "Digital Certificate"

CraginS — Tue, 02 Oct 2018 17:46:13 GMT

@rslade wrote:
California governor Jerry Brown signed a bill last week that bans automated accounts, more commonly known as bots, from pretending to be real people in pursuit of selling products or influencing elections.

Reading the act, as linked, it will have only limited application.

"17941.

(a) It shall be unlawful for any person to use a bot to communicate or interact with another person in California online, with the intent to mislead the other person about its artificial identity for the purpose of knowingly deceiving the person about the content of the communication in order to incentivize a purchase or sale of goods or services in a commercial transaction or to influence a vote in an election. A person using a bot shall not be liable under this section if the person discloses that it is a bot.

(b) The disclosure required by this section shall be clear, conspicuous, and reasonably designed to inform persons with whom the bot communicates or interacts that it is a bot."

The trick in the wording is "knowingly deceive" which combines with the two alternatives of "purchase or sale" OR "influence a vote." Prosecution will depend on being able to first prove deception, that is, falsehood, and then prove it was done KNOWINGLY. An untruth told by someone who truly believes the statement is not a lie, even if it does result in deception.