RE: Wow, just when you though big government was someone else's problem

[Michael Barker <mbarker () cyrusnetworks com>]

Seems like they're following up on Department of Defense Directive 8570.01, whereas all Information Assurance personnel 
(that being defined as anyone with privileged access) are required to be certified.

Fully policy manual is here.
http://www.dtic.mil/whs/directives/corres/pdf/857001m.pdf


-----Original Message-----
From: Valdis.Kletnieks () vt edu [mailto:Valdis.Kletnieks () vt edu] 
Sent: Sunday, April 05, 2009 4:13 AM
To: Suresh Ramasubramanian
Cc: nanog () nanog org; Jeff Young
Subject: Re: Wow, just when you though big government was someone else's problem

On Sat, 04 Apr 2009 16:16:24 +0530, Suresh Ramasubramanian said:

> Do you by any chance get to go work on sensitive government networks 
> without, say, a security clearance?

What the draft actually says:

SEC. 7. LICENSING AND CERTIFICATION OF CYBERSECURITY PROFESSIONALS.

(a) IN GENERAL. - Within 1 year after the date of enactment of this Act, the Secretary of Commerce shall develop or 
coordinate and integrate a national licensing, certification, and periodic recertification program for cybersecurity 
professionals.

(b) MANDATORY LICENSING. - Beginning 3 years after the date of enactment of this Act, it shall be unlawful for any 
individual to engage in business in the United States, or to be employed in the United States, as a provider of 
cybersecurity services to any Federal agency or an information system or network designated by the President, or the 
President's designee, as a critical infrastructure information system or network, who is not licensed and certified 
under the program.

A few thoughts:

1) Somebody's going to make a mint of money doing certification testing.

2) Somebody's network is going to be left flapping in the breeze because their provider didn't get certified in time.

3) It's interesting that "providers of cybersecurity services" have to be licensed, although others who do 
security-relevant work on the system/net don't have to be - nor do they define what a "provider of cybersecurity 
services" is.

So - quick show of hands: If you have a net that this applies to, do you know which of your engineers do/don't need a 
cert? ;)