CISSP Forum Frequently Asked Questions (FAQ)

Please contribute to this FAQ!

Table of Contents

How The Forum Works
(Purpose, controls, features, subscribing)

Forum Etiquette
(What's naughty and nice)

Advertising And Promotion
(Just say No)

Jargon
(We have our own language)

The Certificate and Certification
(Resources, common misunderstandings)

How The Forum Works

Q. How can I access the group through the Yahoo! website (to change my options, download files, etc.)?
A. First, if you don't have a yahoo account, establish one.

Then, on the main yahoo groups page there is a spot on the right side referring to egroups members. Click on that icon.

On that page is a link that says to link your egroups account to your yahoo account. Click that link.

The page you goto will ask you login to your egroups account, not your yahoo account. If you don't know the password, enter the email address at which you get the cisspforum email. The egroups server will then send you your password.

Once you can login to your egroups account, you can then link it to your yahoo account. Just follow the directions.

Q. What is the purpose of the CISSP Forum?
A. It's a discussion group exclusively for CISSPs, where we can discuss matters of mutual interest, ask questions, get assistance, share ideas, and gripe about the sad state of affairs in the world.

Q. Is the forum moderated?
A. No. Any member of the forum may post, and the submission goes directly to the forum without being first approved by a moderator. Since membership is restricted to CISSPs, it is presumed that a moderator is unnecessary.

Q. Is the forum controlled?
A. Yes. Only members of the forum may post. Furthermore, membership in the forum is restricted to certified individuals.

Q. Who controls membership in the forum?
A. ISC2. The list owner is forum@isc2.org, a mailbox administered by ISC2 Services.

Q. What happens when I "reply" to a posting?
A. It is important to understand that all postings, when passing through the Yahoo! groups software, are re-written to have a "Reply-to:" address of the forum. If you simply hit "reply" your response will go to the whole forum. If you intend to respond to a specific individual off-list, you must compose a separate message to that person or change the "To:" address after hitting "reply". You can find the person's email address in the "From:" line of the posting to which you are responding.

Q. Is there a digest version of the forum available?
A. Yes. However, configuring your Yahoo! account to do anything other than the default "individual emails" behavior may end up being one of the most difficult things you'll ever do. Many sober and seasoned professionals have been brought to the brink of insanity in the process. Use the following instructions with care. If you start to drool excessively, seek qualified psychiatric care immediately.

The following explanation was provided by a conscientious member of the forum:

If you do not have a Yahoo account you will need to create one so you can sign in. One of your alternate e-mail addresses for your Yahoo account will need to be the e-mail address where you receive the CISSP Forum e-mails. This e-mail address must also be verified, which can be by following these steps. Note: these steps were accomplished by not having the browser remember any passwords.

  1. Go to www.yahoo.com
  2. Click the "Personalize" link at the top right
  3. Sign in using you Yahoo account and password
  4. Click the "Account Info" link at the top right
  5. Enter your Yahoo ID password
  6. Click "EDIT" link to the right of Member Information
  7. Enter your Yahoo ID password
  8. Under E-Mail Information Click "not-verified" link under the alternate address that you use for the CISSP Forum
  9. Click "Send Verification"
  10. Open the e-mail with the verification code
  11. Go to the link provided in the e-mail
  12. Sign in with your Yahoo ID and password
    The code should be pre-entered for you
  13. Enter your Yahoo ID password
  14. Click "Verify"
Your e-mail address should be verified now. Now, back to associating your Yahoo account to the CISSP Forum group.

  1. Go to www.yahoo.com/groups/cisspforum
  2. Click "Sign in now"
  3. Enter your Yahoo ID and password
  4. Click "My Groups"
  5. Click "Membership Wizard"
  6. Click "Continue"
    Make sure your CISSP Forum e-mail account is checked
  7. Click "Continue"
    On the next screen you will see your e-mail address associated with the CISSP Forum and your Yahoo ID.
  8. Click "Continue"
  9. Click "Continue"
You can now access the CISSP Forum group by going to www.yahoo.com/groups/cisspforum

Q. How do I subscribe from the forum?
A. Once you have been certified, you will be provided with a certificate number that will give you access to the restricted area of the ISC2 website. In the restricted area you can visit the cisspforum information and subscription page. Fill out the subscription form.
Q. How do I unsubscribe from the forum?
A. visit the cisspforum information and subscription page. Fill out the un-subscription form.

Forum Etiquette

Q. I want to ask for suggestions about a problem I am having, or I am looking for a product recommendation. What is the recommended approach?
A. First, do your homework. Hit the web search engines. If you find any products, then begin your e-mail by stating the problem, and list the products you found. If you did not find anything, say so. Preferably, request that members e-mail you off-line with their responses, and provide a mailto:your-e-mail@company.com link in the body of your message. Offer to summarize all the answers and post it to the list with the original question. If you cannot receive off-list e-mail for whatever reason, please say "post your replies to the list", and offer a summary when you have received enough answers.

Q. I'm responding to another post, but I'm taking the discussion in a different direction. How should I handle that?
It is courteous to change the subject line before posting, if you are changing the subject of the message, taking the discussion on a tangent, or even "specializing" the discussion to a particular point. There are three conventional ways to do this:
  • You can change the subject completely.
  • You can insert the new subject before the previous subject. The usual convention for this is to prepend the previous subject with "(was: ", as in the following example: If the original subject was "Western States" and the new thread you are starting has the subject of "Oregon", you could change the subject to: "RE: [cisspforum] Oregon (was: Western States)".
  • You can append additional specificity to the existing subject, particularly when you are addressing a part of the ongoing thread. For example, if the original subject was "Western States", you could change the subject to "RE: [cisspforum] Western States - Oregon".
Make your choice of one of the above formats based on what you think makes sense in the context of the thread.
Q. Someone posted something I strongly disagree with. How should I respond?
A. Carefully. While it may be very tempting to shred the poster's argument with your indisputable logic, you might find in the end that your viewpoint represents a minority of one. The main thing is to phrase your reponse "professionally", meaning respectfully and giving the other person the maximum benefit of the doubt. Assuming the other person holds a certain opinion simply because they are stupid is not likely to win many friends.

You can also consider the possibility of responding directly to the individual, instead of to the list. Even then, it is recommended that you maintain at least a minimal level of respect and courtesy.

In the end, it is your choice how to respond. If you are feeling high emotions about a post, here is some good advice: write your response, then don't send it for at least an hour. Do something else for a while and if you still feel your first draft is appropriate when you come back to it, by all means hit the send button.

Q. Someone posted a statement that is false. How should I respond?
A. First of all, be absolutely sure that you did not misunderstand the post. It is certainly appropriate to respond with a question asking for clarification, e.g., "Did you really mean to say that ...?"

Next, you should be certain that you are right. Sometimes matters of strong opinion can strangely transform themselves (in your mind) into matters of fact vs. fiction.

Finally, all the guidance about disagreement (above) applies.

Q. Someone responded to one of my posts in a mean-spirited and downright impolite manner. What should I do?
A. You will not be the only one to notice. Sometimes the best thing to do is to wait quietly while others fight the battle for you. Another approach is to maintain the moral high ground, calmly responding in a respectful and professional manner. Perhaps the worst thing you can do is to respond in kind. Have no fear: people who are abusive in the forum do far more damage to themselves than to the people they attack.

Q. Someone posted something which is off-topic with respect to Information Systems Security. What should I do?
A. Make your objection known to the poster by communicating off-list. Responding in the forum just adds to the noise. But bear in mind that this forum seems to tolerate a certain amount of off-topic discussion, so long as it is interesting. If you are guilty of engaging in off-topic discussion, you should consider taking the traffic off-list, particularly if requested by another member.

Q. One of the participants in the forum is a self-absorbed wind bag who consistently posts comments obviously intended to congratulate himself/herself on his/her "amazing insights" and "high quality opinions". Can anything be done about this pompous jerk?
A. Yes. You can sigh, roll your eyes, say, "there s/he goes again!", and hit the delete key.

Q. What about "ad hominem" attacks?
A. Ad hominem attacks (attacks on a person, rather than his or her opinion) are unworthy of professionals. We have never had a problem in the forum with attacks on a member's race, ethnicity, religion or gender and do not expect to. Obviously, even a single instance of such would result in swift and harsh official recriminations. 'Nuff said.

Other types of ad hominem attacks can be more subtle, but are nevertheless unacceptable. If you disagree with someone, stick to attacking the logic and rationality of their position. Stating that someone, "obviously has the intellectual capacity of a cantaloupe" reflects more poorly on you than on the target of your accusation. (Unless, of course, you can present scientifically credible data on melon intelligence.)

Q. I posted a question to the forum, but nobody responded. What does that mean?
It can mean many things. Perhaps no one has any opinion on the question. Maybe those who do have an opinion are busy and haven't been keeping close tabs on the forum this week. Realize that some forum participants use the "digest" feature to cut down on the number of messages they receive, so the digest may not yet have been composed.

It's also possible that people are being polite. Most of our mothers told us, "If you can't say anything nice, don't say anything at all." Did you employ the recommended approach for asking a question on the forum?

Advertising And Promotion

Q. Is it appropriate to promote products or services in the forum?
A. No. If a question is posed in the quorum, and you believe that your (or your company's) product or service could solve the problem, it may be appropriate to make brief mention of your offering and invite further off-list discussion. You are also welcome to contact the poster off-list directly. However, you should never post an unsolicited "plug" for your own products or services, no matter how many forum members you believe would be interested.

Q. If someone asks for product or service recommendations, is it OK for me to recommend my own (or my company's) product or service?
A. Yes. However, if you respond to the forum and not individually to the person requesting the information, your response should be focused on the specific questions asked in the thread. You should refrain from posting generic marketing material.

Q. Is it OK to announce job openings in the forum?
A. Yes, unless you are a professional recruiter. Job postings from any one person are expected to be rare, concise, and discreet.

Jargon

Q. What are some of the common abbreviations and acronyms commonly used in the forum?
A. Here are a few, additional entries are solicited. (Please send your questions and recommendations)
  • AFAIK = "as far as I know"
  • AFAIR = "as far as I remember"
  • BTDT = "Been There, Done That"
  • HISM = "Handbook of Information Security Managers" (a book by Hal Tipton and Mickey Krause)
  • IANAL = "I am not a lawyer" (but even if the poster is a lawyer, you should not consider the post to be legal advice)
  • IAW = "in accordance with"
  • IIRC = "if I recall correctly"
  • IMO = "in my opinion"
  • IMHO = "in my humble opinion"
  • IMNSHO = "in my not so humble opinion"
  • LLPOF = "Liar, liar, pants on fire"
  • LOL = "Laughing Out Loud"
  • RTFM = "Read The Fine Manual" (Sometimes the "F" is rendered as other words.)
  • SNAFU = "situation normal: all fouled up"
  • SOP = "standard operating procedure"
  • SPOF = "single point of failure"
  • WRT = "with respect to"
  • YMMV = "your mileage may vary" (i.e., you may not get the same results as I did)
Q. I am from a country other than the US. What is the meaning of some of the the US-specific terminology I often see in the forum?
A. (Input for this section is solicited, particularly from non-US participants. Please send your questions and recommendations.)

The Certificate and Certification

Q. I have a friend/colleague/student/etc. who is studing for the certification exam. Are there any online resources available to help him/her?
A. Yes. Here are a couple, and of course you can consult Google and Amazon for others:
  • The CISSP Open Study Guide (www.cccure.org)
  • Book by Phil Fites, available for purchase. Contact Phil via email. (fites@sympatico.ca)
Please submit other resources to be added to this FAQ.

Q. I think I know someone who has the certification, but I don't think s/he really fulfills the requirements. Should I discuss this on the forum?
A. No. You should first make sure you fully understand the actual requirements for the certification (there have been many misunderstandings over this). You can look it up on the ISC2 website.

It might also be helpful to review the CISSP Code of Ethics and associated explanatory notes.

Next, you should understand that you have certain obligations, both explicit and implicit, as a member of the profession. Your obligation to the person you think may not be legitimate is to refrain from indulging in innuendo on the forum or elsewhere. Your obligation to the forum is to refrain from irresponsible accusations (of unnamed individuals, etc.) that tend to erode confidence in ISC2 and the certification process. Your obligation to the membership is to defend the certification by doing one of two things if you believe someone does not meet the requirements:

  1. Courteously and professionally confront the individual, in private, asking for whatever justification you may need to allay your suspicions.
  2. If you cannot do #1 (it's your boss?), turn over whatever information you have to the ISC2 Ethics Committee, so they can approach the individual without identifying you.
Note that "keep your head down, and don't rock the boat" is not one of the options.


Owner: Eagle's Reach Corp.
Last modified: Fri Mar 3 17:31:00 2006