The Nation of Tokelau

Tokelau is a self-governing territory of New Zealand consisting of three coral atolls in the southern Pacific Ocean. It lies north of the Samoan Islands, east of Tuvala, south of the Phoenix Islands and northwest of the Cook Islands. It's believed that the islands were first settled approximately 1000 years ago. Tokelau is a free and democratic nation with no political parties, holding elections every 3 years. And Tokelau is the first 100% solar powered nation in the world.

So why the interest in this small group of islands in the Pacific?  Well, it's not the islands, the nation, or even the people per se that interest me, it's their ccTLD, .tk that I have recently become aware of.  Tokelau allows any individual to register a domain under this ccTLD, and with few restrictions (such as sexual, drug, hate and firearms content), users and small businesses may register any number of domains free of charge.  "Special" .tk domains, such as those containing the trademark domain names for most Fortune 500 companies must be purchased. Users may also opt to forward their web and email traffic.

The nation of Tokelau boasts a population of 1,499 as of the October 2016 census, good for 237th in the world.  What makes this small population most remarkable is the fact that more than 28 million domains have been registered under the .tk ccTLD.  According to a McAfee survey in 2006, .tk domains were twice as likely to be used for "unwanted behaviors" when compared to the global average. In 2010, the Anti-Phishing Working Group noted that 21.5% of all worldwide phishing originated from .tk domains.

So what does this mean for you?  Have you ever done legitimate business with a person or organization coming from a .tk domain?  I can't say that I have.  And other than the free domain registration (which hardly matters with what GoDaddy and other registrars are selling domains for these days), why would anyone want to register their domain with such a small, and otherwise unknown nation?  They claim to have rules, but are clearly not enforcing them. And how could they with 28 million domains and counting registered? As of right now, it's probably safe to just blacklist the entire .tk for now.

Thoughts on the CISSP

Saturday afternoon, I took the CISSP exam and passed.  Not only is this a sweet certification on my resume, it's the final requirement for my Masters degree.  So all in all, a pretty awesome weekend, even though it was quite stressful leading up with so much riding on this exam.

So the first thing that stands out on this exam is just how long it is.  250 questions long and by far the longest exam I've ever taken either for a certification or in academia.  I'm normally a fast test taker, and it still took me around 2.5 hours to complete.  I can't even imagine someone who is a slow test taker and up against the clock.

My road to success on this exam is not for everybody.  In 2008, I decided to use what I had left of GI Bill eligibility and make a career change into I.T.  Some of my earliest classes were infosec related, and I first read Shon Harris's incredible CISSP All-in-One Exam Guide somewhere in the neighborhood of 2009 as it was the textbook for a couple classes.  From there I went on to study Information Assurance at Eastern Michigan University, earning a Bachelors in 2012.  Many of these classes focused around CISSP topics.  Three years later I went back to Eastern to pursue a Masters degree, and many of these classes also focused on CISSP topics.  Everything from a class on Risk Management in my undergrad days, through graduate classes on Business Continuity and Incident Management recently.

For the capstone of my Masters program, I chose the option of taking this exam, and dedicated the semester to studying for it.  Over the course of the semester, I read Eric Conrad's CISSP Study Guide and Adam Gordon's Official Guide to the CISSP CBK, both on Books 24x7 (thanks EMU!).  I also watched a great video series on FedVTE (thanks government contracting position!).  I took it one domain at a time, first reading the chapter in Eric Conrad's book, watching the video, then reading the chapter in Adam Gordon's book, using each sources practice questions to gauge my progress before moving on to the next source.  Along the way, I kept notes on my strong and weak points of each domain (a learning log was a requirement of the class, otherwise I may not have) and spent the last couple weeks of the semester reviewing all the areas I wasn't comfortable with.

For anyone considering taking the exam, know that this isn't like your typical Cisco or Microsoft exam.  For those, you can almost always find a seat at a nearby testing center on the day you prefer to take your exam.  Not so with the CISSP.  In mid-February when I went to book the exam, I could find a couple seats in early March (way too soon!) or mid to late April, so I took it April 15.  My due date to present proof of passing was April 17, so there was no second chance.  So if you're up against the clock, either for work or school, book sooner than later.  I also ended up having to go with a testing center that was a little over an hour drive from my house, where as the one I normally go to is 15 minutes away.  I'm assuming it's the 6 hours you get for this, but there simply isn't a lot of available seats for this exam.  At least in early 2017 for the Detroit and Ann Arbor areas.

So no rest for the weary, its on to the next thing.  I'm initially leaning towards getting the "Upgrading Your Skills to MCSA: Windows Server 2016" knocked out now before Microsoft drops all the 2012 exams off of the list of available qualifications for partner status.  That wasn't a fun scramble when they dropped the 2008 exams.  Without school taking precedent in my mind, I probably won't take 6 to 9 months to prepare for a test this time.