) (    (  )    ) (     )  (    ) (
 (  .========================.   (
  ) |  ~ C E R T I F I E D ~  |    )
 (  |  ~ C O M P L I A N T ~  |   (
  ) |       (gold seal)       |    )
    '========================'
    the wall behind it is on fire

Vendor Testing Labs

The lab is paid by the vendor. The vendor passes the test. The cycle continues.

• ICSA Labs (Verizon) Oldest security certification body. Vendor-pays model: companies contracted with and paid ICSA before testing. Vendors who failed got 2–4 weeks to patch and retest. ISO accreditation marketed as neutrality. Quietly closed 2022 after 30 years. [Wikipedia] [Verizon]
• Trustwave QSA that certified both Heartland AND Target as PCI compliant. Sued after both breaches. Denied responsibility both times. [Dark Reading]

Certification Mills

Vocabulary tests enforced by federal mandate, generating subscription revenue

• ISC2 (CISSP) DoD 8570 mandate created captive market. Thomas Ptacek: CISSP requirement is "a warning flag to industry elite not to apply." Gave away 1M free entry-level certs while raising CISSP fees 50%. CEO resigned October 2024, no explanation. DoD 8140 replaced 8570 because paper certs weren't producing capable people. [PR Newswire] [ISC2 forum]
• EC-Council (CEH) Decade of plagiarism in courseware. Blamed "overseas contractors." Sexist survey asking women about hacking in bikinis. Blog documenting it pressured offline. Still required by DoD 8570. No executive consequences. [Attrition.org]
• ISACA (CISM / COBIT) COBIT framework: no independent study has demonstrated a causal relationship between COBIT adoption and improved security outcomes. Certifications revoked without prior warning. "More focused on making money than supporting their members." 3.1 stars on consumer review platforms. [PissedConsumer] [ISACA]
• InfoSec Institute Founder Jack Koziol personally named in 3 plagiarism incidents. Plagiarized community researchers, charged NSA/GCHQ/Air Force/Army for the results. 11 BBB complaints. Blamed a contractor. [Attrition.org] [Fast Company]
• ISSA Founded 1984. 10,000+ members. 40 years of harmless existence. No scandals found. No measurable impact on the field found either. At least they didn't plagiarize anybody. [Wikipedia]

Open Source Capture

Communities create value, institutions capture the brand, extract revenue, fail to reinvest

• OWASP Foundation $5,368 to flagship projects. ~$3M in cash reserves. ZAP (world's most-used web scanner) left in 2023. 80+ signatories including OWASP's own founder demanded overhaul. Board response: "light on details." [CSO Online] [ZAP blog]

Security Media

Publications that couldn't secure themselves, pay their writers, or stop spamming

• Hakin9 Magazine XSS on their own login page. Served malware to visitors. Paid authors nothing. Spammed researchers who asked to be removed. Plagiarized content. May have violated Polish commercial law. BruCON 2012 lightning talk: "Hakin9 — Spam Kings." [Attrition.org] [DigiNinja]

Threat Intelligence Theater

Fear-based press releases, unverifiable statistics, credentials borrowed from nowhere

• mi2g Limited (DK Matai) Started as a car portal called "Carlounge." Claimed 1995 security founding date; was doing web dev until 1999. Unconfirmed PhD. Y2K predictions that didn't materialize. $7.3B cyber-attack cost claim called "mathematical masturbation." Conflated disgruntled employees with al-Qaeda. Invented "5th dimension defence shield." Satirist ranked higher in Google for the company's own name. Sent legal threats to the satirist. [Attrition.org] [The Register]