https://itauditsecurity.wordpress.com/2009/03/15/fun-cpes-for-cissps/