In my line of work I meet a lot of people. Although my professional interactions are less formal than ever, most still exchange business cards. Every so often, I get a card with the person's name and then a long line of acronyms and abbreviations following it. For example, John Doe, CISSP, Security+, CISA, GIAC, CEH and probably another 10 I've never heard of.
My first thought: this person has a lot of extra time on his or her hands. But before I jump to unnecessary and likely incorrect assumptions, let's examine the role of security certifications and whether it's a good idea to invest the time and money to obtain them.
I've never really been a fan of certifications for two reasons: some of the smartest security folks I know don't have any, and some of the least capable do. This has caused me to be generally skeptical of the entire process. After all, certification is a huge business for the certifiers. With over 60 "vendor-neutral" certifications, how can a practitioner decide which one makes sense for him/her?
Yet many companies and hiring managers continue to believe there is a direct correlation between certification and competence. (There isn't, but I'm still swimming upstream on that topic.) The reality is, certifications can be useful at times. Let's examine some situations where that could be the case.
Accomplishing specific objectives
The value of certification is always dependent on the goals that need to be accomplished. When breaking into the security field, a certification is proof of some coursework and a general understanding of the vernacular. A CISSP is out of range (since that requires four years of field work), but getting another, possibly even vendor-specific certification may help ease the process of sliding into a technical role. Some hiring managers use certifications as a coarse filter in the process, so having one may be a leg up.
A certification can also help facilitate a career move within an
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
organization. For example, let's say you want to move from security to audit. Getting an audit-oriented certification (say ISACA's CISA) shows a base level of audit understanding.
A certification may also help in getting a raise at one's current job. Some organizations even pay for the certification, which can mean a positive return on that investment.
Finally, for a management position, it may make sense to look at a management-oriented certification. SANS has one of those, the GIAC Security Leadership Certification (GSLC). Without actual on-the-job experience, a certification can be helpful at times, depending on the organization.
Which to choose?
If a certification will help achieve goals, then it's time to figure out what's the best choice -- security certification or an audit certification? What are the pros and cons of each? Let's go through all of the big ones:
Remember, a certification is like anything else: it's a tool to help further career goals. If it's not possible to get from point A to point B without getting certified, then by all means go down that path. But keep in mind, nothing is a panacea and there is no replacement for actual hands-on experience.
So instead of spending a week in a SANS class, maybe volunteer to do a penetration test for a local religious organization and put in place some defenses to protect them. Maybe the local school or animal shelter needs some help, or the neighborhood homeowner's association. Another option is to apprentice with a local organization through the ISSA or the InfraGard organization.
These all provide the types of hands-on experience that employers look for. There are lots of places to learn and practice the trade. And some even yield better karma than a piece of paper.
About the author:
Mike Rothman is president and principal analyst of Security Incite, an industry analyst firm in Atlanta, and the author of The Pragmatic CSO: 12 Steps to Being a Security Master. Rothman is also SearchSecurity.com's expert-in-residence on information security management. Get more information about the Pragmatic CSO, read his blog, or reach him via e-mail at mike.rothman@securityincite.com.
