Comments on: Security Certification Rules Could Shake Up IT Mgmt

By: CJ

CJ — Fri, 27 Jun 2008 03:01:41 +0000

I’ve gone my entire IT career without getting certified, though I’ve been told by many that I’m highly certifiable…

I’ll stick with my GED, thank you very much.

By: Bob Radvanovsky

Bob Radvanovsky — Thu, 26 Jun 2008 13:20:54 +0000

I thought I’d share this with everyone about a recent article published in today’s GCN magazine. This magazine is 1 of 5, representing the ‘heartbeat’ of U.S. government activities. As a ‘critical infrastructure protection’ (or ‘CIP’) researcher, I pay particularly closer attention to this and one other magaine because of the relevant articles about our Nation’s infrastructures.

However…I came across this article this morning about (practically) *mandating* that an IT security ‘professional’ be (are you ready for this) *required* to have an IT security certification. Not that I am discounting the “CISSP” certification, nor its accreditation organization, I see this as a step towards a ‘professional registration’ process.

The fact that they are mentioning ONLY ISC(2)’s certifications and no one else, leads me to believe that they are attempting to make the “CISSP” a mandatory standard without considering other certification/accreditation houses. How can they do this when agencies, such as the EPA and DOE, shot down similar (if almost *aggressive*) efforts to do the same several years ago on a similar note?

Though everyone seems to acknowledge “CISSP” as the ‘de facto’ IT security certification, I feel slighted by the fact that the CISM accreditation is still considered (by many people’s interpretation) as 2nd to the CISSP accreditation.

How is this fair? Answer: it isn’t. >((

-r

P.S. This cheapens, if not weakens, future certification efforts, perhaps ruining other more creditible accreditation firms, such as ISACA and the NSPE (just to name a few).

By: Tom Olzak

Tom Olzak — Thu, 26 Jun 2008 12:57:30 +0000

I agree that there are some CISSPs, just like there are many MCSEs, who aren’t qualified to work in a real security team. However, I don’t believe certifications were ever intended to be confirmation that a person is an expert in the related field.

We use the presence of certifications to determine if a person has the fundamental knowledge required for our security analysts. The interview process determines whether the person can actually put his or her knowledge into practice. And the ability to move from academic to practical application is lacking in many people. This is not necessarily a problem with the certifcation process.

I believe certifications are a good start, but they are far from the end goal for those building a technical career.