With my recent focus on career, job search and subsequent employer change the past few months, I’ve been wanting to post some of my recent thoughts on certifications but just haven’t had the time. So it was with interest (and some amusement) that I was following the recent comments between Daniel Miessler (original post and followup) and Marty McKeay (here and here) in regards to the comparisons/differences between the CISSP and GSEC. They have some opposing viewpoints on the subject, although I think they are closer than they think and sum up my thoughts pretty succinctly. Some of my favorite quotes from the discussion:
[MM] When you’re interviewing for a position, you’re interviewing a person, not a certificate. If you’re interviewing a CISSP to be a router jockey, you better hope they have a couple of other certs to back up their claims of knowledge. Or you better have some really good questions for them, preferably both. By definition, the CISSP shows no in depth knowledge of any particular aspect of security.
That’s one of the things that really bugs me about certs in general, the attitude of some (both cert holders and employers) that just because they hold a CISSP or GSEC, they have reached some pinnacle and know all they need to know about security. The attitude always astounds me! =) I’ve been in IT for about 15 years and yet I feel like I learn something new every day. In fact, that’s one of the main reasons I love the security field so much, the constant challenge to stay current, to learn and grow. =)
[MM] The CISSP certificate is useful setting a baseline of the person’s overall knowledge of security. And if it’s treated as nothing more than a simple measuring stick, it works well. But it’s not meant to measure someone’s networking knowledge and using it do so won’t work.
Marty pegs it here. Certs are (IMHO) a simple baseline that employers can use to assess that we in the security arena have a minimum “baseline” of security knowledge, but it is not the end-all be-all of measuring the skill of a person. We’ve all met loads of IT people with a bucketful of certs who could not troubleshoot their way out of a wet paper bag. So I thing Marty’s point is valid here, we cannot assume that a CISSP knows about things not covered in the official study guide. In a perfect world that foundation knowledge would be there, but this is not a perfect world. =) That’s where Daniel’s point rings true:
[DM] It’s simply absurd to claim that people in “management” roles don’t need to be versed in technology. Chefs learn about food. Architects learn about the structural integrity of their building materials. Physicists learn math. Why should information security experts not have to learn the building blocks of their discipline like everyone else?
I’ve held off taking the CISSP for years, but not for the reasons you might suspect. I guess it was the rebel in me, but as someone who was “in the trenches” for years I didn’t see the need to take a cert that did not (IMHO) add much to my knowledge base and was more of a resume checkbox.
This past year I think I’ve finally made peace with myself on this whole cert subject and have come to the conclusion that it’s part of the resume game we all must play sooner or later. I’ve changed the way I look at these certs and have even come to see the advantage of going through the motions, and will even admit to learning a thing or two in studying for the CISSP and CISA tests this year. I guess you can teach an old dog at least a few new tricks… =)
Update 9/7/07: This exchange has sparked some great comments around the web this week. Mike Rothman over at SecurityIncite.com wrote a great blurb on the issue. Marty also talks more about the issue in Episode 75 of his great podcast.
