3 ms·

I'm going to partially disagree with the article. the problem with the approach of "just learn to be a good security person" is that it doesn't scale. Sure bac

I'm going to partially disagree with the article. the problem with the approach of "just learn to be a good security person" is that it doesn't scale. Sure back when I, and a lot of other people who are a bit older, learned security that was the only option, there weren't structured courses and certifications. However when we're working at scale, certifications can be useful as providing a demonstration that the holder has some level of exposure/knowledge of the arena in question. what complicatates this quite a bit is that some of the more popular certifications are, rightly, not considered that good as the process to get them lends itself to rote learning. So things like the CEH and CISSP where the exam is multi-choice, not so great. On the other hand things like the CREST CCT definitely require a decent level of knowledge to pass and you need to be able to apply that knowledge in a practical situation and in time limited conditions. I find the anti-certification bias in IT and security a bit odd really. If you look at other professions (e.g. law, accountancy, architecture etc etc) it's recognised that these things are required to get a minimum level in place in situations where you have a large body of people, I don't really see why IT Security should be any different. To me, the problem of "these certifications are bad" should have an answer of "lets make better certifications" not "lets not use certification"

zeta0134 10y ago
The only certifications I've picked up so far along my industry journey (I have no college degree and don't plan to get one, so these are necessary) are the Redhat RCSA and RHCE. Both of these certs can't be solved with rote memorization, and required me to log into a virtual machine and solve problems in a live environment, running through a plethora of common systems administration tasks that were then graded by how well I accomplished the requirements. Often the requirements were vague enough that I had to do some digging. There was no real memorization needed, and I had the full man pages of the operating system at my fingertips, but the time limit ensured that I needed to have at least a certain degree of proficiency with each tool to finish all of my tasks before the end of the exam. I assumed this was the norm with certifications, but the comments here strongly suggest that it is not. Are Security Certifications really multiple choice questions without any practical applications? That seems like it could stand to be improved greatly.
- raesene6 10y ago
  some are bad certs (rote learning, multiple choice), others are not (they have good practical elements). One problem is that some of the "bad certs" e.g. CEH, CISSP , are well established. My feeling is that the answer isn't "don't have certs" but "have better certs"
tptacek 10y ago
You're presenting a false dichotomy. The choice isn't between "security certification" and "people learning on their own".
- raesene6 10y ago
  the original article, I felt, made that point. It provided several examples of people learning on their own and provided those as an argument for why certifications were unecessary. So not my dichotomy.

zeta0134 10y ago

The only certifications I've picked up so far along my industry journey (I have no college degree and don't plan to get one, so these are necessary) are the Redhat RCSA and RHCE. Both of these certs can't be solved with rote memorization, and required me to log into a virtual machine and solve problems in a live environment, running through a plethora of common systems administration tasks that were then graded by how well I accomplished the requirements. Often the requirements were vague enough that I had to do some digging. There was no real memorization needed, and I had the full man pages of the operating system at my fingertips, but the time limit ensured that I needed to have at least a certain degree of proficiency with each tool to finish all of my tasks before the end of the exam. I assumed this was the norm with certifications, but the comments here strongly suggest that it is not. Are Security Certifications really multiple choice questions without any practical applications? That seems like it could stand to be improved greatly.

raesene6 10y ago
some are bad certs (rote learning, multiple choice), others are not (they have good practical elements). One problem is that some of the "bad certs" e.g. CEH, CISSP , are well established. My feeling is that the answer isn't "don't have certs" but "have better certs"

tptacek 10y ago

You're presenting a false dichotomy. The choice isn't between "security certification" and "people learning on their own".

raesene6 10y ago
the original article, I felt, made that point. It provided several examples of people learning on their own and provided those as an argument for why certifications were unecessary. So not my dichotomy.