5 ms·

So how would you approach scaling the IT Security industry without some form of industry certification process? I'm definitely not trying to defend the CISSP/C

So how would you approach scaling the IT Security industry without some form of industry certification process? I'm definitely not trying to defend the CISSP/CEH style certs here but I don't see how you reliably expand the industry at scale without some form of certification process. A company hiring it's first security person or a company trying to hire a lot of security people, need some form of base benchmark to work from, just like with most other professions (e.g. Law, accountancy, architecture etc)

tptacek 10y ago
What does "certification" have to do with scaling the industry? Training and nurturing talent is a hard problem, but expensive tests don't do anything to mitigate that problem.
- raesene6 10y ago
  Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified accountants, Lawyers etc. Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting bad people? Also the article's argument that "it's experience that counts" really doesn't help get new people into the industry, where do they get the experience in the first place, it's a catch-22
  - wbl 10y ago
    Apprenticeship works. Lots of places will have junior people work below senior ones on projects and gradually gain experience and become senior.
    - raesene6 10y ago
      Yep I think apprenticeships can help too, there's no one thing that's going to help bring a load of people on, I think it's got to be multiple paths.
      - tptacek 10y ago
        I believe that too. I simply believe --- with ample evidence --- that certifications aren't going to be one of those paths.
        raesene6 10y ago
        so, out of curiousity, that implies to me that you don't rate any IT security certifications? So would I be right in thinking you don't think that any of the Offsec certs (OSCP/OCSE), CREST certs (CCT etc) or SANS certs are usful? Also, and I'd be genuinely interested to hear your thoughts here, why do you think that IT/Info Sec will take a different path than other professions (medicine, law, accountancy, engineering etc) which fairly universally have evolved into a certified professional model?
        tptacek 10y ago
        The "certifications" in medicine and law accompany postgraduate degrees and are far, far more recognized than the random certificates you listed, some of which are profit-making enterprises from for-profit companies.
        raesene6 10y ago
        Ah ok, so would it be fair to say that you're not opposed to the concept of certifiation, per se, but that you're not a fan of existing options in the field? Of course one problem is "how does a certification become recognized", I mean in IT security it's going to have to start somewhere... In the UK the IISP are perhaps closest to the "traditional profession" certifications, but they're struggling a bit to get traction.
        tptacek 10y ago
        You can't wish professionalism into being. You have to build a profession. We're not there yet with any aspect of information security. The hard work of defining the field and its requirements has not yet been done. No organization currently extant on this planet has any business pretending that they know the answers to these questions, let alone charging money to take tests about them.
  - flukus 10y ago
    How many of those industries does certification actually work in? Does it prevent dodgy lawyers and accountants?
    - snowwrestler 10y ago
      Certification does work in some industries. When a lawyer is admitted to the bar, that is generally taken as proof that they have some idea of what they are doing. Bar exams are hard. And the bar also provides a forum for dealing with shady lawyers. If a lawyer treats you badly, you can file a complaint with their bar association and they might get disbarred. This is an area where cyber training and certs is not as good yet, I think: as a forum for resolving disputes.
      - flukus 10y ago
        TV may be leading me astray, but isn't disbarment usually for ethical reasons, not general incompetence?
devnullmonkey 10y ago
The problem is one of trust, methinks. Most certs require only that you "know" the material well enough to pass a test that uses your memory. If the tests were empirical, say like the Red Hat tests or the Cisco CCIE, then the trust that someone actually has skills might be more believable. Having worked in IT security for many years, I can attest to the fact that IT security is more of a subjective set of processes rather than a specifc product or set of products. There are skills involved as far as tools and knowledge of how to use tools, but these change depending on the use case.
- raesene6 10y ago
  Yep the problem is that some of the well known certs are bad, not that the concept of IT security certifications are bad. I've been in IT/Infosec for 17 years now. I have certs that I literally maintain as a HR/sales checkbox (e.g. CISSP) and certs that make me think every time I need to refresh them (e.g. CREST CCT). It's possible to have good IT sec. certs.

tptacek 10y ago

What does "certification" have to do with scaling the industry? Training and nurturing talent is a hard problem, but expensive tests don't do anything to mitigate that problem.

raesene6 10y ago
Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified accountants, Lawyers etc. Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting bad people? Also the article's argument that "it's experience that counts" really doesn't help get new people into the industry, where do they get the experience in the first place, it's a catch-22
- wbl 10y ago
  Apprenticeship works. Lots of places will have junior people work below senior ones on projects and gradually gain experience and become senior.
  - raesene6 10y ago
    Yep I think apprenticeships can help too, there's no one thing that's going to help bring a load of people on, I think it's got to be multiple paths.
    - tptacek 10y ago
      I believe that too. I simply believe --- with ample evidence --- that certifications aren't going to be one of those paths.
      - raesene6 10y ago
        so, out of curiousity, that implies to me that you don't rate any IT security certifications? So would I be right in thinking you don't think that any of the Offsec certs (OSCP/OCSE), CREST certs (CCT etc) or SANS certs are usful? Also, and I'd be genuinely interested to hear your thoughts here, why do you think that IT/Info Sec will take a different path than other professions (medicine, law, accountancy, engineering etc) which fairly universally have evolved into a certified professional model?
        tptacek 10y ago
        The "certifications" in medicine and law accompany postgraduate degrees and are far, far more recognized than the random certificates you listed, some of which are profit-making enterprises from for-profit companies.
        raesene6 10y ago
        Ah ok, so would it be fair to say that you're not opposed to the concept of certifiation, per se, but that you're not a fan of existing options in the field? Of course one problem is "how does a certification become recognized", I mean in IT security it's going to have to start somewhere... In the UK the IISP are perhaps closest to the "traditional profession" certifications, but they're struggling a bit to get traction.
        tptacek 10y ago
        You can't wish professionalism into being. You have to build a profession. We're not there yet with any aspect of information security. The hard work of defining the field and its requirements has not yet been done. No organization currently extant on this planet has any business pretending that they know the answers to these questions, let alone charging money to take tests about them.
- flukus 10y ago
  How many of those industries does certification actually work in? Does it prevent dodgy lawyers and accountants?
  - snowwrestler 10y ago
    Certification does work in some industries. When a lawyer is admitted to the bar, that is generally taken as proof that they have some idea of what they are doing. Bar exams are hard. And the bar also provides a forum for dealing with shady lawyers. If a lawyer treats you badly, you can file a complaint with their bar association and they might get disbarred. This is an area where cyber training and certs is not as good yet, I think: as a forum for resolving disputes.
    - flukus 10y ago
      TV may be leading me astray, but isn't disbarment usually for ethical reasons, not general incompetence?

devnullmonkey 10y ago

The problem is one of trust, methinks. Most certs require only that you "know" the material well enough to pass a test that uses your memory. If the tests were empirical, say like the Red Hat tests or the Cisco CCIE, then the trust that someone actually has skills might be more believable. Having worked in IT security for many years, I can attest to the fact that IT security is more of a subjective set of processes rather than a specifc product or set of products. There are skills involved as far as tools and knowledge of how to use tools, but these change depending on the use case.

raesene6 10y ago
Yep the problem is that some of the well known certs are bad, not that the concept of IT security certifications are bad. I've been in IT/Infosec for 17 years now. I have certs that I literally maintain as a HR/sales checkbox (e.g. CISSP) and certs that make me think every time I need to refresh them (e.g. CREST CCT). It's possible to have good IT sec. certs.