7 ms·

Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doe

Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified accountants, Lawyers etc. Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting bad people? Also the article's argument that "it's experience that counts" really doesn't help get new people into the industry, where do they get the experience in the first place, it's a catch-22

wbl 10y ago
Apprenticeship works. Lots of places will have junior people work below senior ones on projects and gradually gain experience and become senior.
- raesene6 10y ago
  Yep I think apprenticeships can help too, there's no one thing that's going to help bring a load of people on, I think it's got to be multiple paths.
  - tptacek 10y ago
    I believe that too. I simply believe --- with ample evidence --- that certifications aren't going to be one of those paths.
    - raesene6 10y ago
      so, out of curiousity, that implies to me that you don't rate any IT security certifications? So would I be right in thinking you don't think that any of the Offsec certs (OSCP/OCSE), CREST certs (CCT etc) or SANS certs are usful? Also, and I'd be genuinely interested to hear your thoughts here, why do you think that IT/Info Sec will take a different path than other professions (medicine, law, accountancy, engineering etc) which fairly universally have evolved into a certified professional model?
      - tptacek 10y ago
        The "certifications" in medicine and law accompany postgraduate degrees and are far, far more recognized than the random certificates you listed, some of which are profit-making enterprises from for-profit companies.
        raesene6 10y ago
        Ah ok, so would it be fair to say that you're not opposed to the concept of certifiation, per se, but that you're not a fan of existing options in the field? Of course one problem is "how does a certification become recognized", I mean in IT security it's going to have to start somewhere... In the UK the IISP are perhaps closest to the "traditional profession" certifications, but they're struggling a bit to get traction.
        tptacek 10y ago
        You can't wish professionalism into being. You have to build a profession. We're not there yet with any aspect of information security. The hard work of defining the field and its requirements has not yet been done. No organization currently extant on this planet has any business pretending that they know the answers to these questions, let alone charging money to take tests about them.
        raesene6 10y ago
        Obviously it takes time to build a profession, but you've got to start somewhere, and part of that path is certification. Unfortunately the industry is growing far faster than perhaps happened for previous emergent professions, so the time needed to slowly grow professional bodies isn't available. If it's not commercial organisations that start providing those services, the only other options I can see are some form of union, or some government mandated body. Those are options, but both have their challenges. Both those options have their downsides.
        tptacek 10y ago
flukus 10y ago
How many of those industries does certification actually work in? Does it prevent dodgy lawyers and accountants?
- snowwrestler 10y ago
  Certification does work in some industries. When a lawyer is admitted to the bar, that is generally taken as proof that they have some idea of what they are doing. Bar exams are hard. And the bar also provides a forum for dealing with shady lawyers. If a lawyer treats you badly, you can file a complaint with their bar association and they might get disbarred. This is an area where cyber training and certs is not as good yet, I think: as a forum for resolving disputes.
  - flukus 10y ago
    TV may be leading me astray, but isn't disbarment usually for ethical reasons, not general incompetence?

wbl 10y ago

Apprenticeship works. Lots of places will have junior people work below senior ones on projects and gradually gain experience and become senior.

raesene6 10y ago
Yep I think apprenticeships can help too, there's no one thing that's going to help bring a load of people on, I think it's got to be multiple paths.
- tptacek 10y ago
  I believe that too. I simply believe --- with ample evidence --- that certifications aren't going to be one of those paths.
  - raesene6 10y ago
    so, out of curiousity, that implies to me that you don't rate any IT security certifications? So would I be right in thinking you don't think that any of the Offsec certs (OSCP/OCSE), CREST certs (CCT etc) or SANS certs are usful? Also, and I'd be genuinely interested to hear your thoughts here, why do you think that IT/Info Sec will take a different path than other professions (medicine, law, accountancy, engineering etc) which fairly universally have evolved into a certified professional model?
    - tptacek 10y ago
      The "certifications" in medicine and law accompany postgraduate degrees and are far, far more recognized than the random certificates you listed, some of which are profit-making enterprises from for-profit companies.
      - raesene6 10y ago
        Ah ok, so would it be fair to say that you're not opposed to the concept of certifiation, per se, but that you're not a fan of existing options in the field? Of course one problem is "how does a certification become recognized", I mean in IT security it's going to have to start somewhere... In the UK the IISP are perhaps closest to the "traditional profession" certifications, but they're struggling a bit to get traction.
        tptacek 10y ago
        You can't wish professionalism into being. You have to build a profession. We're not there yet with any aspect of information security. The hard work of defining the field and its requirements has not yet been done. No organization currently extant on this planet has any business pretending that they know the answers to these questions, let alone charging money to take tests about them.
        raesene6 10y ago
        Obviously it takes time to build a profession, but you've got to start somewhere, and part of that path is certification. Unfortunately the industry is growing far faster than perhaps happened for previous emergent professions, so the time needed to slowly grow professional bodies isn't available. If it's not commercial organisations that start providing those services, the only other options I can see are some form of union, or some government mandated body. Those are options, but both have their challenges. Both those options have their downsides.
        tptacek 10y ago

flukus 10y ago

How many of those industries does certification actually work in? Does it prevent dodgy lawyers and accountants?

snowwrestler 10y ago
Certification does work in some industries. When a lawyer is admitted to the bar, that is generally taken as proof that they have some idea of what they are doing. Bar exams are hard. And the bar also provides a forum for dealing with shady lawyers. If a lawyer treats you badly, you can file a complaint with their bar association and they might get disbarred. This is an area where cyber training and certs is not as good yet, I think: as a forum for resolving disputes.
- flukus 10y ago
  TV may be leading me astray, but isn't disbarment usually for ethical reasons, not general incompetence?