4 ms·

Certifications? Do people here second that recommendation? I'm very skeptical of the certification industry.

loteck 9y ago
If there is any point whatsoever to IT certifications it is to act as a minimum level legitimizer for those willing to acknowledge a lack of experience. Claiming certs have no value is to claim knowledge has no value.
- zer01 9y ago
  > is to act as a minimum level legitimizer for those willing to acknowledge a lack of experience True, but there are a lot of bullshit certifications out there that either 1.) vastly over project the actual knowledge people glean from it (CISSP and friends) or 2.) are unrecognized to the point that they're useless.
  - loteck 9y ago
    The certs aren't bullshit, it's how they are used by companies that makes them appear to be bullshit. What logically follows from my grandparent post is that people who can demonstrate vast experience shouldn't be asked to hold beginner certs. But companies do this all the time. It perpetuates a false impression that a beginner cert is actually aligned with advanced knowledge, which sets up people to complain about "bullshit certs" on internet forums.
- dsacco 9y ago
  > Claiming certs have no value is to claim knowledge has no value. No it isn’t, because it’s not intended to be literal. Instead, it’s shorthand for saying, “certifications have approximately negligible positive utility compared to learning alternatives, and net negative utility after time and monetary investments are considered compared to alternatives.” It’s like functions in the local versus global scale: for the most part, a certification is has an imperceptible impact on overall career trajectory. To abuse terminology a bit, of available opportunities with similar time and monetary costs, certifications are not among the those capable of changing the global scale of your career. I’ve been responsible for making hiring decisions in infosec positions. I consider certifications like CISSP to be a weakly negative signal in an inexperienced candidate and no signal either way in an experienced candidate. It’s useless to say that certain things have value if their value is absolutely dominated by similarly accessible alternatives. I know more than a handful of people who have started successful infosec careers with no certification or degree because they invested in themselves in more meaningful ways that the really well paying companies care about.
deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
zer01 9y ago
SANS certifications are the only ones I think hold any actual water. People tout the CISSP like it teaches you anything but the very basics and use that to call themselves professionals, which is a huge red flag in hiring.
FLUX-YOU 9y ago
OSCP has practical, hands-on experience in which you get 24 hours to pop a certain amount of boxes. You also write a pentesting report afterwards which contributes a certain number of points. Then they pass/fail you. They have a lab environment and a curriculum, and I think a forum and video tutorials for you to practice with before you actually pony up for the exam. It is one of the widely well-regarded certs because it doesn't simply test knowledge, but your ability to do a practical thing that infosec companies are looking for. From what I've read (I don't have this cert) you need to cover a lot of knowledge bases to actually pass it anyway, chief among those is enumerating networks and vulns. Some of the other certs are treated like software engineering certs (that is, not really well regarded except in cases of consultancy body shops needing simple qualifications for their clients)
qaq 9y ago
If you are really smart none cares
justboxing 9y ago
Yeah, and the SANs certification course mentioned in the post are nuts (price wise). > SEC301 Introduction to Cyber Security. > Dates: Fri, May 11 - Tue, May 15 (5 Days) > Fee: 5,380 USD Source: https://www.sans.org/registration/register.php?conferenceid=50975 https://www.sans.org/registration/register.php?conferenceid=... Over 5 grand for a 5 day course for an Intro Level Training? Wut!

If there is any point whatsoever to IT certifications it is to act as a minimum level legitimizer for those willing to acknowledge a lack of experience. Claiming certs have no value is to claim knowledge has no value.

zer01 9y ago
> is to act as a minimum level legitimizer for those willing to acknowledge a lack of experience True, but there are a lot of bullshit certifications out there that either 1.) vastly over project the actual knowledge people glean from it (CISSP and friends) or 2.) are unrecognized to the point that they're useless.
- loteck 9y ago
  The certs aren't bullshit, it's how they are used by companies that makes them appear to be bullshit. What logically follows from my grandparent post is that people who can demonstrate vast experience shouldn't be asked to hold beginner certs. But companies do this all the time. It perpetuates a false impression that a beginner cert is actually aligned with advanced knowledge, which sets up people to complain about "bullshit certs" on internet forums.
dsacco 9y ago
> Claiming certs have no value is to claim knowledge has no value. No it isn’t, because it’s not intended to be literal. Instead, it’s shorthand for saying, “certifications have approximately negligible positive utility compared to learning alternatives, and net negative utility after time and monetary investments are considered compared to alternatives.” It’s like functions in the local versus global scale: for the most part, a certification is has an imperceptible impact on overall career trajectory. To abuse terminology a bit, of available opportunities with similar time and monetary costs, certifications are not among the those capable of changing the global scale of your career. I’ve been responsible for making hiring decisions in infosec positions. I consider certifications like CISSP to be a weakly negative signal in an inexperienced candidate and no signal either way in an experienced candidate. It’s useless to say that certain things have value if their value is absolutely dominated by similarly accessible alternatives. I know more than a handful of people who have started successful infosec careers with no certification or degree because they invested in themselves in more meaningful ways that the really well paying companies care about.

deleted 9y ago

[deleted]

deleted 9y ago

[deleted]

zer01 9y ago

SANS certifications are the only ones I think hold any actual water. People tout the CISSP like it teaches you anything but the very basics and use that to call themselves professionals, which is a huge red flag in hiring.

FLUX-YOU 9y ago

OSCP has practical, hands-on experience in which you get 24 hours to pop a certain amount of boxes. You also write a pentesting report afterwards which contributes a certain number of points. Then they pass/fail you. They have a lab environment and a curriculum, and I think a forum and video tutorials for you to practice with before you actually pony up for the exam. It is one of the widely well-regarded certs because it doesn't simply test knowledge, but your ability to do a practical thing that infosec companies are looking for. From what I've read (I don't have this cert) you need to cover a lot of knowledge bases to actually pass it anyway, chief among those is enumerating networks and vulns. Some of the other certs are treated like software engineering certs (that is, not really well regarded except in cases of consultancy body shops needing simple qualifications for their clients)

qaq 9y ago

If you are really smart none cares

justboxing 9y ago

Yeah, and the SANs certification course mentioned in the post are nuts (price wise). > SEC301 Introduction to Cyber Security. > Dates: Fri, May 11 - Tue, May 15 (5 Days) > Fee: 5,380 USD Source: https://www.sans.org/registration/register.php?conferenceid=50975 https://www.sans.org/registration/register.php?conferenceid=... Over 5 grand for a 5 day course for an Intro Level Training? Wut!