3 ms·

This really depends on the candidate profile and what exactly you're expecting the certifications to do. Does a certification teach you how to 'do' InfoSec? No

This really depends on the candidate profile and what exactly you're expecting the certifications to do. Does a certification teach you how to 'do' InfoSec? No. But they're useful if you're starting out in InfoSec. Especially if you're changing careers, don't have a BS, or have those other boxes recruiters like to check. Certs can get you through the recruiter. Also, some employers require certain certifications to work there; especially if they're working with the government, or some other organization whose contract requires that people working on the contract have various certifications. If you're going into forensics or something like that where you may be called upon to testify in court as an expert witness, certifications help prove your bonafides to the court. A blanket 'no they're not useful' is unhelpful and not entirely accurate.

tptacek 5y ago
If, for newcomers, there was literally nothing else you could do, short of obtaining a compatible bachelors degree (another form of certification), to prepare for entry into the field, then yes, it would be unhelpful and inaccurate to say that certification is entirely useless. But there are other things you can do, and so the effort involved in acquiring a certification --- even if an employer is paying for it --- has to be weighted against those other things. Research, open source development, writing, CTFs, keeping abreast of research, networking (even just "going to Defcon" --- and I don't like Defcon!), investing more time in researching career opportunities, bug bounties... these things all have a much higher payoff than certification does, and any time you spend pursuing a certification is coming at the expense of those other things. It's also letting you kid yourself about the work and whether it's a fit for what you want to be doing, because one thing you should notice about that random list of things I just generated is that it covers a lot of what infosec people actually do. A certification process provides structure and forcing functions and activation energy (for a dumb process that won't get you any meaningful advantage professionally). But if you can't generate that kind of activation energy yourself, in this climate, with this many available resources, with the kinds of career payoffs people are regularly obtaining, maybe this isn't really what you want to be doing?
- chevill 5y ago
  I agree that they are most effective for newcomers. I'd also agree that with few exceptions they aren't the most efficient learning process, but as a person that had the luxury of spending about $35k in leftover GI bill benefits on 6 SANS certifications I did get some value out of most of the classes, even when I was an intermediate DFIR analyst. They weren't life changing or anything, but some of them were useful. >these things all have a much higher payoff than certification does, and any time you spend pursuing a certification is coming at the expense of those other things. Those are all good suggestions. I think from the perspective of newbies a lot of them (research/ctfs/open source dev) seem really intimidating and/or they might assume (rightly or wrongly) that they have a high barrier to entry. When you combine that with the tendency for a lot of security guys to be super shy introverts for a lot of us its a big deal to socialize or reach out to people for help. Having static, structured forms of training like books, certification programs, online courses, etc, can help people like this get started even if its not the most efficient way to learn. Getting just a little bit of experience can give the boost of confidence they need to start contributing socially. I guess my point is while I do agree that passion is usually the biggest indicator of success in this industry (and many others), I wouldn't be ready to rule out that a person has that passion just because they have a slow start, aren't confident and don't really know where to start or where to look.

tptacek 5y ago

If, for newcomers, there was literally nothing else you could do, short of obtaining a compatible bachelors degree (another form of certification), to prepare for entry into the field, then yes, it would be unhelpful and inaccurate to say that certification is entirely useless. But there are other things you can do, and so the effort involved in acquiring a certification --- even if an employer is paying for it --- has to be weighted against those other things. Research, open source development, writing, CTFs, keeping abreast of research, networking (even just "going to Defcon" --- and I don't like Defcon!), investing more time in researching career opportunities, bug bounties... these things all have a much higher payoff than certification does, and any time you spend pursuing a certification is coming at the expense of those other things. It's also letting you kid yourself about the work and whether it's a fit for what you want to be doing, because one thing you should notice about that random list of things I just generated is that it covers a lot of what infosec people actually do. A certification process provides structure and forcing functions and activation energy (for a dumb process that won't get you any meaningful advantage professionally). But if you can't generate that kind of activation energy yourself, in this climate, with this many available resources, with the kinds of career payoffs people are regularly obtaining, maybe this isn't really what you want to be doing?

chevill 5y ago
I agree that they are most effective for newcomers. I'd also agree that with few exceptions they aren't the most efficient learning process, but as a person that had the luxury of spending about $35k in leftover GI bill benefits on 6 SANS certifications I did get some value out of most of the classes, even when I was an intermediate DFIR analyst. They weren't life changing or anything, but some of them were useful. >these things all have a much higher payoff than certification does, and any time you spend pursuing a certification is coming at the expense of those other things. Those are all good suggestions. I think from the perspective of newbies a lot of them (research/ctfs/open source dev) seem really intimidating and/or they might assume (rightly or wrongly) that they have a high barrier to entry. When you combine that with the tendency for a lot of security guys to be super shy introverts for a lot of us its a big deal to socialize or reach out to people for help. Having static, structured forms of training like books, certification programs, online courses, etc, can help people like this get started even if its not the most efficient way to learn. Getting just a little bit of experience can give the boost of confidence they need to start contributing socially. I guess my point is while I do agree that passion is usually the biggest indicator of success in this industry (and many others), I wouldn't be ready to rule out that a person has that passion just because they have a slow start, aren't confident and don't really know where to start or where to look.