3 ms·

I take issue with part of this, as do many other actual technical security professionals. What is said: certifications like CISSP don’t represent the full spec

I take issue with part of this, as do many other actual technical security professionals. What is said: certifications like CISSP don’t represent the full spectrum of skills a professional needs therefore certifications are a waste of time. Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else. However, what does the ISC2 marketing material say? Let's take a peek! Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program. With a CISSP, you validate your expertise and become an (ISC)² member, unlocking a broad array of exclusive resources, educational tools, and peer-to-peer networking opportunities. Prove your skills, advance your career, help earn the salary you want and gain the support of a community of cybersecurity leaders here to support you throughout your career From https://www.isc2.org/Certifications/CISSP https://www.isc2.org/Certifications/CISSP So, basically, a nontechnical certification that is shallow and broad has managed to insinuate itself as the way towards being able to run a security program, and more valuable than any technical security degree, or a CS degree, or a PHD in Cryptography. It claims to be both for security pros with many years experience, but others say it is foundational material. This has then led to a negative cycle of incompotence, bringing in nontechnical types into a field that is uniquely demanding for broad technical skills normally gained through years in the trenches (SRE/development/administration/network engineering) Is there any wonder why we have a security problem?

Jotra7 5y ago
College cybersecurity programs are utter trash. CS programs do not address security properly. This is why we have problems. Passing the CISSP is a way better guage of general security knowledge than any college cyber degree.
yodelshady 5y ago
> It claims to be both for security pros with many years experience, but others say it is foundational material > Is there any wonder why we have a security problem? You're absolutely right, but it hurt to read. I know the management/technical divide has existed for a while, and yes, I know management sometimes has a point in stopping technicals focusing on irrelevant details. But... jesus. I'm currently tasked with evaluating "what an attacker could do" having compromised <X> on a <Y> system. No, I'm not allowed to evaluate a specific <X>'s likely vulnerability, or even an exact specification of <Y> - because that's losing the bigger picture. What do I even say?
- imwillofficial 5y ago
  Run for the fire exit
imwillofficial 5y ago
“But others say it is foundational material” CISSP requires 5 years of industry experience. Clearly not foundational. I pin it as intermediate. The EU agreed, ranking it equivalent to a masters degree. https://www.isc2.org/News-and-Events/Press-Room/Posts/2020/05/12/ISC2-CISSP-Certification-Now-Comparable-to-Masters-Degree-Standard https://www.isc2.org/News-and-Events/Press-Room/Posts/2020/0...
- ramimac 5y ago
  It's definitely true to say it is framed as foundational in some quarters, however. Consider the common "CISSP required" "entry level" roles that are regularly shared and pilloried Calling it equivalent to a masters was also a marketing coup, there was plenty of discussion and pushback on that characterization when it was announced
  - imwillofficial 5y ago
    Some claims are so wrong, they do not improve the discussion with their repeating. Like the moon being made of cheese. The CISSP, with it’s 5 year of experience requirement is not foundational, full stop. What some people attempt to lie about is irrelevant.

Jotra7 5y ago

College cybersecurity programs are utter trash. CS programs do not address security properly. This is why we have problems. Passing the CISSP is a way better guage of general security knowledge than any college cyber degree.

yodelshady 5y ago

> It claims to be both for security pros with many years experience, but others say it is foundational material > Is there any wonder why we have a security problem? You're absolutely right, but it hurt to read. I know the management/technical divide has existed for a while, and yes, I know management sometimes has a point in stopping technicals focusing on irrelevant details. But... jesus. I'm currently tasked with evaluating "what an attacker could do" having compromised <X> on a <Y> system. No, I'm not allowed to evaluate a specific <X>'s likely vulnerability, or even an exact specification of <Y> - because that's losing the bigger picture. What do I even say?

imwillofficial 5y ago
Run for the fire exit

imwillofficial 5y ago

“But others say it is foundational material” CISSP requires 5 years of industry experience. Clearly not foundational. I pin it as intermediate. The EU agreed, ranking it equivalent to a masters degree. https://www.isc2.org/News-and-Events/Press-Room/Posts/2020/05/12/ISC2-CISSP-Certification-Now-Comparable-to-Masters-Degree-Standard https://www.isc2.org/News-and-Events/Press-Room/Posts/2020/0...

ramimac 5y ago
It's definitely true to say it is framed as foundational in some quarters, however. Consider the common "CISSP required" "entry level" roles that are regularly shared and pilloried Calling it equivalent to a masters was also a marketing coup, there was plenty of discussion and pushback on that characterization when it was announced
- imwillofficial 5y ago
  Some claims are so wrong, they do not improve the discussion with their repeating. Like the moon being made of cheese. The CISSP, with it’s 5 year of experience requirement is not foundational, full stop. What some people attempt to lie about is irrelevant.