CISSP: the new MCSE??

Ok.. as I was preparing my CISSP Notes Tutorial, I was talking to TheHorse13 on IRC about it and whether it would be useful. While only a few would be interested (which is fine), we did get into a discussion that the CISSP may be heading the same direction as MCSE (NT) was/is (I don't know if the MCSE 2000/2003 is the same).

Basically, everyone and their brother is getting the CISSP. Even with recent changes -- requiring 4 years experience or 3 years and a bachelor degree plus sponsoring by another CISSP or company sponsoring plus audit to prove your experience -- it has become the degree of choice. Looking at the Certification wall of a bookstore that seems evident. The number of books for the CISSP is growing.

I would definately say that the CCNA is already at the status or near the status that the MCSE NT was about 4 years ago.

What do the rest of you think??

Your right, Cissp is becoming a popular cert to get, as it's the only thing to distinguish yourself between a million and one MCSE paper techs running around. I'm even working to get this cert, only because I know I'll be a hell of alot more marketable on the job market and because I know, currently the people holding the cert are an elite few, who have actuall proven skill, not just able to cram for an exam.


--PuRe

It is far more popular than it should be, and I don't think peoples expectations for what a cissp can do are getting set appropriately.

Quote:

---

I would definately say that the CCNA is already at the status or near the status that the MCSE NT was about 4 years ago.

---

I think that CCNA is prolly beyond that. With at least 1 high school in every city in Ontario offering it, as well as almost every college having it incorporated into their networking programs. I'm guessing the rest of the world is the same way, considering the quotes they've released on the number of students enrolled in the Cisco Networking Academy. In October 2001, they relased the numbers of 8348 Academy's in 133 countries, with over 225,000 students. It's a two year program in most places, which means even if a quarter of those people get their cert, the first year of the program was 1997 and the first group of grads would have been 1999, they've put out over 200,000 certified people. If highs closer to half the people get their certification then you're looking at over 400,000 certified people. This doesn't include people getting it on their own, or in the boot camps. I guess I never really had any first hand experience with the MCSE NT crazy but I know know of the schools around where I'm from offered it like they are with the CCNA.

I am not as enchanted by the CISSP as everyone else. I am turned off by the $450 exam fee and the mention of "annual maintance fees" for having the certification. Plus, the Endorsement? I need an endorsement for the privledge of spending $450 for a cert I can never pay off? No thanks.
I see the cert & the program as an attempt to create a "Information Technology Industry Union" of sorts. I doubt it will ever get that far, by that is what it looks like to me the INC. that created this cert is aiming for.

The CISSP cert is what my profs are pushing me towards right now. I am getting the impression that it is simply the trend right now, just like Network+, A+, Security+, and an entire army of certifications has been. The only difference I can see with the CISSP is that it's a lot harder to obtaion, and fortunately, employers know this. My only concern is that it will become too common and will at that point cease to be a selling point, merely a necessity like CCNA. I'm glad I've got a couple more years to figure it out.

And yes, the price is outrageous. It cannot possibly be worth $450 of anybody's time to grade the paper, although it does take 6 hours. That means I'm paying someone $75 an hour to grade the paper. It seems to me like this certification is intended to generate revenue, and not to actually certify people.

It is more than just the $450 for the test, but an annual fee of $85 IIRC. Plus, you are required to sit for the test again every three years to maintain your certification. If you take the exam and pass it, but don't make the cut on the audit, you do not get to claim any standing based on the exam.

Striek: I hope your professors understand that students very likely will not be able to walk out of a technical program and successfully test for the CISSP without considerable experience behind them, support of an employer or other CISSP. From what I've seen of the requirements for the professional audit, an applicant will have to produce a lot of material to demonstrate adequate experience in all ten domains. A one-page resume won't cut it.

No, the price is not outrageous. Seems fair. We are talking a professional certification that one earns with experience and study. I think the process as it is set up should prevent the "paper MCSE" syndrome and insure the certification maintains a professional level standing and industry respect.

Combine the $450, plus annual $85, plus annual IEEE membership, and you have some significant pro certification, networking and industry support (online training and journals). I recommend Security & Privacy.

So far, the material I've covered in texts and references have more to do with higher level IT security roles. This isn't Security+ or SSCP for a network or system security tech, the CISSP is a corporate IT security officer certification.

As a side note, the fee goes from $450 to $499 starting Jan 1. And there are new variations to it.

Quote:

---

I think the process as it is set up should prevent the "paper MCSE" syndrome and insure the certification maintains a professional level standing and industry respect.

---

Yes and no. Now you just need 3-4 years experience as an administrator, not necessary specifically directed towards security administrator (one would assume that one would have security on the mind as an admin but I think we know that this isn't always the case). I think this is the biggest concern I would have in regards to it becoming the "next MCSE".

In addition, there has been a mini-explosion of "boot camps" and such. Granted, I've seen more for the likes of MCSE 2000, CCNA, etc.

Out of curiosity, what would people think the next cert would be worthwhile: GIAC?

For giggles I will probably do Security+ (mostly so I can tell students what to expect if they decide to do it). But once I get CISSP out of the way, I was thinking of doing something else (just to keep busy.. :).. )

Quote:

---

corporate IT security officer

---

Whoa, I cringed when I read that phrase.... :eek:

The GIAC certs are worth it in my opinion. You can't really just bootcamp through it since each GIAC cert requires you to write a 20+ page paper on a related subject that demonstrates your understanding and that has NOT been done before. Others also require more interaction such as the firewalling cert where you have to analyze another students plan to look for holes or the intrusion detection cert where you have to analyze some actual logs of traffic.

I've just finished the GCIH (incident handling training) and have to do a nice 20+ page writeup on an attack (again, one that no one has written up before), what it is, how it works, and the incident handling process from start to finish...then i get to take my two tests.

And if you want to go after the GIAC GSE god cert...you have to get certified in 5 of their tracks and get honors in at least 1.

The GIAC GSE god cert kicks butt, but its expensive..as you said, you need to get at least 5 other cert's first. Kinda like going after a CCIE. But personally, I think the gsec certs are much better then the CISSP. What people don't seem to understand (especially human resources people, but they don't understand much) is that CISSP is more based on theory, while the GSEC certs are very specialized. If someone has a GCIH, you know that they have training and experience in Incident Responce. It doesn't mean you hire them to set up a firewall. If someone has a CISSP, then you know that they have trainging in the theorys of security, but have no idea what they can actually do.

Well, there was recently a decent sized thread on the sec focus lists about this and it was basically laid down that the cissp is security from a management 1000 mile wide/1 inch deep perspective. The GIAC certs are actual hands on technical certifications for the most part. There is alot of bitching about everyone requiring cissp even though what they actually need is someone with the hands on technical knowledge.

Quote:

---

There is alot of bitching about everyone requiring cissp even though what they actually need is someone with the hands on technical knowledge.

---

That would suggest to me that HR/Management doesn't understand what a CISSP is..

HR/Management doesn't understand what a computer is most of the time

Haha, indeed. From what I can gather from various sources there is indeed alot of misunderstanding as to what having the cissp credentials actually means and alot of hype involved in getting them. I hear the commercials for local training institutions that are no longer plugging higher paying jobs from just being a tech monkey, now it is all about becoming a cissp certified security professional and so on to get the fat pay.

Companies are finally understanding the necessity of security. They just don't know where to look to find sometone that knows anything about secuirty, so they grab the closest CISSP because they at least have a general idea and you can hire 1 person to do 12 jobs (so they think) as apposed to getting people with gsec that are specialized in one or two things. The gsec person probably has most of the same knowledge as a CISSP but because they are specialized, they are overlooked by HR.

Well...nowadays the GSEC includes the cissp cbk so they should have at least a good portion of the same knowledge.

Quote:

---

Originally posted here by souleman
HR/Management doesn't understand what a computer is most of the time

---

Thats a fact!
to most HR dept's, certs are "trendy" usally the company with the best marketing stategy that targets HR dept's with there "look for applicants with our xxx certificate, they are REAL IT proffessionals" propaganda, is the one the HR people will *think* is the prestigous one.

In one of my old jobs, I had a HR rep that will call me for advice about what certifications to look for on a resume, I generally told him not to look so much at certification, but look more at applicable experience (ironic I had to tell this to HR person,ah?)

Quote:

---

In one of my old jobs, I had a HR rep that will call me for advice about what certifications to look for on a resume, I generally told him not to look so much at certification, but look more at applicable experience (ironic I had to tell this to HR person,ah?)

---

Not really IMHO. They are involved in HR. They go with what they know and understand. When we say experience that can mean many things in computers (networks, security, programming, specific areas like Lotus Notes, Web Devel, etc.). If they look for certs, they can weed through things faster (I don't doubt that HR gets tonnes of resumes to sift through, many of them in less-than-stellar state). I think I would want to specialize in IDS stuff for the GSEC as I happen to enjoy the challenge of IDS, Honeypots and packet sniffing (and looking at all them logs!!) :D



That all said, to me it sounds worthwhile to get both: CISSP for the managerial point of view and GSEC for the technical point of view.

Part of the mission of my organization is to place people in jobs...... You have no idea how many times I get the resumes of people that have DOS, MCSE, MVS or some other acronym on their resume with the question from the placement "specialist".... "What does this mean and can they fulfil the parameters of this job description......."

On rare occasions I get to hire someone for my department..... HR is not even allowed to screen the resumes.... I do it..... It means that I spend a week reading 200+ resumes - but I end up getting what I want.... And I have seen _so_ many _paper_ "tigers". I am utterly unimpressed by the paperwork anyone brings to the table..... Depending upon the position they are looking for with me there are a series of questions they get asked that elevate their requirement for knowledge in the position I am hiring for.... The higher you go... the better chance of employment with me...... And I give you this $h1T from a position that has not a single piece of paper to back up it's level of skill......

Paperwork is all very well...... It is a good determination for those that don't know what they want/need to decide upon an employee...... But when an employer has a person that _knows_ what is needed and can't be BS'ed then it is still the survival of the fittest for those that apply...... It's easy to go into an exam situation..... The question is can you manage the exam at the _same_ time Martha in Accounting can't send her attachment to her Accounts Receivable that is imperative to get done _today_ and Montgomery in Sales can't hear the music CD he placed in the CD-ROM.....

That's the real test........

Arguments against my position on this freely accepted...... ;)

Using a certification as your sole means of judging someone is a poor way of assessing candidates. I think most good HR people know that now. There were way to many people who had MCSE's that couldn't do the job. I have done quit a bit of interviewing, from the hiring side, and I was constantly amazed at the people we would see applying for a high level admin job. If you notice, people that are hiring now do not push so hard for MCSE's anymore. I think more than anything, the people who like it are sales people for VAR type businesses. They basically get to say, look at the certs that our consultants have, blah blah blah... Getting certified can be a very very good thing. But if you think you know something just because you have a cert, with 0 experience. You should think again. That's not directed at anybody in particular, just that if you are new to the IT game, and you think a cert will be the answer to everything, you are mistaken.

Also. From what research I have done into CISSP, it is mostly about definitions and technology, with a lot of encryption. It doesn't get into the nitty gritty of vulnerability testing, or the how-to when configuring routers or firewalls. It is just more of know that a firewall does this function. An IDS does this function.

I strongly believe that the most useful and most accurate certification available know is the Cisco CIE.

MsMittens > I think you should look more into the GCIA (Intrusion Analyst) and GCIH (Incident Handler) for what you like. The GSEC itself is their basic intro cert that also includes the cissp cbk. Tho it touches on Intrusion Detection and packet sniffing it doesn't get too much depth. The GCIA training however gets down and dirty with what you love most with the most basic tools to make sure you know what you're doing before you get a pretty user interfaced tool that does most of the work for you.

Quote:

---

Quote:

---

corporate IT security officer

---

Whoa, I cringed when I read that phrase....

---

Yes, well, cringe away. I just finished six+ months of generating security policy, standards and guidelines (which, it turns out, I'm not authorized to write-but that's another story) for our first-ever audit. My primary references were the CISSP texts. It ain't easy to write this stuff for a state agency that hasn't been in business very long, no organizational history or documentation to draw on.

Comments on HR: Yeah, I have to agree with those who feel that HR still doesn't have a clue. We have moved so far beyond what HR can understand. Everything they know about technology or security they get from their HR cronie meetings. Ask them to trust their local techs or IT experts? Yer dreamin'!

Juridian is right, the CISSP does cover a broad sweep, and not too technically deep. I think that was the intent. As a sys admin, I don't want a corporate sec off messing with my systems. But, a CSO, needs to take a larger view of the issues, provide policy, guidance and direction--and be able to bring the physical plant, HR and administrative into step for IT security.

As for hiring, our IT has a defining role in the defining and selection of new full-time staff. I lead the committees that hired my boss, and one of my co-workers. That is about the only way to make it work. You cannot afford to turn that over to HR alone.

BTW, on our security audit -- we only had one exception and are "in compliance!" Woohoo!

Thanks, also, for the information on the GCIA certs. I've bookmarked their web site and will study these carefully.

All these new things ... no time to play with 'em all!

Certifications serve only as a "measuring stick" to HR and non technical managers/employers when hiring employees.....

It in no way measures,,,,in my opinion,,,,a person's true technical abilities or lack of....

When deciding to aquire a particular certification, base it purely on popularity level or what the current "defacto standard is" among employers/HR/etc.....it translates basically to $$$$$

With that said,,,,the CISSP has been for the last 5 yrs and still is a very popular certification to have.....



Just my opinion

cheers.....

P.S.
I strongly recommend for anyone looking for a career as a security professional to find a way if possible to get a "security clearance",,,,,it is going to be in my opinion one of the major factors that is going to separate you from the so many others entering the security industry.
( need company to sponsor you,,,not an easy process....not any company can sponsor,,,)

I was told by someone i should go for my cissp and giac exam.How hard are the exam?

Quote:

---

Companies are finally understanding the necessity of security.

---

i think its great this is finally starting to come back and bite most companies. hiring someone who only knows what a network is by a microsoft diagram is just begging to get your ass handed to you. if a piece of equipment doesn't cost $500 in licencing, then how can it possible be good?

i recently went through a mcse bootcamp to get my mcse. there were 11 of us in the class, 2 people had their mcse under nt. neither of them successfully obtained the newer cert, and both of them were confused by anything that wasn't made by ms (what is a router? cat5?) it was very sad, actually.

I remember when the explosion of the A+, MCSE, and others occured. Every HR department in town fielded resumes strictly based on what certifications were on any given one. Forget the experience, forget what they have put down as fields of knowledge, all that was out the door. I can't tell you how many good people were tossed by the wayside because they didn't have the glorious MCSE stamped on their resume and how some straight-out-of-college MCSE-wearing guy got the job making 60k a year with no experience. Saw a lot of that during the internet boom as well. Then things went straight to #*@! when they couldn't get a server back up or troubleshoot network problems, etc...because it wasn't taught in their 2 week crash course.

Certifications, while a nice thing to have, really don't apply IMHO. I'm a unix administrator and I was going for my HPUX 11i certification. Got through the first two classes (at $2500 apiece) and was about to start my third so I could take the $300 test when I realized something. After taking the test, I'd have to pay a yearly fee to maintain the certification. Not a problem there, but what if I moved jobs and I wasn't in an HP shop? Hence, I never got it.

Good to have, pretty on a wall, but I'll take experience anyday. Nowadays, any good IT professional who has 5 years or more of solid experience has all-around "jack of all trades" experience and combined with a few more like that, any problem can be solved.

At the moment I am going to school and have done and er working on the following certs.

A+ (hardware done, software exam very shortly)
MS course 2152C (implementing 2000 server and pro)
CCNA (first semester done. Got it like a week ago it still on my desk :D)

CCNA is great if you ask me. I like it the most of what i'm doing. Going through this really learns you something.

A+ was boring. I don't like cramming my brain full of tables like what IRQ belongs to what device. I don't think that it's useless but i won't be using it a lot.

MCSA sucks. Don't know whats so good about it, it guides you throug menu's and wizards but it doesnt really build knolidge about what you are doing yust how to do it.



I think(don't have any RL experience though) that some certs are more usfull then others. And that they CAN give you some information on an applicants possibilyties when backed up with experience.

Hey everyone...

CERTS help to keep your resume or proposal in the review pile instead of the trash.
I have seen it over and over again.

I think a few have hit on what I feel is a very important aspect of holding certifications.

...MARKETING...

I feel they hold great value with respect to answering Government RFPs in particular.

Most certs are virtually worthless standing on thier own, but when used in conjunction with personal experience or the combined experience of a group, they hold much greater value.

Also, the CERT market charges what the collective we are seemingly willing to pay.

Almost everyone I interview for a position with us will admit when pressed if they got a particular cert hoping to avold the low paying start at the bottom work that builds RL experiance in the first place.

Many seem to have forgotten balance...