What's the right IT/Information Security Certification for me?

In one of our previous article we already discussed what an Information Security degree would bring you; now, let’s tackle this tricky question:  “What security certification should I pursue?”

Throughout my career, I constantly heard a ready-made answer:  CISSP! (even though the person was not able to tell what CISSP stands for). Try it yourself: Whenever you have a chance, ask your workmates the very same question. I bet someone will mention it before you finish the sentence. It’s a kind of wildcard answer: Security? No matter what area/position the person works for, say CISSP and you’ll be alright.

But is that the definitive answer for this question?

First, let me clarify something: While getting a security certification is not absolutely essential to apply for an IT/information security job, an increasing number of companies are requiring that applicants be certified. The algorithm is simple:

Efficient (for the recruiter)? Apparently yes.

Accurate? Unlikely, but that’s the reality out there; having some certifications is a matter of survivability in the field, either we like it or not.

Having a security certification also ensures that you will enjoy a higher salary compared to co-workers who are not certified, as per countless market researches. Thus, becoming a certified professional undoubtedly gives you an edge in your IT/information security career. The problem is that certification has become big business and the number of possible security certificates you can earn has grown.

So let me use an analogy one of my bosses used to tell me. Imagine the following scenario: You’re working at a construction site, demolishing a wall, and a pile of debris needs to be taken away. Will you use a Lamborghini, one of the fastest cars ever built, but with a trunk that barely accommodates a suitcase? I highly doubt it… I know the example might sound cliché, but that’s how I see this certification thing. Tell me what you intend to achieve, and I tell you what Information/IT certification is the best for you. So let’s dig a bit further…

When picking where to start with your security certification path, ask yourself a couple of questions first:

Am I a techie or a management professional?

Answering this question helps you deciding to go either for a vendor-specific certification or a vendor-neutral one. Think with me: if you work as a firewall administrator (and you plan to keep doing so for a while), pursuing CISSP without being, let’s say, CCSA, is not the best way to go. Conversely, if your deal is to develop and implement your company’s ISMS, achieving a CCSP won’t be of much help. It goes without saying that getting Y-certified (I just coined this term : means achieving both managerial and technical certifications, rooting from the same field) will certainly broaden your field of sight, but the benefits might not be readily perceived.

Pages: 1 2