IT Workplace
Managed Services & Outsourcing
Reports and Whitepapers
News for CIOs
CIO Census
Digital Security Zone
Webinar Highlight Reports
Roundtable Highlight Reports
2020 IT Salary Calculator
AI Directory
ITWC Talks
Featured Partner Content Hubs
CANADA'S TOP WOMEN IN CYBERSECURITY
MapleSEC
All IT World Canada Events
President to President
All Tech Videos
Cyber Security Today
#Hashtag Trending
CMO Talks
ITWC Podcast Network
Blogger Opportunities
Gartner Corner
Technicity WEST
OUCH! Free Content gets hurt by enabled Ad Blockers
Please consider unblocking us or Subscribe in support of our great non-gated content.
Leadership Privacy & Security
What is cyber security certification worth?
CIO Association of Canada
@https://twitter.com/CIO_CAN
Published: October 22nd, 2017
Steve Biswanger
There have been a lot of interesting reactions to the Equifax data breach. One of the most interesting for me is the criticism of the Equifax CISO's lack of technical or cyber security education. She does have Bachelor's and Master's degrees in music composition as well as a resume that shows a work history at several companies also in the finance industry. This situation illustrates the challenge we all face in identifying qualified candidates.
It is only recently that Information Security degrees have become available from universities. Most people rely on "certifications" to vet qualified candidates. The Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified in Risk and Information Systems Control (CRISC) and Certified Information Security Manager (CISM) certifications are common in cyber Security job descriptions. But what is the true value of such certifications?
Certifications are issued by for-profit companies whose business model is to generate revenue by issuing certificates. On the one hand, they need to ensure a minimum "quality" of their certification holders so potential customers value the brand and are willing to pay the certification fees. On the other hand, they are encouraged to sign up as many customers as possible so the "quality bar" cannot be set too high. Once a certification brand is valued enough, there develops an education system to assist candidates to achieve the certification. You will often see "Boot Camps" that promise to fill your mind with all of the knowledge to pass the certification exam in one week. I think we can all agree that one week is insufficient to develop competency in any discipline.
So is there any value to an Information Security certification? Let's consider three:
The certification gets you to the short list. Many automated recruiting systems will filter candidates based on pre-defined keywords. Often these keywords include certifications and education. You may have all of the necessary skills to excel at the role and never get an opportunity to interview if you can't pass the initial screening process.
A certification is a quick way to fill gaps in an employee's skill set. There is a lot of benefit in hiring "non-traditional" employees for Cyber Security positions. Someone with in-depth knowledge of the business function, rare technical skills, or a unique blend of technical and "people" skills can be very valuable for cross-functional teams. Certifications provide a structured way for these individuals to learn a common nomenclature and Cyber Security processes and frameworks in a relatively short time.
Certifications can indicate strengths or passion. The certifications listed above all focus on different priorities. The GIAC is considered a more technical certification, while the CISM is intended for leaders of Cyber Security teams. It is difficult to determine an individual's career aspirations or skills based solely on former job titles. But someone who has been an Information Security Analyst for the past three roles and has a CRISC certification is probably stronger at governance and risk assessment and less likely to be enthusiastic about a technical role.
Cyber security is still a young and informally defined discipline. Roles and job descriptions are inconsistent, as are the education and certification opportunities. The breadth of skills required in cyber security means that almost any relevant background can be beneficial, and with the shortage of qualified talent, we are forced to be flexible, creative, and willing to develop our staff. Certifications have some value, but you must recognize their relative strengths and shortcomings.
Steve Biswanger is Director of Information Security at Encana Corporation and is the first President of the new CISO Division, CIO Association of Canada. On Twitter at https://twitter.com/itsabouttrust. This is the third of five blogs marking Cyber Security Awareness Month.
Would you recommend this article?
Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication. Click this link to send me a note →
Jim Love, Chief Content Officer, IT World Canada
Leadership, Privacy & Security certifications, CIOCAN, Cyber Security
From bots and AI to counterfeit reality and fake news, Gartner's top predictions for 2018
The Business Leadership Podcast: Mark Cohon, Chairman at Global Toronto
About CIO Association of Canada
CIOCAN is a not-for-profit community of CIOs and IT leaders whose mission is to facilitate networking, sharing of best practices and executive development, and to collaborate on issues facing CIOs/IT Executives.
Follow Follow @https://twitter.com/CIO_CAN on Twitter Join CIO Association of Canada on LinkedIn Website
Stronger cybersecurity starts with one word: agility
CIOCAN announces 2020 Impact Award winners
Russia-linked hacker group targets COVID-19 vaccine development efforts
It's time to survey the landscape of the new normal
Tweets by itworldca
Resources CanadianCIO Digital Security CMO Digital CDN Magazine IT Salary Calculator LightningPR Webinars and Events Tech Research Partner Content
IT World Canada Community About Us Contact Us Technology Videos IT News IT Blogs Mobility News Cloud Computing Technology Topics ITWC Talks
ITWC Websites ITWC.ca Channel Daily News.com IT World Canada.com IT Business.ca Direction Informatique.com
© 2021 IT World Canada