Security Certifications Are Causing More Harm Than Good

I'd venture to say most certifications in general are junk, CYA processes. If you are basing your hiring decision on the letters someone puts after their name, you're doing it wrong.

The same could probably be said for a degree, particularly with the current snowflake "everyone must pass" mentality at so many schools.

Certifications and degrees are nice, but neither guarantees a person is competent in any field.

I think soon that this sentiment will start to apply to Universities. It seems inevitable at some point in the near future there will be an online 'university' (for lack of a better word) who's graduates will be considered equal or even better than a standard university education, particularly for tech related degrees.

Universities have been a centralized source of accreditation for a long time. All it takes is for someone to figure out how to restrict graduation and filter good candidates using testing or some other means to gain accreditation and acceptance of its graduates by industry.

There's 'compliance security' and then there's 'street-smart security'. They are very different things.

Most organizations aim for compliance (it's cheap and easy). They base security on contracts, certs and insurance policies.

Street-smart security practitioners are appalled by this. And, management doesn't understand why the 'security people' aren't on-board with 'compliance'.

It's a lot like the old west with Cowboys and Indians. Two totally different world views.

It doesn't seem like the certs themselves are causing more harm than good, it seems like the lack of evaluation employers do for potential employees is the real issue. Giving too much credence to essentially any degree is problematic, I don't think security certs are exceptional, in this case.