Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Certifications Are Causing More Harm Than Good

tacnetsol.com

Post reply on HN
Print view View original

61–70 of 224 posts

Re: Security Certifications Are Causing More Harm Than Good

#61

Post by cmdrfred »

lawnchair_larry wrote: post #41
cmdrfred wrote: post #3

I feel this way about certifications in general. I work with tons of Microsoft and Cisco certified people and the basic computer science errors they make has be doubting the value of those certifications.

Why would cisco people need to know CS? Different fields.

I mean simple mistakes, like not understanding that information on an air gapped machine is unknowable to another machine on the network.

"If you took the tax id and social from 'airGappedMachine'"

"It has no connection to any other machine"

"Just query the database"

"Store it on a thumbdrive and walk it over? It changes quite often I don't think that's a good workflow"

"No, just query it"

"How?"

"SQL!"

Or the classic:

"That password only has N characters, I can crack that in Y seconds"

"You are the Administrator of that box, you can simply reset the password and do whatever you like."

"Yeah but the hackers.... Y seconds"

"It's not Y seconds for them, if they already are an Administrator or have read database access it's game over anyway they have to use the API and that locks you out after 3 attempts. Also your are assuming a much easier hashing method than is actually in use."

"Yeah but my calculator says Y seconds so it's Y seconds"

Re: Security Certifications Are Causing More Harm Than Good

#63

Post by amckenna »

lawnchair_larry wrote: post #39
mi100hael wrote: post #24

From most people I talk to, the exception is the OSCP since it requires you to actually pop real, live boxes. Anyone holding that cert has actually exploited a buffer overflow, escalated privileges, etc. CEH, CISSP, etc are just too theoretical with no hands-on requirements.

It's a joke as well, and it just means the holder could copy and paste an XP-era exploit, which has roughly no relevance today.

Don't know if you have taken it in the last year or so since they updated it, but it's pretty tough. You may be able to use a public exploit to elevate your shell once on a box, but getting code execution was the difficult part. One of the challenges involved fuzzing, writing custom buffer overflow exploits, and dealing with weird stack pivots. That only got me about 20% of the way to passing the test. All in 24hrs. My girlfriend was taking the GPEN at the same time. While I was banging my head against a debugger she was making flash cards. I think that highlighted the difference between the certs.

Re: Security Certifications Are Causing More Harm Than Good

#64

Post by raesene6 »

tptacek wrote: post #57
raesene6 wrote: post #55

Earlier quoted context omitted.

So how would you approach scaling the IT Security industry without some form of industry certification process? I'm definitely not trying to defend the CISSP/CEH style certs here but I don't see how you reliably expand the industry at scale without some form of certification process. A company hiring it's first security person or a company trying to hire a lot of security people, need some form of base benchmark to w…

What does "certification" have to do with scaling the industry? Training and nurturing talent is a hard problem, but expensive tests don't do anything to mitigate that problem.

Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation.

For example Certified accountants, Lawyers etc.

Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting bad people?

Also the article's argument that "it's experience that counts" really doesn't help get new people into the industry, where do they get the experience in the first place, it's a catch-22

Re: Security Certifications Are Causing More Harm Than Good

#65

Post by raesene6 »

tptacek wrote: post #58
raesene6 wrote: post #48

I'm going to partially disagree with the article. the problem with the approach of "just learn to be a good security person" is that it doesn't scale. Sure back when I, and a lot of other people who are a bit older, learned security that was the only option, there weren't structured courses and certifications. However when we're working at scale, certifications can be useful as providing a demonstration that the hold…

You're presenting a false dichotomy. The choice isn't between "security certification" and "people learning on their own".

the original article, I felt, made that point. It provided several examples of people learning on their own and provided those as an argument for why certifications were unecessary.

So not my dichotomy.

Re: Security Certifications Are Causing More Harm Than Good

#66

Post by devnullmonkey »

raesene6 wrote: post #55
lawnchair_larry wrote: post #43

Earlier quoted context omitted.

Nope, it is in fact the certifications. Strongly agree with the tptacek quote here.

So how would you approach scaling the IT Security industry without some form of industry certification process? I'm definitely not trying to defend the CISSP/CEH style certs here but I don't see how you reliably expand the industry at scale without some form of certification process. A company hiring it's first security person or a company trying to hire a lot of security people, need some form of base benchmark to w…

The problem is one of trust, methinks. Most certs require only that you "know" the material well enough to pass a test that uses your memory. If the tests were empirical, say like the Red Hat tests or the Cisco CCIE, then the trust that someone actually has skills might be more believable.

Having worked in IT security for many years, I can attest to the fact that IT security is more of a subjective set of processes rather than a specifc product or set of products.

There are skills involved as far as tools and knowledge of how to use tools, but these change depending on the use case.

Re: Security Certifications Are Causing More Harm Than Good

#67

Post by raesene6 »

zeta0134 wrote: post #56
raesene6 wrote: post #48

I'm going to partially disagree with the article. the problem with the approach of "just learn to be a good security person" is that it doesn't scale. Sure back when I, and a lot of other people who are a bit older, learned security that was the only option, there weren't structured courses and certifications. However when we're working at scale, certifications can be useful as providing a demonstration that the hold…

The only certifications I've picked up so far along my industry journey (I have no college degree and don't plan to get one, so these are necessary) are the Redhat RCSA and RHCE. Both of these certs can't be solved with rote memorization, and required me to log into a virtual machine and solve problems in a live environment, running through a plethora of common systems administration tasks that were then graded by ho…

some are bad certs (rote learning, multiple choice), others are not (they have good practical elements).

One problem is that some of the "bad certs" e.g. CEH, CISSP , are well established.

My feeling is that the answer isn't "don't have certs" but "have better certs"

Re: Security Certifications Are Causing More Harm Than Good

#68

Post by e79 »

The thing with infosec is that no matter if you're a consultant pen tester or an in-house member of a blue team, a high proficiency in technical writing is required. And few certs demonstrate that the person is a good technical writer. It's not enough to know the answers to multiple choice questions. It's not even enough to know how to exploit things. If you don't understand something well and can discuss it in technical detail to a number of different audiences, I don't believe you'll get very far in the industry.

There are a couple of exceptions, of course. OSCP is a good certificate to have. To pass the exam, you are required to not only demonstrate proficiency in several areas (i.e SQL injection, buffer overflows), but you must also write and submit a technical report to a review team. The technical report must address vulnerability overview, impact, risk rating, reproduction steps, and more. Of course the exam isn't perfect, but it's probably the biggest test of real technical understanding and ability I've ever seen.

Re: Security Certifications Are Causing More Harm Than Good

#69

Post by balabaster »

pmichaud wrote: post #51
orev wrote: post #13

There is a huge problem in IT. It's not certifications. It's the totally illogical bias against certifications. There's no reason someone can't have both skills and certifications, but everyone treats them as mutually exclusive. Certs help with administrative things like HR requirements, contractual obligations, audits, etc... No, those things do not make one secure, but running a business is not only about being sec…

> There's no reason someone can't have both skills and certifications Of course you're right that it's not impossible. But here's why it happens anyway and why the heuristic of them being roughly mutually exclusive is not insane: 1. There's a certification that's nearly meaningless because it's so easy to obtain without also having the relevant expertise that the certificate is supposed to represent. 2. People who ar…

Additionally technical certificates supposedly measure competency in a particular technology. That technology is obsolete roughly at the time you're sitting to write the exam. So you've spent time learning material (assuming you didn't already know it) to cover a technology that will be in the process of being replaced as you sit down to write the exam. You may as well have spent the time using the skills productively rather than using it to obtain a piece of paper that says your skills are obsolete...

Plus there's the financial outlay of it; costs to obtain the course material and sit the exam.

These points (including yours) basically amount to my bias against obtaining certificates.

I'm not against the material itself, if it's useful. But I'm not in the habit of paying for or spending time on education for anything other than the value of my interest in the material. A piece of obsolete paper does nothing for me at this point in my career.

YMMV

Post reply on HN