Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Certifications Are Causing More Harm Than Good

tacnetsol.com

Post reply on HN
Print view View original

91–100 of 224 posts

Re: Security Certifications Are Causing More Harm Than Good

#91

Post by SilasX »

homakov wrote: post #90
e79 wrote: post #68

The thing with infosec is that no matter if you're a consultant pen tester or an in-house member of a blue team, a high proficiency in technical writing is required. And few certs demonstrate that the person is a good technical writer. It's not enough to know the answers to multiple choice questions. It's not even enough to know how to exploit things. If you don't understand something well and can discuss it in techn…

Knowing basic English is a prerequisite to any tech job. There's nothing else you need to know to explain a bug. And there's TOEFL/IELTS if you're looking for English language certificate.

In theory, maybe, but there are many people who are fluent in basic English but who can't usefully communicate technical matters like bugs (except, perhaps, to someone who already looked at that specific problem with them).

Edit: And, in contrast, I've met people who I had a hard time communicating with in spoken English but, had no problems with once we did our communications in writing or with a written point of reference.

Re: Security Certifications Are Causing More Harm Than Good

#92

Post by leoscuro »

Articles like this one frustrate me.

I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume.

Right now, I am in a jr. sysadmin position making minimum wage, but I was selected for a SANS scholarship where they pay for your GSEC, GCIH, and one elective cert. My friend bought me a decent laptop, so I could experiment on virtual machines. Another registered me for the NCL so I could access their gyms to spread my legs a bit with more powerful tools. I READ SECURITY WHITEPAPERS FOR FUN NOW. I love trying to figure out how to best balance company workflow and security best practices.

I know at the end, that the three certs are not going to make me a SME, but at the very least I hope that this particular extra line on my resume can help get my foot in the door somewhere I can be mentored and develop my base. A salary that can actually pay my bills would be nice too.

Then I read articles like this, and wonder if I'm going to be sidelined again. I feel like at that point, my life is worthless.

Re: Security Certifications Are Causing More Harm Than Good

#93

Post by ABCLAW »

logfromblammo wrote: post #50
sathackr wrote: post #12

I was involved once in a criminal forensics case. The defense's "expert" witness was a one man computer shop. He had created his own "certifications" and listed them on his resumé as indications to the court of his suitability as a witness. It was literally "person's-company-name Certified Forensic Examiner". He had created about 6 certifications, all of which he held. It's kinda funny, but also kinda scary that the…

So he got the court to accept a self-signed cert as a trusted root. I don't see how that's much different than asking someone to solemnly swear they are telling the truth, when most humans are as capable as lying about whether or not they are truthful as they are of lying about anything else. If the court has no one capable of gauging the expertise of a witness, it has to trust in someone to do that for them, and if…

The court has plenty of people capable of gauging the expertise of the witness, just not at that level. Impeaching credibility is not the job of the court - it is the job of the opposing party.

If the other side of the case had an expert that didn't bring up the lack of credentials, or the litigators on the file didn't bother to do the most cursory of credibility impeachments, that's on them.

Re: Security Certifications Are Causing More Harm Than Good

#95

Post by unethical_ban »

I find value in the SANS courses I've taken. Not hat the certs mean too much, since the tests are pretty easy... but the concepts, common jargon and best-practices discussions that take place can be useful.

It's kind of like college. It's about what you get out of it. From a hiring perspective, though - if a course provides utility, perhaps if one of the interviewers also has taken the cert course, they can probe the candidate more thoroughly on their knowledge from the course.

Re: Security Certifications Are Causing More Harm Than Good

#97

Post by harperlee »

phonon wrote: post #22
strictnein wrote: post #15

> "Recruiter Thomas Ptacek, whose Chicago-based agency Starfighter specializes in recruiting security folk" NET::ERR_CERT_DATE_INVALID Subject: www.starfighters.io Issuer: Go Daddy Secure Certificate Authority - G2 Expires on: Nov 13, 2016 Current date: Apr 12, 2017 Is there some infosec version of Muphry's law?

Starfighter is defunct. https://twitter.com/tqbf/status/771533037666390017

Was there ever a post detailing why? I searched for it several times but found nothing...

Re: Security Certifications Are Causing More Harm Than Good

#98

Post by MichaelRenor »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

Don't fret. The author is correct, but it's mostly true for the upper ladder of the skilled workforce. I would chuckle if I saw a senior engineer list certifications on their resume (apart from maybe advanced CCNA/NP/IE cert for a networking specific role).

At that point in your career your experience and knowledge will show for itself, and you won't be proving anything with paper.

Right now, however, it's vital you get your foot in the door. You don't have much experience yet, so a cert shows you're eager and at least not totally clueless. The jobs that care about your certs will probably not be very good, but it's a stepping stone if you're ambitious.

Re: Security Certifications Are Causing More Harm Than Good

#99

Post by Sancty »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

To be honest, I think your original gut feeling is correct. Keep doing what you're doing. Especially for small companies, the hiring process is about finding someone who can adapt and push themselves. Seeing that you experimented and pursued formal certification means that your teachable and ambitions.

Re: Security Certifications Are Causing More Harm Than Good

#100

Post by endorphone »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

This article is talking from the perspective of getting hired by so-called "elite" security firms. That comprises a tiny percentage of the roles you might possibly seek in the future, and shouldn't taint your pursuit. Many employers who are trying to staff some sort of internal security competency will regard it very well -- there's a reason they appear in countless job listing -- as a sign of both focus and interest.
Post reply on HN