Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Certifications Are Causing More Harm Than Good

tacnetsol.com

Post reply on HN
Print view View original

101–110 of 224 posts

Re: Security Certifications Are Causing More Harm Than Good

#101

Post by cortesoft »

MichaelRenor wrote: post #98
leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

Don't fret. The author is correct, but it's mostly true for the upper ladder of the skilled workforce. I would chuckle if I saw a senior engineer list certifications on their resume (apart from maybe advanced CCNA/NP/IE cert for a networking specific role). At that point in your career your experience and knowledge will show for itself, and you won't be proving anything with paper. Right now, however, it's vital you…

This is exactly true for all non-work related qualifications (schooling, degrees, certification, etc)... they matter when you are first getting into the industry, and for your first job or two.

Once you get established, no one looks at those things.

Re: Security Certifications Are Causing More Harm Than Good

#102

Post by sputknick »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

I think you are doing it right. I'm also a veteran, I had no idea about certifications until I got out. It's more of a balance than this article represents. Certifications mean something, but they aren't the end-all-be-all that they bill themselves as. The trick for you is to combine the attitude towards work you hopefully developed in the military with this foundational knowledge to demonstrate 1. you are not an idiot and 2. you can get crap done. When I left the military I was making ID badges (with a master's degree). Keep at it, it gets better.

Re: Security Certifications Are Causing More Harm Than Good

#103

Post by temp246810 »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

No one-thing will make or break your resume aside from the obvious egregious mistakes that I won't go into here.

Get your certifications - they will certainly help. Just don't pin all your hopes and dreams on these certifications.

The will add to your resume as a whole - so that when someone is reviewing your resume they can put an extra check mark in the pros column (experience, check; skill set, check; oh hey he has certs too, nice. check;)

In my experience working in technology, most people aren't as vocal about certifications as you would think based on the chatter you see online. They are a nice to have, not a must have, to get started. Sometimes depending on your actual job, they become a job requirement and work will pay for them.

Also in my experience, the people really against certs are people who for some reason don't like the idea of other people "invading their turf". As if you getting a cert in their field somehow trivializes their experience or effort.

In other words, keep doing what you're doing. View your certifications as milestones along the way, not the be-all-end-all of what you will need in your career. Continue learning and getting valuable experience, and you should be alright.

Update: One last note: certs are like a lot of other things you will encounter in any type of education. You get out of it what you put in. If you work just enough to be able to pass the tests, well, that's what you will get out of it; a way to pass the tests. If on the other hand, you try hard to learn and understand the concepts, then, that's what you will get out of it and it will certainly add to your learning.

Re: Security Certifications Are Causing More Harm Than Good

#104

Post by phaus »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

You won't be sidelined. If you internalize most of the material from your SANS courses you'll probably be smarter than 2/3 of the people in this industry, if not more.

Most of the articles like this seem to come from people in the top 1-5%. Most of them are people that have started their own companies. I'm not a unicorn and most people aren't. I'm pretty confident that Tptacek and everyone else quoted are better security analysts than I am and possibly ever will be. However, I'm also confident that I'm pretty good at my job and I have the potential to get much better.

The important thing is to keep learning every single day.

Re: Security Certifications Are Causing More Harm Than Good

#105

Post by cortesoft »

logfromblammo wrote: post #50
sathackr wrote: post #12

I was involved once in a criminal forensics case. The defense's "expert" witness was a one man computer shop. He had created his own "certifications" and listed them on his resumé as indications to the court of his suitability as a witness. It was literally "person's-company-name Certified Forensic Examiner". He had created about 6 certifications, all of which he held. It's kinda funny, but also kinda scary that the…

So he got the court to accept a self-signed cert as a trusted root. I don't see how that's much different than asking someone to solemnly swear they are telling the truth, when most humans are as capable as lying about whether or not they are truthful as they are of lying about anything else. If the court has no one capable of gauging the expertise of a witness, it has to trust in someone to do that for them, and if…

There is something very different about telling the truth and having knowledge.

Everyone can tell the truth, but not everyone knows technical details about something. He is using his certifications to show he knows technical details; he might even believe he knows those things, but he very well could be wrong.

Re: Security Certifications Are Causing More Harm Than Good

#106

Post by wbl »

raesene6 wrote: post #64
tptacek wrote: post #57

Earlier quoted context omitted.

What does "certification" have to do with scaling the industry? Training and nurturing talent is a hard problem, but expensive tests don't do anything to mitigate that problem.

Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified accountants, Lawyers etc. Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting ba…

Apprenticeship works. Lots of places will have junior people work below senior ones on projects and gradually gain experience and become senior.

Re: Security Certifications Are Causing More Harm Than Good

#107

Post by hourislate »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

There is nothing wrong with getting a cert. SANS offers some great courses. It's a good way for folks to start and get introduced into the industry. There are different roles in security. Soft skills are an important part of that, learning how to manage the process is just as important as being a specialist in Pen testing or Forensics, etc.

Don't get discouraged.

Re: Security Certifications Are Causing More Harm Than Good

#109

Post by jlewis7272 »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

I switched careers at age 30 also (into programming). A buddy told me something that has held out to be true. Think of your career like you would guiding a canoe down a river. Parts of the river will bend and get narrow and parts will be wider and easier to navigate. Try to stick to the parts that are wider and easier to navigate and you'll be just fine. It's ok to add another line to your resume to allow you to get your foot in the door. After that it's up to you. Build up your own experience and that will shine through every time.

Re: Security Certifications Are Causing More Harm Than Good

#110

Post by unhinged_wanker »

leoscuro wrote: post #92

Articles like this one frustrate me. I'm 30, and am essentially starting life over after finishing my military enlistment a couple years ago. all the experience of setting up shops and drafting reports meant nothing with out a degree. So I start working on my degree, and I am absolutely miserable. My love of learning was sucked out of me because I wasn't learning: I was working towards an extra line on my resume. Rig…

This guy is flat-out wrong. He bags on the CISSP - thats a friggin management cert, not a technical cert. Like bitching the CEH doesn't go hard into Opex/Capex.

Meanwhile on planet earth "draw up an inter-agency security agreement compliant with all local jurisdictional laws and industry regs" is also infosec and command line kung-fu will do fuck all to help you get it done.

This guy just drinks "unicorn" piss - he didn't get "trained", he's just so darn smart and hardworking and special. I bet his business card says "lead ninja" or some other IT fuckboy bullshit.

Post reply on HN