Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security Certifications Are Causing More Harm Than Good

tacnetsol.com

Post reply on HN
Print view View original

161–170 of 224 posts

Re: Security Certifications Are Causing More Harm Than Good

#161

Post by ZeroManArmy »

thwarted wrote: post #156
ganoushoreilly wrote: post #81

Earlier quoted context omitted.

This. So much this. Writing and general social skills are the number 1 thing lacking with people I interact with in the industry. The I know more than you attitude is great amongst peers, but with clients, you don't have to prove you're smarter, instead your job is to make them smarter. Break it down to a 4th grade level, if you can't, you likely don't understand it yourself. I would agree that in general certs have…

Also, Security is not IT. That's another thing that needs to change. Do you mean that Security is not currently IT and it should be or do you mean Security is considered to be IT and it shouldn't be ? The amount of stress that you mean to put on the word "not" doesn't come through very well in this medium.

I feel like he means it's generalized into the spectrum that falls into IT. Security should be more of specialization, less toolbox?

Re: Security Certifications Are Causing More Harm Than Good

#162

Post by flukus »

braveo wrote: post #89
nailer wrote: post #44

Earlier quoted context omitted.

There's both some truth and some falsehood to the 'certifications don't prove anything' argument: Answer a multiple choice test for an MCSE or whatever? Doesn't prove much. Receive a server that's been wrecked and won't boot, turn it into a load balancing HTTPS server, SMTP server, a bunch of required cron jobs and a boat load more requirements for RHCE? Proves you can do those things. Disclaimer: used to work at Red…

I just recently had someone ask me to take an assessment test for a senior developer position. There's always some silly hoop to jump through, so I thought "why not". Well I got booted out of the test because I hit Ctrl-C to copy something for the first warning, and hit Ctrl-L (muscle memory) for the final revocation of the test. I just thought to myself ... did I just fail an assessment test because I hit Ctrl-L? Th…

I think I've done this test or a similar one. The worst was going for an MVC role and it was giving me a bunch of questions on webforms lifecycles and "what does the X.Y" method do.

Re: Security Certifications Are Causing More Harm Than Good

#163

Post by flukus »

raesene6 wrote: post #64
tptacek wrote: post #57

Earlier quoted context omitted.

What does "certification" have to do with scaling the industry? Training and nurturing talent is a hard problem, but expensive tests don't do anything to mitigate that problem.

Certifications are used by many industries to provide a demonstration of a common baseline level of knowledge and experience, so that each individual person doesn't need to be assessed by each hiring organisation. For example Certified accountants, Lawyers etc. Without some common baseline, how do people looking to hire security types who don't have the experience to assess their skills and knowledge avoid getting ba…

How many of those industries does certification actually work in? Does it prevent dodgy lawyers and accountants?

Re: Security Certifications Are Causing More Harm Than Good

#164

Post by flukus »

sathackr wrote: post #12

I was involved once in a criminal forensics case. The defense's "expert" witness was a one man computer shop. He had created his own "certifications" and listed them on his resumé as indications to the court of his suitability as a witness. It was literally "person's-company-name Certified Forensic Examiner". He had created about 6 certifications, all of which he held. It's kinda funny, but also kinda scary that the…

Can/did the other side bring this up? I may be watching too much suits, but it seems like an easy way to ruin the credibility of the witness.

Re: Security Certifications Are Causing More Harm Than Good

#165

Post by flukus »

user5994461 wrote: post #148
w8rbt wrote: post #6

There's 'compliance security' and then there's 'street-smart security'. They are very different things. Most organizations aim for compliance (it's cheap and easy). They base security on contracts, certs and insurance policies. Street-smart security practitioners are appalled by this. And, management doesn't understand why the 'security people' aren't on-board with 'compliance'. It's a lot like the old west with Cowb…

Compliances cover a lot of the basics.

Isn't compliance the reason we have "at least one upper and lower case letter, at least one number, at least one special character and a drop of blood from your first born" style passwords that ruin security?

Re: Security Certifications Are Causing More Harm Than Good

#166

Post by flukus »

raw23 wrote: post #4

I think soon that this sentiment will start to apply to Universities. It seems inevitable at some point in the near future there will be an online 'university' (for lack of a better word) who's graduates will be considered equal or even better than a standard university education, particularly for tech related degrees. Universities have been a centralized source of accreditation for a long time. All it takes is for s…

It already has for me, I won't hold it against someone but it no longer indicates any basic level of knowledge.

This is based on my last batch of interns that had masters degrees but couldn't handle hello world. Their spoken english skills made it clear that they were completely incapable of understanding the lecturers.

Universities are a business, they are paid a lot to provide a piece of paper, so they provide it.

Re: Security Certifications Are Causing More Harm Than Good

#167

Post by intern4tional »

tptacek wrote: post #153
coverband wrote: post #142

Earlier quoted context omitted.

Then by definition you don't have any expectations for "a CISSP to be an expert in 'tech ninja' stuff", as I was saying... ;-) I'll agree with you that, to an extent, all certifications are a scam, especially those with artificially high sit-down fees. My point is that, CISSP does not claim to be a gauge for whether you are a crypto expert, just that you should know the difference between basic types of encryption an…

Roles I've held: * ISP network security engineering * Network penetration tester * Software developer for network security products * Application security assessor * (Most recently) Security team lead I've had these roles for small companies and for very large ones. What experience am I missing that would lead me to change my mind about the CISSP? I don't think attempting to pigeonhole me as a "crypto expert" is goin…

That's an impressive resume of roles, but security is more than just those areas.

I think the grandparent is trying to say that the CISSP is largely for non-technical security roles. People that manage large security organizations are generally believed to be the ones that benefit from the CISSP as they are not interested in the details and more on a 1000 foot strategic view.

Without knowing more details about the your specific expertise, I would say you probably haven't been in a role that would benefit from the CISSP by just looking at your list. If you've been the CISO for a large company with 400+ people reporting to you doing IS work, having a CISSP should at least help you prioritize the work that needs to be done. Likewise for many companies that have non-technical management in security organizations, a CISSP helps provide some background for them.

Re: Security Certifications Are Causing More Harm Than Good

#168

Post by FLUX-YOU »

gwbas1c wrote: post #147

“Would you feel comfortable letting a doctor be your primary care physician if all it took was to pass a written multiple choice exam?” Doctors have to go through extensive certification in order to be hired, and constantly have to re-certify. The difference, though, is that a doctor's certification is very rigorous and well-designed. The difference is that a medical certification proves competency. Certifications in…

Why is the medical industry able to make decent tests of competency but devs/security groups cannot?

Re: Security Certifications Are Causing More Harm Than Good

#169

Post by ZeroManArmy »

infosecdude64 wrote: post #87

Being a manager of an InfoSec team I agree with this, especially the CISSP and CEH. I've seen a few folks get a CEH and then they're off to App testing land, but the funning thing is, none of them has ever written an app, some not even a script, and they are now doing security testing on mobile apps. Basically they just push a button on an app scanner and pull a report, it's sad. The folks that do succeed in security…

As some one who is looking to get into security, I have that drive of why. At work I hate when the senior engineers close something without explaining it.

I like to know how something broke and why it broke. I understand programming and can read about any normal language to a basic degree and lightly troubleshoot.

Your absolutely right, about those kinds of people too. Some get the certification and stop there. Others get it and use it as a foundation and build on it.

Re: Security Certifications Are Causing More Harm Than Good

#170

Post by kkirsche »

tptacek wrote: post #119
e79 wrote: post #68

The thing with infosec is that no matter if you're a consultant pen tester or an in-house member of a blue team, a high proficiency in technical writing is required. And few certs demonstrate that the person is a good technical writer. It's not enough to know the answers to multiple choice questions. It's not even enough to know how to exploit things. If you don't understand something well and can discuss it in techn…

It's unlikely that typical OSCP-holder could write a modern buffer overflow exploit, or even judge exploitability of a memory corruption flaw given the source code and a traceback. Equally importantly: memory corruption exploit development and SQL injection are different skills , and most people who do SQL injection don't need proficiency in "buffer overflows". Why is superficial coverage of "buffer overflows" part o…

If you want that wouldn't you want OSCE instead of OSCP?
Post reply on HN