Slashdot Mirror
GIAC/SANS Certification Changes?
venom600 wonders: "SANS and GIAC have recently changed their certification requirements, no longer requiring a practical assignment be completed in order to be certified. This has created some discussion around the value of their certifications moving forward.
In addition, SANS recently asked current certified individuals (in an email) to provide quotes about the value of their certifications for an upcoming brochure. Since the requirements have changed, the value of the certification has changed as well, making any quotes an unfair assessment of value. This brings me to my question: What IT security certifications are left (if any) that actually provide value to you?"
My CISSP...while not a good indication of technical skill, still seems to provide the ooohs and aaahs necessary from management and customers to be worthwhile. Although I have met plenty of CISSPs who wouldn't know any of the 10 domains from a hole in the ground...it seems to be the "cert du jour" to have. My $0.02 ...from the real world.
When hiring, I'm not really impressed by certifications. To me, a certification means you stopped working long enough to play games with an authority figure -- usually in the hopes of getting more money -- and that authority figure may or may not have given you a rigorous testing to determine your eligibility for the certification. It's not just the certification that matters, it's where you got it.
Essentially, I judge applicants based on how I perceive their level of talent during the interview. I'm more interested in the flavor of a resume than I am in the experience and skills listed on it; I can *get* you experience and skills, but I can't get you talent -- let alone the basic ability to "fit in" at my company.
Microsoft cheerleader, blue flag waving, you got a problem with that?
MCSEs are making all the money these days :p
Set the bar. "You must be this tall to ride the Giant Dipper".
GIAC
Demonstrated application. "Your stuff could be safe with me.
A Harvard MBA doesn't translate into a tier-1 CEO. There are no guarantees. But CISSP and GIAC are decent evaluation tools for assessing candidates and associates.
Security+ shows someone is looking in the right direction.
"Flyin' in just a sweet place,
Never been known to fail..."
has an informative article outlining the value of several of the IT security certifications. Read it here
I rank real world experience and self-taught knowledge 100 times higher than certs or degree's from some big name school or college.
:)
Real world exp. is the real certification in my book, show me someone who has been up for 72 hours working on team or alone to fix a server or network issue who resolves the issue. That individual or team that tackles problems like that will get a job working with me before anyone who has a degree or cert.
Self-taught knowledge shows me that the person took on the challenge of learning on there own and did not require someone to hold their hand and teach them stuff from a book that is so far off the day to day path that its a waste of a good tree.
Don't get me wrong, I applaud anyone who has successfully completed any certs or degrees, it takes a lot of time and effort to do that. I just don't feel that the weight that seems to be put on them is justified.
My 2 pennies, now all the folks with degrees and certs can assault me.
Open Source, Open Formats, Open Doors, Open Your Mind "Break On Through to the Other Side" The Doors
Personaly i have always found practical tests to be some of the most valuable in the IT field , Theory is wonderufll but it needs to be backed up by a solid foundation of workable skill . to use another example I could explain to you how a car engine works in some detail but dammed if i could build one
Testing to see for both theoretical knowlidge and practical skill is important for a well rounded education ( well testing is important to check your educating properly, but the most important is practical education and lab work)
The only things certain in war are Propaganda and Death. You can never be sure which is which though
...or tic-tacs for that matter. :)
But seriously.
I used to have a good half-dozen certifications active at any given time ("real" ones, not just the generic A+ crap). But after awhile I began to notice that people were much more impressed by what I'd done in the real world and I slowly started letting them lapse. The last one expired about four years ago and to be quite honest I don't think a single customer has noticed or cared. And it sure saves me a lot of time and hassle!
But then again I suppose it depends on your background. If you're fresh out of college then they would be a Very Good Thing to have for at least some number of years.
since when were SANS certifcations considered, uh, respectable?
... when was SANS considered respectable?
nevermind their certifications
vodka, straight up, thank you!
Most janitor get paid for picking up paper. How come techs are supposed to pay others so they can do that?
Havig said that, I'm willing to write a security course and exam for anyone interested in such rip-offs. I can guarantee it'll be as good as anything GIAC or SANS can do, because I can afford to be current. They can't. It might not be recognised by anyone worth a damn, but at least you'll know how to actually do meaningful security.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
On a scale of one to ten I'd put this vulnerability as an eight if anyone bothers to exploit it intelligently. This is very, very, very close to the relative badness of arbitrary code execution.
Help poke pirates in the eyepatch, arr.
I took the SANS security boot camp when they first started. I found it valuable and very well done. A solid week of good, well presented, stuff that you won't find anywhere else.
However, even though I passed all the exams needed for GIAC certification, the follow on requirement to submit papers simply did not fit my work schedule. As the only system administrator for a small startup, I simply did not have time to write papers. So, the requirement they appear to be dropping was the requirement that blocked my certification.
Writing a good paper takes time and focus. Something that working system administrators often find short in supply.
For every problem there is a solution that is simple, obvious and wrong.