I discussed of the same trends in the IT industry in general, and seeing it coming in the security industry in particular in my paper "Autopsy of a successful intrusion" about a year ago. This paper just got mirrored on neworder.box.sk, and got a bunch of readership from this, and some interesting comments about this specific issue.

In my paper, I kind of state that the IT certifications pollute the market, drives salaries down and create downright security risks because people with the most experience/education are left out, meaning that the expertise is also going down. Some people got shocked about my apparent preference toward a university scholarship rather than a panoply of quick certifications, but actually there were a few of these "quick certs" that admited that they thought they were downright Computing God after leaving these schools, while now that they took more experience and started to learn by themselves they realize that they knew practically nothing back then. And it's not about going to university neither, I think it's about experience and maturing, and desire to learn, and all of this takes time, and going to school takes time and helps you achieve these, which means that once on the job market, the candidate will be a much more "professional" person (in the technical and responsability point of view).

Now, with the scandals of Enron, Tyco and all, and knowing the hiring habits of corporate America and the security awareness showed in "Autopsy..." that is more the norm than the exceptions, and what is discussed by Rick Forno, why do I feel that the house of card that is economy is about to crumble? Certifiably Certified, doesn't that sound like auditing the auditors? "This company is honest, because our auditors are audited!" Hmmm...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/118/16888#16888