I know many people who have taken the test and there is no correlation to their ability to take their "well rounded" knowledge and actually apply it to real life security technology design. I will say that there are many techies who run around saying "well that's not secure" without understanding that security is a cost-benefit analysis. The certification, if nothing else, shows that you are aware of the vast breadth of the field and how, for example, wiretap law affects the command line args to grep you use while wading through that web proxy log file (well at least in theory).

The secrecy around the passing metrics to me is more alarming, and smells like the bell curve which can be adjusted depending on next quarter's budget. Let's face it, certifications are a revenue centre for ISC^2. If it got out on the street that a cert was "too hard" then they would whittle down their market. Likewise if it was too easy then you would get articles like this.

At least the author is willing to own up to "do it if the suits want it". Just make them pay... :)

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/67/11000#11000