Want a job in infosec? Your first task: hacking your way through what many call the "HR firewall" by adding a CISSP certification to your resume.
Job listings for security roles often list the CISSP (Certified Information Systems Security Professional) or other cybersecurity certifications, such as those offered by SANS, CompTIA, and Cisco, as a requirement. This is especially true in the enterprise space, including banks, insurance companies, and FTSE 100 corporations. But at a time when the demand for good infosec people sees companies outbidding each other to hire top talent, and ominous studies warn of a looming cybersecurity skills shortage, experts are questioning whether certifications based on multiple choice tests are really the best way to recruit the right people.
"I give that bit of advice to listeners who ask me for career advice to get their foot in the door," Jerry Bell, who runs the Defensive Security podcast and leads the internal security strategy team for a large global IT services company, told Ars. "Indeed [I do] describe it as getting through the 'HR firewall.' So, I suspect this is common advice given and used by many people."
David Shearer, CEO of ISC2—trademark stylized as (ISC)2—the organization that certifies CISSPs, told Ars that with more than 107,000 CISSPs in over 160 countries, the certification "has become almost a de facto standard for chief information security officers around the world."
CISSPs must pass an electronic exam consisting of 250 multiple choice questions, and demonstrate five years of full-time experience working in information security. Candidates who pass the exam, but lack the experience, may identify themselves as Associates of ISC2 until they meet the work experience requirement.
As a result, a cottage industry of boot camps has sprung up to help would-be CISSPs cram for and pass the exam. Boot camps can cost thousands of dollars, and candidates must spend £415 ($599) to sit the exam.
But does adding a CISSP to your resume really mean you know your stuff?
Not everyone is impressed
Recruiter Thomas Ptacek, whose Chicago-based agency Starfighter specializes in recruiting security folk, describes the CISSP as "a joke," and claims that in his experience a job description requiring a CISSP was a warning flag to industry elite not to apply.
"I don't think there are that many high-level practitioners outside of management who put much stock in the CISSP," he says.
Dan Tentler, founder of the attack simulation consultancy Phobos Group, compares hiring infosec workers based on passing an exam to hiring other professionals on the same basis: "Would you feel comfortable letting a doctor be your primary care physician if all it took was to pass a written multiple choice exam?"
He believes that "ISC2 is making money hand over fist," and that the organization is "diluting the market with people who have no idea what they're doing."
ISC2's Shearer, for his part, takes issue with the suggestion that the CISSP can be passed by rote memorization alone. "The way the questions are fashioned is to elicit critical thinking, not just a book knowledge answer, of the candidate," he argues. "That's why for candidates that don't have the required experience, the exams can be extremely difficult."
Furthermore, he says, his organization has "longstanding evidence that people who have the credential command more in the marketplace in terms of salary." So as a career move, it's easy to understand why job candidates spend the time and money to take the exam—and elect to remain certified afterwards, which requires annual continuing education, often at substantial cost.
According to a study sponsored by ISC2, the global workforce faces a shortage of more than 1.5 million cybersecurity professionals by 2020. Shearer tells Ars he hopes that the CISSP, and ISC2’s other certifications, will help solve that skills shortage. But are the growing ranks of CISSPs really filling the market need for skilled cybersecurity workers—or just wallpapering over the cracks?
The real skills shortage
"This idea that there's a shortage is absolutely true, but it's a focused shortage," Alan Paller, director of research for the SANS Institute, which offers certifications that compete with CISSP, tells Ars. "The majority of the jobs that are hard to fill are the mission-critical jobs," he argues, citing a 2012 report by the US Department of Homeland Security (DHS).
Mission-critical jobs, according to the DHS report, are hands-on roles like penetration testing, incident response, and threat analysis. DHS concluded that filling these mission-critical roles involves growing an "on-ramp" of penetration testers.
“Knowing how to penetrate an architecture allows for better security monitoring, event analysis, security engineering, and architecture,” the study found, “and knowing how to find and exploit application vulnerabilities allows for better code reviews, forensics analysis, threat analysis, and incident response.”
Due to the important nature of these jobs, which the DHS report compared to those of pilots, physicians, and nuclear plant operators, certifications must "set a high bar for technical proficiency," which means "using techniques as rigorous as those used for the professions mentioned above, including scenario-based testing to measure proficiency."
The report concluded: "The standards are strict because people's lives depend on these professionals doing their jobs effectively."
Tentler believes that CISSP doesn't come close to meeting those strict standards: "These people [CISSPs] are flying a jet without going to flight school."
Even NIST, the US National Institute of Standards and Technology, recognizes the need for greater skills-based hiring practices. NIST's National Initiative for Cybersecurity Education (NICE) recently released its Strategic Plan that lists “Accelerate Learning and Skills Development” as its number one goal.
NIST calls for a paradigm shift
"We need a paradigm shift to focus more on skills and abilities, and less on traditional credentials," Rodney Petersen, the director of NICE, tells Ars. "Employers must pledge to base their hiring on skills, not on certifications or degrees."
A greater focus on skills could reduce the total number of security workers needed. Tentler questions whether the skills shortage is as grave as the ISC2 study suggests, and points out that sourcing the right people can dramatically reduce the headcount required.
“One of the reasons why Google and Facebook appear to have wizards running their shops," he says, "is because three people who know what they are doing and are competent are orders of magnitude more capable and will provide better results than 25 people who have no idea what they are doing."
Nor are computer science degrees necessarily the answer. Although a solid background in computer science can help, especially with application security testing, Ptacek tells Ars that a CS degree on its own is no guarantee of success as a penetration tester—in fact, a reliance on credentials-based hiring to fill these mission-critical roles is the real problem.
"I push back on the idea that there is not enough talent out there," he says. "We don't need to train a new generation; we need to do a better job of breaking down the wall that HR and tech managers put up as an excuse to not bring people in."
Doing so requires a whole new approach not just to hiring practices, but also to education, training, and certification—an approach NIST's Petersen has embraced.
"I think that paradigm change is something that needs to happen for employers," he tells Ars, "but also for education training providers, to adapt their education, training, and assessment processes to reflect that change in philosophic approach."
So if credentials, like computer science degrees and well-recognized certifications like the CISSP, aren’t the best way to hire cybersecurity talent, then what does that paradigm shift look like?
Listing image by Getty Images