Evaluating Security Certifications

Over the past few years, we've seen both IT certifications and information security grow in importance. It's therefore not surprising to see the emergence of information security­related certifications. Although certification certainly doesn't guarantee competence or skill, holding the right certifications can enhance an information security professional's career. Beyond confirming that you passed an exam, the right information security certification can lend you credibility, can demonstrate that you're serious about the information security field and that you have experience in the field, and can even attest that you subscribe to certain professional ethics and have an unmarred background. But although certification can boost your prospects in today's competitive job market, beware—not all certifications are created equal. That being the case, how do you decide which certification is right for you?

What Information Security Hat Do You Wear?
Different certifications test different skill sets and bodies of knowledge, so although one certification might fit your career path, another might not. For example, the Certified Information Systems Auditor (CISA) certification is a good choice for IT auditors, but Certified Information Systems Security Professional (CISSP) is a better choice for information security professionals involved in designing, implementing, operating, or administering IT security. There are other, more specific certifications that focus on specific areas of information security, including forensics (e.g., Security Certified Network Architect—SCNA), intrusion detection (e.g., GIAC Certified Intrusion Analyst—GCIA), VPNs and firewalls (e.g., Security Certified Network Professional—SCNP), and wireless (e.g., Certified Wireless Security Professional—CWSP). Think about what kind of job you want in the future or what certification might help you advance in your current position, then find a certificate that matches your goals. Talk to colleagues and managers to learn from their experiences with and thoughts about certification. Web Table 1 (http://www.windowsitpro.com/windowssecurity, InstantDoc ID 44650) can help you become familiar with existing security information certifications. Pay attention to the objectives associated with each certification, as well as to the specific careers that the certification targets. . . .