Finished the exam in just over 3 hours (first attempt). I was on a roll, so I only took one 10 minute break. All told, I spent about 2.5 weeks of solid study. As for material:
- Infosec Institute videos: employer provided, not very comprehensive. I wouldn't really recommend them unless you are confident with the material or plan to watch them a few times.
- Conrad's 11th hour
- Transcender practice exams
- AIO/CBK for reference
I'll preface my thoughts on the relevancy of this certification by conceding that it is marketable, it is respected, it's not intended to be (primarily) a technical exam, and the sheer breadth of information and length of the exam are a challenge.
A couple of years ago, we discussed the merits of the cert here
http://www.techexams.net/forums/isc-sscp-cissp/80918-read-article-lets-discuss.html
Now that I've taken (and passed) the exam, I wanted to revisit my thoughts on it. So not much has changed for me. There were probably more references to technical references than I was expecting, but even then, it seemed like they were often used as distractions rather than information relevant to answering the question. As I've heard many times, there were many questions where 2 of the answers could be eliminated right off the bat. However, the other two were often very similar or were vague or misleading - meaning I had to be careful not to misconstrue what concept the answer was trying to express.
I see why many people find it such a challenge. Unlike many tests, it's difficult to really know how you did until you see the results. I would imagine that good test takers do well with this exam, but those who have a hard time with the "pick the best of these crappy options" format will struggle. It seems to me that the root cause of the perception that this exam is so difficult is the intentionally obtuse question structure and sheer length of the exam.
The actual content did not see very difficult to me. I probably missed a handful of questions because I did not memorize the exact step of every single method/model in each domain ("What is the first thing you should after step x?"). I probably had a 50/50 chance at those. Other than that, I felt pretty solid about my answers.
So what does this mean in the context Information Security? I'll start with this snip from a the linked thread:
Broad theory certs should have the type of influence in the industry that Security+ has, not CISSP, which has come to be seen as some sort of gold standard for security practitioners. I realize that DoD and HR have led the charge in creating this misperception, but the result is that there a lot of folks and even companies out there in security roles that know little about the technologies behind the assets they are trying to protect.
For some roles, that is perfectly fine. For many roles, such as mine and most of the people I work with, that's not fine. The fact of the matter is that CISSP gives one an awareness of a broad range of basic security concepts. It aids in developing the terminology to communicate on these subjects. It can even help integrate disparate security concepts. But that's a very low bar for most technical positions.
As has been said before, we need good security officers, good policy types, good auditors and good management in the security arena. I'm not in any way diminishing that. But what we really need is DO-ers that can learn and analyze and protect and defend.
Here is a quick background to give some idea of where I'm coming from. My employer required me to pick up CISSP. I am in professional services for a large security vendor. My customers are all in the federal space, one of which is a branch of the US Armed Forces. Even though DoD has specified that multiple certifications (including GCIH which I already had) qualify for the top Information Assurance technical level (III), this customer is requiring CISSP in upcoming contracts because it gives them the warm fuzzies.
Fine, that's their perogative. I knocked it out. But it's scary because they believe that CISSP = skilled engineers, analysts, architects or whatever the case may be. I have seen the same nonsense in other industries. But since I'm in the business of protecting data sensitive to US interests and have seen successful attacks against US assets, it is very concerning to see this nonsense in the public sector. It has created bad incentives for everyone involved.
The battlefield is literally moving into cyberspace. It would help if the obsession with information assurance, compliance, auditing, policy etc was re-calibrated to allow for more emphasis on the threat monitoring, detecting, analyzing, incident response loop with red teaming/pen testing thrown in. These things require serious technical knowledge and skills.
ISC2 is not the problem - perception is. I think as more and more large scale attacks are successful, perception will change. I'd like to see communities like this leading the charge on changing that perception.
