What Information Security certifications should I get?
So I'm fairly new to the forums here, but it seems like about every tenth post or so is about someone wanting to either break into security or develop their security skills further. Since I'm a helpful Homer, I always would write back to give some points. Sorry to say, though, that I'm getting tired of writing the same thing every time, so I decided to make one big post that I could just refer people to. I know there are stickied similar posts like this floating around, but I thought it'd be easier to link you, curious reader, to my own words. I won't wax lyrical about every single cert out there, mostly because they are being constantly developed and may have changed since I wrote this initial post. Rather, I'll list them, let you do the research to better compare and contrast, and update this list as necessary.
Please be aware that certs do not make the man. Real skills are required. While there is always debate on the value of certs, I tell people to primarily use certs as ways of supplementing their knowledge and secondarily getting a "leg up" on potential jobs where other candidates may not be certified.
I'm addressing what I consider to be the "name brands" of certs here. Especially nowadays there are lots of companies offering lots of certs, but these will be the ones people have the most general knowledge of and are created by the most well-known companies. Feel free to add comments below. I'll add useful comments to this first post.
As a last item, since everybody and their uncle wants to go into infosec management and make the big bucks, I focused the list below on that path. Feel free to ask below for other paths (forensics, for example) and I (or others) will happily keep you from exercising your own free will by giving you the cert roadmap you're looking for without all the extra stuff you don't need.
Entry certifications. If you're just starting out, these are a good way to get your feet wet, learn some introductory material, and see 1) if you want to continue down this treacherous journey and 2) where you may want to focus your attention in the future. Security is a huge field spanning literally every IT realm and crossing over into the business realm if you want to pursue a management path. There are lots of forks in the road. Choose wisely.
CompTIA Network+ - this isn't technically a security cert, but security inevitably touches upon the network. If you don't have much in the way of networking know-how, I'd suggest starting here. There are no prerequisites.
CompTIA Security+ - pretty much the de factor intro cert. Covers the gamut at a good level. There are no prerequisites.
CompTIA Advanced Security Practitioner (CASP) - if you've just passed Security+ or don't need it due to your current level of knowledge, this is my recommended next step. The 201 to Security+'s 101. There are no prerequisites.
(ISC)² Systems Security Certified Practitioner (SSCP) - A sort-of alternative to the CASP. One year of experience is required in a specific security domain listed on the certification's website.
SANS/GIAC has training/cert options that slot in here. GIAC Security Essentials (GSEC) & GIAC Information Security Fundamentals (GISF) come to mind. These are very expensive, best left to deep corporate pockets, and IMO have no value-add over the cheaper options listed above.
EC-Council has training/cert options that slot in here. The world-at-large is split on the value of these certs as the company underlying them isn't as well-rounded and professional as, say, (ISC)² or ISACA. I won't give my opinion on the subject, but you can search around these forums for plenty of opinions. CEH is their most popular exam and would be suitable to study after Security+.
Mid- to High-level certs. Once you're comfortable with your beginner-level knowledge, start looking into these guys.
Vendor-specific certs. If you're going to be running technical security controls like McAfee ePO, ArcSight, Splunk, etc. then get work to pay for these certs & associated training. A no-brainer if this is your everyday workload.
SANS/GIAC has training/cert options that slot in here. As mentioned above, these are expensive and better for corporate worker bees, but they do have lots of hands-on value. Since there are tons of options (and a very dynamic list), I'd recommend browsing the SANS and GIAC websites for the focus area of your choice. Categories include penetration testing, incident handling, forensics, management, audit, etc.
(ISC)² Certified Information Systems Security Professional (CISSP) - In my region this is listed as a desired cert on just about every security job. If you have one end-goal for future job marketability, this should be it. Five+ years of experience is required in specific security domains listed on the certification's website.
ISACA Certified Information Security Manager (CISM) - You'll see this listed on just about any infosec-manager job posting, mostly because the posters like the name. I consider it complementary to the CISSP. Five+ years of general infosec experience, with three+ years of infosec management experience, is required in specific security domains listed on the certification's website.
ISACA Certified in Risk and Information Systems Control (CRISC) - while this is technically a risk-focused exam, my belief is that it has lots of value for infosec managers since everything they do (whether they know it or not) is risk-based. A good follow-up to the CISM. Three+ years of experience is required in specific security domains listed on the certification's website.
ISACA Certified Information Systems Auditor (CISA) - This is geared towards auditors, but it very easily slots under the Management section. A good follow-up to the CISM. I recommend doing this immediately before or after the more technically audit-focused GIAC Systems and Network Auditor (GSNA). The CISA requires five+ years of professional information systems auditing, control, or security work experience is required in specific security domains listed on the certification's website.
My suggested management path - Start your Master of Business Administration (MBA) > Network+ > Security+ > CASP > CISSP > Graduate with your MBA > CISM > CRISC > CISA. By the time you get through working through those (and have the required years of experience) you'll have a dozen new options to choose from!
