A few times each year, a thread pops up bashing the certification industry, mocking organizations requiring certifications for job applicants or contract opportunities, or using brain-dump test takers as the barometer for those with industry certs. Many, if not most of the arguments are valid in their specific contexts. Hiring or contract awards should not rely on certifications to prove a prominent level of competence. However, certifications do provide value in several areas that are often dismissed or ignored and can bring immense value to the IT and InfoSec industries.
Massively Open & Available#
Certifications are more accessible than many other prerequisites for IT and InfoSec jobs. This should be celebrated by an industry lacking diversity. Most IT and InfoSec job opportunities (even entry-level) require an applicable four-year degree or commensurate experience, excluding individuals lacking the financial resources or schedule flexibility to complete these pre-req’s. Except for the professional or senior levels, rarely do certs require industry experience or exorbitant fees. Additionally, today, many tests are available via online proctoring, reducing the challenges of traveling to a test center and opening up a large swath of previously excluded individuals to the industry.
Within the United States, most county and city libraries have a plethora of study aides for certifications. In many cases, these materials can be shipped to a home, downloaded on an e-reader or in a web browser, or are available as online training in forms such as a free Lynda.com subscription. These low-cost, on-demand study and testing options make certifications an inclusive and accessible method for those starting out in the industry or looking to make a career change, regardless of background and socioeconomic factors.
Road-map to Learn#
For individuals exploring, new to, or experienced in IT or InfoSec, certifications provide a road-map towards achieving distinct goals.
Strong, core networking fundamentals is a common knowledge gap for junior IT professionals. For an individual exploring the industry or filling gaps in this area, a path to beginner competence may be CompTIA Network+ → Cisco CCENT (ICND1) → Cisco CCNA Routing & Switching (ICND2). The exam fee total for this path is approximately $630 (~$300 CompTIA & ~$165 Cisco x 2). This path will provide adequate theory and practical knowledge of networking for an individual to confidently apply for opportunities in a networking role. With this road-map, a person can gain fundamental understanding from no knowledge to associate level. While the test fees are considerably less expensive than many other career pre-req’s, scholarships and exam discounts can be found for many population segments such as but not limited to veterans, low-income, single-parent, or disabled individuals.
Certification roadmaps can be especially valuable to InfoSec professionals. Too often, vulnerability assessments or pen-tests are performed by individuals without experience designing or defending a network infrastructure. This is most evident in over-generalized, post-exercise recommendations or the inability for the assessor to properly quantify the effort, impact, or cost involved in remediation and mitigation. Knowing how information systems work provides InfoSec professionals the skills to expand their capabilities and give valuable insight to customers during engagements. Certification frameworks can be utilized to provide a study path to fill knowledge gaps and expand careers.
Practice and Follow-Through#
To be good at anything, we must set goals for growth, practice the skills to accomplish the goals, and follow-through to completion. Along the journey, we can become complacent, jaded, burnt-out, bored, uninspired, or apathetic. Certifications can be a way to get back on track or get started again. They can also serve as a prescription for lifelong learning and relevance.
A newcomer that has shown the ability to study for and complete a certification path is much more attractive to employers than an individual that has taken some classes online, attended training courses, or who discounts certifications altogether. Those individuals often lack the proof they can complete tasks and goals, to follow-through. A person seeking self-improvement and willing to take on and complete a task that endurance, pacing, and perseverance is inherently more interesting. Most will find themselves bored or uninspired in their job at many points in their career. Seeking self-improvement, setting goals, and accomplishing them are signs of a healthy attitude in handling adversity.
It is common for new and eager IT folks to lack direction in their newly discovered role. Paired with a desire to learn it all results in much floundering in many directions, never really mastering or gaining a solid grasp of critical foundational knowledge. Over time, that professional becomes a generalist and can usually progress to a role with very livable wages. It also culminates in an individual that does things because “that’s how it’s done”, often avoiding innovative technologies, strategies, and architectures. To break out of this rut, the professional must fill gaps in their skills, sometimes going back to the basics to rise out of their generalist role. Certifications provide a path for these individuals to escape this trap and jump-start a stagnant career.
Finally#
Of course, this all assumes people act ethically and use the certification paths as a means to expand one’s skills and knowledge. Certifications are not a panacea. They are not a direct substitute for experience. Certifications can be had using brain-dumps, memorizing answers, and gaming the system. Certifications shouldn’t be used as the ultimate factor in considering a candidate. But, when used properly, they provide an opportunity for those looking to break out of a stale career, shift industries, or overcome socioeconomic circumstances precluding them from a traditional career path (if there is such a thing). The industry is accessible. We should get excited about that and work to bring in diverse backgrounds, opinions, and experience. Certifications aid in making it accessible. We should stop bashing certifications and get better at using them properly as another tool for individuals to learn and grow. Certifications can make a positive impact on newcomers, professionals, organizations, and the industry at large.