Title: Credentials of Information Security Professionals
Course: IN 2001 Principle of Information Assurance > Section: Module 11: Chapter 11

Credentials of Information Security Professionals
1. Many organizations seek industry-recognized certifications when reviewing the credentials of applicants.
2. Most existing certifications are relatively new and not fully understood by hiring organizations.
3. The certifying bodies work hard to educate the general public on the value and qualifications of their certificate recipients.
4. Employers are trying to understand the match between certifications and the position requirements and hopeful professionals are trying to gain meaningful employment based on their newly received certifications.

(ISC)^2 Certifications
1. The International Information Systems Security Certification Consortium (ISC)^2 is considered the foremost organization offering information security certifications today.
2. Currently (ISC)^2 offers three primary certifications and three specializations for its flagship certification.
3. (ISC)^2 also offers an intermediate, or in-progress, certification to allow candidates who have not completed the experiential requirements of a certification to provide evidence of progress toward completing the certification.
4. Certified Information Systems Security Professional (CISSP)
  - Considered the most prestigious certification for security managers and CISOs, the CISSP is one of two certifications offered by the International Information Systems Security Certification Consortium. The SSCP is the other certification
  - In order to sit for the CISSP exam, the candidate must possess at least three years of direct full-time security professional work experience in one or more of the 10 domains of information security knowledge:
    - Access control systems and methodology
    - Applications and systems development
    - Business continuity planning
    - Cryptography
    - Law, investigation and ethics
    - Operations security
    - Physical security
    - Security architecture and models
    - Security management practices
    - Telecommunications, network, and Internet security
  - Once a candidate receives the CISSP, he or she must earn a specific number of continuing education credits every three years to retain the certification.
5. Systems Security Certified Practitioner (SSCP)
  - Like the CISSP, the SSCP certification applies more to the security manager than the security technician because most questions focus on the operational nature of information security.
  - The SSCP focuses “on practices, roles and responsibilities as defined by experts from major IS industries.”
  - The SSCP covers seven domains:
    - Access controls
    - Administration
    - Audit and monitoring
    - Risk, response, and recovery
    - Cryptography
    - Data communications
    - Malicious code and malware

ISACA Certifications
1. The Information Systems Audit and Control Association (ISACA) was founded by a group of individuals with similar jobs in computer auditing, who sought to provide a centralized source of information and guidance.
  - ISACA offers two well recognized and respected certifications: the CISA certification for auditing, networking and security professionals and the CISM certification for information security management professionals
2. All ISACA certifications have the following common requirements:
  - Successful completion of the requisite examination
  - Experience as an information systems auditor, with a minimum of five years’ professional experience in an area of direct interest to the certification
  - Agreement to the ISACA Code of Professional Ethics
  - Continuing education policy that requires maintenance fees and a minimum of 20 contact hours of continuing education each year and a minimum of 120 contact hours over the three-year certification period

SANS Global Information Assurance Certification (GIAC)
1. In 1999, SANS developed a series of technical security certifications known as the GIAC.  At the time GIAC was established, there were no technical certifications available elsewhere.
2. An individual can attain the various GIAC certifications individually or pursue a comprehensive certification known as the GIAC Security Engineer (GSE).
3. Like the SSCP, the GIAC Information Security Officer (GISO) is an overview certification that combines basic technical knowledge with an understanding of threats, risks and best practices.
4. Unlike other certifications, GIAC certifications require the applicant to first complete a written practical assignment before taking the exam. GIAC certifications include:
  - GIAC Security Essentials Certification (GSEC)
  - GIAC Certified Firewall Analyst (GCFW)
  - GIAC Certified Intrusion Analyst (GCIA)
  - GIAC Certified Incident Handler (GCIH)
  - GIAC Certified Windows Security Administrator (GCWN)
  - GIAC Certified UNIX Security Administrator (GCUX)
  - GIAC Information Security Officer - Basic (GISO - Basic)
  - GIAC Systems and Network Auditor (GSNA)
  - GIAC Certified Forensic Analyst (GCFA)
  - GIAC Security Leadership Certificate (GSLC)
5. Before candidates are even allowed to sit for the final certification for obtaining the GIAC Security Engineer designation, which is considered the pinnacle of GIAC certifications, they must earn all of the various GIAC certifications and receive honors recognition in at least one.
6. GIAC is designed not only to test an individual’s knowledge of a field, but also to require the application of that knowledge through a practicum. While there are a growing number of entry-level certifications, GIAC currently offers the only advanced technical certifications.

Security Certified Program (SCP)
1. One of the newest certifications in the information security discipline, the SCP certification provides two tracks: the Security Certified Network Professional (SCNP) and the Security Certified Network Architect (SCNA).
2. The SCNP track focuses on firewalls and intrusion detection and requires the following two exams:
  - Network Security Fundamentals (NSF)
  - Network Defense and Countermeasures (NDC)
3. The SCNA program focuses more on authentication, including biometrics and PKI, and requires the following two exams:
  - PKI and Biometrics Concepts and Planning (PBC)
  - PKI and Biometrics Implementation (PBI)
4. SCP programs provide those new to the career field of information security a useful mechanism to getting started and are a vendor-neutral means by which a practitioner can document professional and technical skills.

CompTIA’s Security+
1. Offered as part of the A+ program, the Security+ certification focuses on the key skills that are necessary to perform security, but is not tied to a particular software or hardware vendor package.
2. According to the CompTIA Web site, “the CompTIA Security+ certification tests for security knowledge mastery of an individual with two years on-the-job networking experience, with emphasis on security.  The exam covers industry-wide topics, including communication security, infrastructure security, cryptography, access control, authentication, external attack and operational and organization security.”
3. In order to obtain the Security+ certification, applicants only have to take a single, 100-question exam within 90 minutes, offered through most online testing centers. Successful applicants score at least 764 on a scale of 100 – 900. The exam objectives focus on:
  - General security concepts (30%)
  - Communication security (20%)
  - Infrastructure security (20%)
  - Basics of cryptography (15%)
  - Operational/organizational security (15%)

Certified Computer Examiner (CCE)
1. The Certified Computer Examiner (CCE) certification is a computer forensics certification provided by the International Society of Forensic Computer Examiners. To complete the CCE certification process, the applicant must:
  - Have no criminal record
  - Meet minimum experience, training or self-training requirements
  - Abide by the certification’s code of ethical standards
  - Pass an online examination
  - Successfully perform actual forensic examinations on three test media
2. The CCE certification process covers the following areas:
  - Acquisition, marking, handling and storage of evidence procedures
  - Chain of custody
  - Essential “core” forensic computer examination procedures
  - The “rules of evidence” as they relate to computer examinations
  - Basic PC hardware construction and theory
  - Very basic networking theory
  - Basic data recovery techniques
  - Authenticating MS Word documents and accessing and interpreting metadata
  - Basic CDR recording processes and accessing data on CDR media
  - Basic password recovery techniques
  - Basic Internet issues
3. This certification also has concentrations/endorsements corresponding to various operating systems present in current business environments.  A CCE who earns three or more of these endorsements qualifies as a Master Certified Computer Examiner (MCCE).

Related Certifications
1. There are a number of certifications that are related to the field of information security or contain information security components.  The details of these certifications are varied.

Certification Costs
1. Certifications cost money, and the better certifications can be quite expensive to attain.
2. The cost for the formal training required to prepare for the certification can also be significant.
3. While these courses should not serve as the candidate’s only means of preparing for the certification exam, they can help candidates round out their knowledge and fill in gaps.
4. Even an experienced professional would find it difficult to sit for one of these exams without some preparation.
5. Many candidates teach themselves through trade press books.
6. Others prefer the structure of formal training because it includes practicing the technical components on equipment the candidate may not be able to access otherwise.
7. Before attempting a certification exam, candidates should do their homework.
8. Candidates should look at the exam criteria, purpose, and requirements in order to ensure that the time and energy they spend pursuing the certification are well spent.

Advice for Information Security Professionals
1. As a future information security professional, you can benefit from keeping the following suggestions in mind as you enter the information security job market:
  - Always remember: Business before technology
  - It’s all about the information
  - Be heard and not seen
  - Know more than you say, and be more skillful than you let on
  - Speak to users, not at them
  - Your education is never complete