- The Value of Professional Certification.
This is a subject that I receive a lot of questions
because I teach at university.
At the same time,
I also invest a lot on taking certification.
So there is a lot of question that comes up,
which is certification versus formal degree,
and what is really the value of certification, right?
So it's important for you to understand.
One does not conflict with the other.
It shouldn't be a competition between those two things.
Now, if you think about which one you should pursue,
the answer is it depends.
It depends on your goal, it depends on your strategy.
If you are looking for short-term gains,
the certification may be the best option.
And the reason why is because a lot of organizations,
they do not have requirements such as bachelor degree.
Now, if one of the requirements for the job
is for you to have the bachelor degree,
then, of course, the formal degree is the way to go.
But they should be complementary because here's the thing.
The certification gives you the accreditation
from a specific body of knowledge.
It could be a vendor-neutral type of certification
or it could be a vendor type of certification.
The thing is, when you are applying for a job
and the job says,
"The requirement is to have the following certifications,"
then there is no other alternative for you
other than having those certifications
if you want to be successful during the interview.
Now, you have to look at the job requirement
and what it really says because sometimes it says desirable.
In other words, it's good if you have it,
but it's not required, mandatory, right?
So you have to be very careful
because those slightly change in wording
can mean something completely different
from the expectation of the interviewer.
Of course, if you have,
in both scenarios it's always a good thing.
That's why I say you should invest on both.
You should have your formal degree
and you should have the certifications
that are valuable for you.
Now, it doesn't mean
you should take all the certification available.
You have gotta be strategic,
you've gotta invest your time correctly.
So think about that.
Focus on what is important for you.
Don't go out and start doing all the certification
just for the sake of having certification
because it makes no sense.
Time is money.
You have to invest your time in the right place
and in the right set of certifications.
So make sure you're doing the right thing
and the only person that can guide you through that is you
because only you know where you wanna be.
Only you know what you want to achieve.
So be careful where you invest your time
when it comes to certification.
There are different types of certifications too.
There are what we call the foundation certifications,
and I'm gonna give some examples here
of vendor-neutral type of certification,
such as the ISACA Cybersecurity Fundamentals.
This is a great certification to get started
because it has it offer a very well-known
set of capabilities that you're gonna learn.
Fundamental things such as security asset,
information security fundamentals,
security operations and response, and threat landscape.
So it is very broad and it gives you really a good idea.
Not only that,
but it's offered by a very well-known organization
with more than 50 years in the market,
which is the Information System Auditing
and Control Association, ISACA.
So think about this one.
If you have no experience in cybersecurity,
I would say this one is a really good one.
The other one is really good too.
It's the ISC2 Certified in Cybersecurity.
It's kind of new.
This certification is not too old,
but it's offered by one of the main
industry-leading certification organization,
which is the International Information System
Security Certification Consortium.
ISC2 is a very reputable organization
and very well-respected
across the entire cybersecurity industry.
So everyone knows who is ISC2.
This certification, as I said, is kind of new,
but it does cover a very good amount of things,
such as security principles,
network security access control, security operations,
business continuity, disaster recovery,
and incident response.
So that's another alternative that you can choose.
You don't have to to do it all, right?
You don't have to do it all
because they are all Foundational.
The other one is the Cyber and IT Security Foundation
by Exin.
This one, it's really interesting, this certification.
Exin is also very well-known organization
with more than 3 million certified professionals
in different areas worldwide.
Very well recognized, too.
But this one has something in particular,
and here's why I say this one is very peculiar
is because it has TCP/IP networking concepts,
and I think this is super important.
So if you have no knowledge
or very little knowledge about core network infrastructure,
this one might be a good for you
because you're gonna learn about TCP/IP networking,
you're gonna learn
about compute computer systems in general,
applications and database, cryptography,
identity, cloud computing,
exploitation of vulnerabilities.
So it's very complete.
It's very complete.
When I look at this one compared to the other two,
the Certified in Cybersecurity
and the Cybersecurity Fundamentals by ISACA,
I usually say, "Well, if you are raw
and you don't really have a lot of knowledge,
this one is a good one to start."
Again, because it has the core TCP/IP stack cover.
The Security+ certification
is something that is very near to my heart
because it was my first cybersecurity certification
back in 2006.
It was this first cybersecurity certification that I got
because I wanted to have
this vendor-neutral type of approach
to understand the terminologies.
So that's the good thing about certification.
Certification allows you to have a roadmap.
And at the end of the roadmap,
you take the exam and you get the certification, right?
So if you use the certification with the intent of learning
and then the certification
becomes basically a consequence of learning,
it's much easier
because you are going to learn all those concepts,
and then the certification becomes just a consequence
of learning all those things.
You're gonna take the exam, you're gonna pass, right?
But this one, I like it,
and it grew a lot over the years
because now it covers things
that were not even imaginable in the past.
Now, it covers attacks, threats, and vulnerabilities.
It covers the architecture
and design of the network from the security perspective.
It covers the implementation of some of the things,
the operations and incident response,
and the governance, and risk and compliance.
So it's very complete,
and a lot of folks think that out of those
is probably one of the most difficult ones.
So you could do, for example,
the Exin one to get started and then Security+,
or you could do a Cybersecurity from ISC2
and then the Security+.
You could definitely do two out of those,
but not all of them is really not necessary.
The last one is the EC-Council Security Specialist.
This one here from EC-Council,
which is also a well-known organization,
which I actually teach at EC-Council University
as a professor on this Bachelor's Degree in Cybersecurity.
This one is very interesting too
because it covers in more details,
and EC-Council tends to be more kind of hands-on-oriented
where you have a lot of details.
So this one covers the Network Fundamentals,
which is good too.
It covers the threats and attacks in general, wireless VPN.
It covers ethical hacking a little bit.
It covers a little bit of pen testing.
So this one is very broad across many things.
So the amount of things that covers a little bit broader
than our other ones.
So that could be a second option as well.
And then we go to what we call the Cybersecurity Analysts
and Security Practitioners,
which are cybersecurity certification,
a little bit more advanced.
So this one, definitely,
you don't jump into those certification
without having the Foundational.
Make sure that you have the Foundation,
at least one of those.
Choose one of those.
If you wanna choose two, it's fine,
but at least one of those.
Take that and then go next,
which is the Cybersecurity Analyst
and Security Practitioners.
The first one, which is the CySA+ is really good.
It is one of the most interesting certifications
that I've taken from CompTIA
because it has some hands-on activities,
which is really cool.
So when you are doing the exam,
you're going to notice that there are scenarios,
emulation scenarios that you need to interact
and do something.
So it covers threats and vulnerability management,
it covers soft and system security, security operations,
incident response, compliance and assessments.
The amount of topics is very rich,
but also the way that you're gonna take the exam.
Because while there are...
Most of the questions are multiple choices,
as I said, there are questions
where it's gonna show you a log file,
and they're gonna ask you a question based on that log file,
or you're gonna show a file log
and guide you to do something based on that file logs.
There are questions that you have to interact with as well.
So it was very rich.
The other one is the Systems Security Certified Practitioner
from ICS2.
This one also is not to owed.
This certification
was created with the intent of meeting
the US Department of Defense, DoD, Directive 8570.01.
It's really good one for practitioners.
It's more advanced than the Foundational one
that covers access control,
security operations in administration,
risk identification, monitoring analysis,
incident response, of course,
and recovery, cryptography, network and communication,
and system application security.
So very rich, very rich.
And of course it's offered by ISC2,
which is the best in the industry for that.
The next one is the Certified Cybersecurity Technician.
As the name says, technician.
So this is more,
I would say, if you think about levels, right?
Level 1, Tier 1, Tier 2, and Tier 3
from the security SOC analyst perspective.
This is more that frontline security technician,
the cybersecurity technician that will interact most likely
with the end user,
and we will do some hands-on and things like that.
It's a good certification
if that's your entry level that you're thinking about.
Other certifications that you also can think
because it's a roadmap, right?
You did the Foundational, you did the Cybersecurity Analyst,
and now you are going to the Specializations.
Now, the Specialization, there are many,
and you have to think about:
What do you want to do?
Because now that you've done the Foundational
and the Cybersecurity Analyst,
now you have all this range of things in your hands,
like, "Okay, I know all this.
Which specialization do I want to reinvest my time?"
So it could be red team.
You can think about, "Oh, I want to work with pen test.
I want to be a pen tester.
I want to work with the red team,
or I want to work with the blue team,
or I want to work with cloud security."
So all those things, you have to think about, right?
What is the other specialization?
So in the book,
there is a table that covers all the categories.
So for example, for red team and pen test,
there is the GIAC Penetration Test,
there is the CompTIA PenTest+,
there is the OSCP from Offensive Security,
which is a very difficult certification
because it's a fully hands-on.
And many others that you can see in the table in the book.
But the point is not even the certification.
The point is what do you want to do next?
That's why this should be part of your plan.
Not the short-term plan, but the long-term plan.
Because it's your vision,
it's your roadmap of how you're gonna evolve in the field.
You could evolve to digital forensics
if that's what you want to do.
You want to invest on digital forensics.
Well, there is the CIHFI certification from EC-Council
the GIAC Certified Forensic Examiner from GIAC.
There are many, right?
Is that what you really want to do in your career?
Because if it is not,
those certification can cost a lot of money
not only from the preparation perspective,
but from the time and the cost of the exam.
So don't invest on something that you're not gonna use,
unless you have plenty of time and money, right?
Which is mostly not the case
because you have a very limited amount of time
to invest on your future.
Cybersecurity architects, security managers and leaders,
that's another thing too.
If you are already in the field
and you want to to move on to the next level
and become a manager, maybe,
you want you to to spend some time studying
for some CSO type of certification,
that's an option as well.
And then there is the vendor-specific certifications, okay?
All those that I mentioned, they are vendor-agnostic
because they are offered by enterprise industry
that has no connection with any vendor.
Now, there are vendors such as Microsoft, such as Amazon,
that they have their own certification,
their own track for their products.
Because both providers, they have security solutions.
So they do have security certifications.
When should you go here?
Again, it depends.
Maybe for example, your roadmap says,
"I'm gonna take the Foundational,
then the Cybersecurity Analyst,
and after that I'm not gonna go to the Specialization.
I'm gonna go to the vendor
because I've seen a lot of opportunities
to work in Azure security.
So I'm gonna go and take some Azure Security certifications.
Now, I have the Foundation,
I have the Analyst, and the Vendor."
I have very complete portfolio
from the knowledge perspective and from the accreditation.
Again, I'm always emphasizing the knowledge
because you cannot think of certification
as a way only to have your accreditation.
You have to think about, "Okay, what is the...
What I'm going to learn as I study to the certification?"
Remember, it's not only about the destination,
it's about what you become
as you prepare to get to that destination.
So think about that, too.
Google is another one, right?
So if you think about the major cloud providers,
they all have certifications.
If you are going to work in a company
that has a GCP, Google Cloud,
then you have to probably invest
in Google Cloud certification.
So think of the opportunities and options available.