Cybersecurity is a hot career choice more so today than ever before. With millions of people having their identities stolen, financial information breached, and private health records leaked, there is a great need for cybersecurity professionals. Every year there is a new security breach, Target, JP Morgan Chase, Office of Personnel Management (OPM), Michael’s, eBay and Equifax… it is becoming difficult to keep track of them all. It has come to the point where I get a letter in the mail from XYZ company stating they have potentially been hacked and “here’s what to do” along with a free year of identity theft protection, and I just yawn. That’s bad: Apathy towards security is a depressing state of mind to be in. It has become so commonplace that I sometimes wonder what companies, especially big-time companies, are doing to mitigate these risks. Can a company be so secure that they are never hacked? The idea of a perfect security solution is a pipe dream. The problem lies with the fact that the company has to ensure they are secure 100% of the time and the attacker just needs to be 1% successful in order to create a massive breach.
How can we ensure thatorganizations are secure from malicious attacks? Finding the best and most experienced staff is the very first and maybe the most important step. As a hiring manager there are only a couple of ways to identify whether a prospective candidate will fill the intended role with success. One way is to vet their background and experience with a fine-toothed comb.To ensure candidates have the right skills, requiring specific security related certifications is also key. There are many security certifications out there, but not all are created equal. You don’t want a candidate with only Security+ running your Security Operations Center (SOC). Let’s look at what I believe are the top five security certifications (in no particular order).
Top 5 Security Certifications for 2019
1. Certified Ethical Hacker (CEH)
The CEH has become one of the most sought after certifications in the security field. Created by EC-Council, the CEH exam will test your ability to work as a penetration tester by utilizing tools and skills learned through official courseware. An ethical hacker is a trusted adviser to a company looking to test its security posture. To become a CEH, you must fill out an application with EC-Council and pay the registration fee of $100. The exam is made up of multiple choice questions which you will have four hours to complete. The exam costs $450 USD to take and the passing score is based on the exam version that you get. Questions are weighted differently than others depending on their level of difficulty. Check out EC-Council’s website for more info on the CEH cert. Click here for CEH job opportunities.
2. CompTIA Security+
If there is one certification everyone in the IT field should have, Security+ is it. Most tout the Security+ exam as an entry level security certification. CompTIA has been putting out great certifications for years and Security+ is one of their best and most sought after. The rise of the DoD 8570 compliance requirements has made the Security+ certification a must have as it meets the IAT Level II tier of required certifications. The exam covers topics such as physical security, biometrics, hashing, password complexity, and security concepts. The cost for the exam is $339 and it consists of 90 questions which are graded on a scale of 100-900. The passing score is 750 and you will have 90 minutes to complete the exam. Click here for Security+ job opportunities.
3. Certified Information Systems Security Professional (CISSP)
The CISSP certification is a very well respected cert, due in part to the difficulty of the exam and the breadth of knowledge needed to pass the exam. According the ISC2, “Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program.” The CISSP certification is an advanced cert, meant primarily for Chief Information Security Officers, Security Managers, Directors of Security, IT Directors/Managers and Security Consultants. Like Security+, the CISSP is 8570.1 compliant at IASAE Level I, II and III. The exam consists of 100 to 150 questions which you will have 3 hours to work through and complete. A passing score of 700 out of a possible 1000 is required. Click here for CISSP job opportunities.
4. GIAC Certified Incident Handler (GCIH)
The GCIH has become one of the most prestigious security certifications available today. GCIH certification validates your skills as an incident handler and a trusted advisor in the event there is a security breach. While the idea of being an incident handler leads you to believe it is a reactionary role, the GCIH is both a preventative and reactionary role. You cannot be an incident handler without understanding what incidents you might encounter and how to react to them. Items you will be tested on and expected to know are DNS, DNS zones misconfiguration, using tools such as nslookup and dig. Other exam topics will include knowledge of vulnerability scanning tools such as Nessus and others. Having knowledge of the types of worms that exist and how they interact with your systems once infected will also come in handy for the exam. The exam consists of 150 questions and 4 hours to complete them. The passing score for the exam is 73%. Click here for GCIH job opportunities.
5. CCNA Cyber Ops
The gold standard for networking certifications is the Cisco Certified Networking Associate (CCNA). The CCNA isn’t necessarily an entry level certification even though Cisco markets it as such. There are several different CCNA exams with the CCNA Cyber Ops being focused primarily on networking security. The Cyber Ops cert will help security professionals gain a foothold in the cybersecurity career field. According to Cisco’s website, the CCNA Cyber Ops cert, “prepares candidates to being a career working with associate-level cybersecurity analysts within security operations centers.” The CCNA Cyber Ops cert is compliant with the DoD 8570.01 requirement at the CSSP Analyst and CCSP Incident Responder categories. In order to earn the CCNA Cyber Ops cert you must pass two exams, the 210-250 SECFND and the 210-255 SECOPS exam. For more information on the exams and their make-up, visit Cisco’s website. Click here for CCNA Cyber Ops job opportunities.
Chart Your Path
There are so many good security certifications to choose from, this list is just scratching the surface with the top five. Do your research and visit sites such as CompTIA, Cisco, ISC2, EC-Council and others to get an idea of what security certifications are available. Cross reference the available certifications with the path you want your career to take to get the best idea of where to start. Certifications require a significant investment in your time and money, so choose wisely.
