Cyber Security certification

[nishat15-10945]

A GUIDE TO CYBER SECURITY CERTIFICATIONS
A degree will only take you so far up the job ladder. At some point in your career, an IT security certification from a reputable third-party organization may be necessary (e.g. you're changing jobs, the job market is tight, you need experience, etc.).

Since the acronyms alone are enough to drive you nuts, we've created this short and simple guide to getting accredited. If you already know the basics, you might want to skip ahead to our breakdown of major certification organizations.

NOTE: We've also included a shortlist of relevant certifications at the bottom of each job page in our Career Path section.
SECURITY CERTIFICATIONS: WHAT YOU NEED TO KNOW
The Basics
basics

Cyber security certifications come in all shapes and subjects – from forensics to intrusion to ethical hacking. They are typically administered by independent accrediting organizations like CompTIA, EC Council, GIAC, ISACA and (ISC)2.

Accrediting organizations often divide their programs into three categories: entry level, intermediate and expert.

Entry-level certifications are meant to ground you in the basics – foundation principles, best practices, important tools, latest technologies, etc.
Intermediate and expert-level certifications presume that you have extensive job experience and a detailed grasp of the subject matter.
Regardless of the topic or level:

IT security certifications can be used across jobs and organizations.
The credentialing process usually consists of training and a final exam.
Certifications must be renewed periodically (every 3/4 years).
To be reaccredited, you'll need continuing education credits and the ability to pass the current exam.
Costs & Commitment
cost-commit

When you decide to get your cyber security certification is up to you. If you have the skills, there's nothing to stop you from starting when you're an undergraduate. A recognizable credential will burnish your résumé and catch the eye of hiring managers.

We won't blow smoke up your proverbial. Certification can be expensive and time-consuming. An entry-level credential can take three to nine months to complete and set you back $300-$600 for the exam.

However, you may not have to pay for it. Universities and employers frequently help foot the bill. In a 2014 SANS survey of cybersecurity trends:

65% of respondents reported their employers completely paid for certification training
15% of employers shared the costs
The U.S. Department of Veterans Affairs has also approved reimbursement under the G.I. Bill for some certifications. Talk to your accrediting body about funding options.

Is it worth it? If you get the right one, yes. Certification can lead to promotion, better job prospects and/or a raise. Some respondents in the SANS survey reported salary increases of up to 5% after accreditation.

Which Certification To Choose
cert-choice

When it comes to entry-level training, you might start by considering certifications such as:

CompTIA Security+
GSEC: GIAC Security Essentials Certification
SSCP: Systems Security Certified Practitioner
Take the time to compare CompTIA Security+ and GSEC. GSEC has a solid reputation within the industry and is approved for DoD 8570 Baseline Information Assurance. Alternatively, Security+ is one of the most well-known beginners' certifications. Ed Tittel of Tom's IT Pro named it to his list of Best Information Security Certifications for 2015.

Once you're through the initial hoops, certification will depend on your level of expertise and your field of interest. For example, a Penetration Tester would probably want to take a look at GPEN.

Popular industry certifications include:

CISSP: Certified Information Systems Security Professional is a high-level credential focused on security policy and management. This is the most frequently mentioned certification in the business. It was also one of the top-paying IT security certifications in 2014.
CISA: Certified Information Systems Auditor is designed for professionals who audit, control, monitor and assess information technology and business systems.
CISM: Certified Information Security Manager is geared towards people in managerial positions (e.g. CIO of IT security).
GCIH: GIAC Certified Incident Handler is for incident handlers responsible for detecting, responding to and resolving computer security incidents.
CEH: Certified Ethical Hacker is often discussed among white hat hackers and penetration testers.
OSCP: Offensive Security Certified Professional is designed for penetration testers and includes a rigorous 24 hour certification exam.
In March 2014, Burning Glass did a survey of cyber security job postings and found that CISSP, CISA, Security+, CISM and GSEC were the top 5 requested certifications.

A lot of organizations encourage you to start with their entry program and work towards more advanced credentials, but it's not always necessary to go through every level. Check the fine print on prerequisites.
source:cyberdegrees.org