I saw a message recently that DoD isn’t happy with the quality of training provided to those folks who, under DoD 8750, needed to gain certification depending on their position and functional areas. The complaint is that these certifications (and associated training/education) are producing folks who can talk the talk about security, but can’t walk the walk.
As an educator involved with information security training and education, I’m concerned with these results (perceptions). This not the 1st time I’ve heard these complaints: the head security guy at a large networking company told me that their biggest need was for people who both understood security and were capable of “system administrating” servers and the like.
Some certifications require hands-on demonstration of skills and knowledge (CCIE is one that I can think of off the top of my head): I’m sure there are others. As far as security degrees and certifications go, too many of them are based on writing papers and passing exams — the difference between knowing “that” and knowing “how.”
Some jobs may only require that you know that, and not how. I may not know the details of how to configure a Cisco switch nor a router … but I should be able to whiteboard an answer to the protocol interactions of a machine on subnet A sending a UDP packet to a machine on Subnet B through an intervening switches and router. But I should be able to say, when asked a security questions, about whether a security control would be implemented best in the switch, the router, both or neither — and be able to justify that answer.
