Industry based certifications such as (ISC)2's Certified Information Systems Security Professional (CISSP) courses are simply not enough, according to Professor Bill Caelli, the head of the software engineering and data communications school at the Queensland University of Technology.
"The CISSP is a very important start... but doesn't contribute much real world knowledge," he told ZDNet Australia at AusCERT's Ausconf security conference, describing the certification as nothing more than "an awareness raising exercise".
Management don't understand what is and isn't covered by courses such as CISSP, Caelli says.
Going one step further, Caelli has called for government regulation of security professionals.
"Industry must feel confident... I am for regulation of information security professionals who have a shingle on their door saying 'security professional,'" he said.
The idea that veterinarians, and taxi drivers are regulated and security professionals aren't doesn't make sense.
"I can control and manage critical infrastructure but I can't even fix up your pussy cat," he quipped.
Dave Dittrich, who is currently developing an information assurance curriculum for the University of Washington, echoes these sentiments. He stops short of suggesting the industry needs to be regulated.
"Regulation is a blunt instrument," he said. "The security industry changes too fast for government mandated regulation".
Just as civil engineering jobs are staffed by civil engineering graduates, Dittrich says information security roles will eventually require degree level qualifications as the discipline is standardised. He also expressed concerns over the limitations of the CISSP course.
"You have a lot of practitioners out there who've taken that [CISSP] exam... but technically they're not quite up to speed," he said.
I recently obtained my CISSP. I have to say that it isn't all that easy to achieve. I doubt that someone without a reasonable amount of experience can just pick up a book and pass the exam. I have over 17 years experience, in various aspects of IT from electronic design, coding, right through to implementing large networks with various security requirements. It still took me 6 hours to get through the 250 questions in the exam. We did attend a review course, but also did a lot of group study.
CISSP is also very broad in that is meant cover all aspects of security - from policies and procedures, through physical and logical controls, business continuity, software development practices and crypto. As a CISSP you cannot claim to be an expert ,say, in all things related crypto. (For instance you almost definitely would know the difference between assymetric and symmetric crypto, know which algorithms fit in which category, have good working knowledge of how they function. But you wouldn't be able to recite every function and operation of the algoritm to ,say, be able to code it up).
But you can say that you are a security professional that has experience (which you have to justify through work references) and knowledge (by the exam) across the wide range of security issues that will be facing organisations today. Thereby you can help customers identify their security issues and propose (and probably implement) appropriate solutions.
BTW Ask an academic crypto boffin to help a company develop a security policy or even manage a transition to become a more security-aware organisation and see how sucessful they would be. This is "real-world".