Blog

Need a CISO cert? Got $200? Get one while they’re hot…

By Mike Rothman

Evidently it’s time to rethink our business model at Securosis. All you need to do is role out a certification program and wait for money to roll in. Actually prove skills? Bah, humbug. Actually require some sort of test? Screw that. Basically all you need is a CISO job and $200, and I have a certification for you.

Your CISO cert is worth about this... But at least you'l be happy!My severe case of snark is directed at the new Certified CISO program, introduced last week by the EC-Council. Those are the folks who do the Ethical Hacker certification, which is actually a decent program. This Certified CISO program? Not so much.

How do you qualify to be a Certified CISO? Basically you need to have a pulse and a job. For the next year, all you have to do is show that you have 10 years of experience with 6 years across the 5 CISO domains (Governance, Controls and Auditing Management, Management – Projects and Ops, Security Core Competencies, Strategic Planning & Finance). Not that there isn’t something to be said about someone who decides to remain a CISO for 10+ years (besides questionable judgement), but who needs a certification to prove that?

Do you wonder why most certifications are less useful than toilet paper? At least you can wipe your backside with toilet paper. Wouldn’t your resume just suffice – since this just proves your experience? Even better is the price. You can get this critical certification for the low, low price of $350 to apply and another $200/year to renew. I’m sure Lee Kushner is quaking in his boots, as clearly Certified CISOs will now reduce the need for CISO recruiting services. Companies can now just add this term to their resume filtering machines and move on to the next position, right?

It seems the EC-Council plans to have some kind of test in 2012, although you can exempt out of that if you bother to get high-impact certifications like the CISSP, PMP, and CISA. Although it’s not clear to me how you’d build a truly objective test to show what’s really important for a CISO: persuasion skills and a very high tolerance for pain and frustration. And don’t think that we are anti-certification out of hand. We built the curriculum for the CCSK certification training program. It’s just that the certification has to have some grounding in reality. Is that too much to ask?

All I can hope is that self-respecting CISOs see through this haze and realize that more letters on their business card don’t prove anything. Or maybe I’ll just stop tilting at windmills and roll out a Certified Pragmatic CSO program. Maybe that’s the ticket.

Photo credit: “Very Happy Toilet Paper” originally uploaded by kim’n’Cris Knight

No Related Posts
Comments

I agree with u on this one,  I have no need for more letters on my BC.

However, I bet u can come up with 10 questions that would score someone on how pragmatic they appear.

By SteveA


@reppep haha thats funny, this is much cheaper and easier than a real cisco cert.

By rnlrnr


Mike,

Didn’t you notice how much their logotype for “C|CISO” looks like “CISCO”? Extra simoleons from the clueless who can’t tell the difference…

By reppep


Yup. That’s always a risk. So maybe let’s all hope that self-respecting companies realize that doing a job <> doing a job well, and being qualified. Need to take my pills before optimism gets the best of me.

By Mike Rothman


“All I can hope is that self-respecting CISO see through this haze and realize more letters on their business card doesn’t prove anything”  < Unfortunately it’s not those going for the cert that I’m worried about but the organizations that suddenly decide the cert is a qualification requirement.

By diami03


If you like to leave comments, and aren’t a spammer, register for the site and email us at info@securosis.com and we’ll turn off moderation for your account.