Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Which IT security certifications are considered the most difficult to obtain?

share|improve this question

closed as not constructive by Rory Alsop Nov 28 '11 at 20:27

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

up vote 4 down vote accepted

Of the security certs that I've done (CISSP, GIAC GSOC(Gold), CREST CCT ACE) I'd make the following comments

  • The CISSP was (when I took it about 9 years ago) quite a book-based excercise. I'm not a great fan of any exam that largely or completely depends on multiple-choice answers, as it's usually possible for a candidate to pass purely based on memorization of enough of the syllabus and also it requires the candidate to provide answers that fit with the syllabus even if they don't agree with the "correct" answer. Additionally there are a large number of CISSP "Boot Camps" which focus on getting candidates past the exam. Personally I don't regard that as an indication of a highly regarded exam.

  • the SANS course I took had two qualification levels, silver and gold. The silver was multiple choice (albeit open book), so some of the comments I made on the CISSP would apply here. The gold cert however required construction of a paper, which seems like a much better way of assessing a candidates understanding of the area that the exam covers.

  • CREST CCT was the "hardest" to obtain. There's no training courses specifically targeted at enabling people to pass it and the exam itself requires both knowledge of the domain (short form and long form questions) and practical skills that the candidate has to demonstrate in a time constrained environment. Whilst no exam is perfect, I think that this was a good way to assess this type of skill (penetration testing).

share|improve this answer
1  
Agree on the CISSP - it was a very easy and quick exam (you get up to 6 hours, but if you do technical security work as your day job you can sit it in little over an hour) –  Rory Alsop Nov 27 '11 at 17:19

The consideration of your peers !

share|improve this answer
    
+1! I'm tempted to accept this answer, but even though having peers vouch for you is often better than a certification...this still isn't technically a certification. –  user389823 Nov 27 '11 at 1:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.