What is the value of vendor specific security certs vs. general ones?

Question

Let me preface my question by saying that I understand that experience is generally more valuable than certifications when it comes to the IT profession.

Having said that, are vendor specific security certifications, such as Cisco's CCNA & CCNP Security routes, looked at similarly when compared to more general ones such as CISSP and Security+? i.e. a security cert is a security cert? Or do employers look at something from Cisco, MS, et al. as too focused and not really adding value to the candidate, especially if they do not use that vendor's equipment?

Answer 1

Adding to the already great answers - which are all some variant of "it depends"... the "it depends" includes:

• From Lucas Kauffman - it depends on your role - many certificationes depend on the role you're applying for. Some certifications apply to specific types of security roles.

• From Eric - it's also the needs of an organization - a Cisco shop wants Cisco certs and so forth.

From me - there's also the business model of the company - these days, for example, the US defense industry requires a certain number of certified engineers for the bidding of certain proposals. So hiring (especailly at a senior level) individuals with those certs is a major bonus. In this case, it's not the nature of the work OR the role, necesarily, but a created context to show the customer the company's qualifications. I can imagine other consulting type businesses with a similar focus.

I'll even go so far as to say that when I'm reviewing a candidate's resume, I'll check whether the applicant is what I think of as a certificate "junkie". Since I often have weird teams that need to be very flexible, no one certification really does it for me... but I like to see that the person I'm talking to takes an active role in self-education and improvement. Seeing 1 certificate or similar education effort every 3 years is a good indicator. Seeing a set of alphabet soup long enough to write a novel with makes me wonder if the guy spends any time working! Usually I verify and follow up to see if there was a work context for such a thing - like a consulting role where the more certs the better...so the guy was funded to go nuts with self-study in the off season between consulting gigs.

I'll also ask "why this cert?" in the interview. Bad Answer: "Because I thought it was good to get a certificate, and everyone said this one was good for getting a new job." Good Answer: "Because the syllabus included X topic, a point I wished to know more about or thought might be a weak point in my current skill set... where I was looking to make a transition to < a role like yours > I figured I might need that." Note - whether or not the candidate is right about the needs of the role doesn't matter much to me... more that he was looking at what he really needed to supplement a weak point, and that he had a plan for growth. Bonus points either way - extra major bonus points if he's actually right about the role. :)

Answer 2

Do mind that within security there are different segments. You have:

• security analysts
• penetration testers
• forensics
• network security
• ...

When applying for a job it is important to look at the job description. If they are looking for security specialists in a networking environment then obviously a Juniper/Cisco security certificate will be plus, whereas a MS security cert will be of less value.

If you are working as a penetration tester then the OSCP/OSCE would be more appropriate.

It really depends on the job.

Some certificates like CCS or OSCE show that you are capable/willing to learn very difficult things. Which will also be considered.

Answer 3

This answer will vary widely depending on the organization. Obviously a company that is a pure Cisco shop is going to request that you have some Cisco certifications. While a company that is a Juniper shop for example will like that you have some networking certs and a good working knowledge of similar gear, but it wouldn't have as high of an impact.

That being said, I am a huge fan of the more vendor neutral certificates. The CISSP is a great certificate to show an employer that you have broad knowledge of all security aspects. Then from there, you can more easily learn security about product X or software Y. The GIAC certs are also another great example of this. Both of ISC and GIAC certs will show employers you have broad knowledge and are willing to learn. So I think they are more beneficial overall.