Which IT security certifications are considered the most difficult to obtain?
Of the security certs that I've done (CISSP, GIAC GSOC(Gold), CREST CCT ACE) I'd make the following comments
The CISSP was (when I took it about 9 years ago) quite a book-based excercise. I'm not a great fan of any exam that largely or completely depends on multiple-choice answers, as it's usually possible for a candidate to pass purely based on memorization of enough of the syllabus and also it requires the candidate to provide answers that fit with the syllabus even if they don't agree with the "correct" answer. Additionally there are a large number of CISSP "Boot Camps" which focus on getting candidates past the exam. Personally I don't regard that as an indication of a highly regarded exam.
the SANS course I took had two qualification levels, silver and gold. The silver was multiple choice (albeit open book), so some of the comments I made on the CISSP would apply here. The gold cert however required construction of a paper, which seems like a much better way of assessing a candidates understanding of the area that the exam covers.
CREST CCT was the "hardest" to obtain. There's no training courses specifically targeted at enabling people to pass it and the exam itself requires both knowledge of the domain (short form and long form questions) and practical skills that the candidate has to demonstrate in a time constrained environment. Whilst no exam is perfect, I think that this was a good way to assess this type of skill (penetration testing).