Comments on: Information Security: Comparing the CISSP and GSEC Certifications http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications grep understanding Fri, 25 May 2012 02:15:50 +0000 hourly 1 http://wordpress.org/?v=3.3.2 By: Matt K http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-244452 Matt K Thu, 29 Apr 2010 22:26:39 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-244452 <p>"...but keep in mind that the first time pass rate is over 70%"<br><br>I'd like to know your source for this statistic, especially since ISC2 does not publish pass/fail rates.<br><br><br>"Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials."<br><br>Not sure how that's possible seeing as how no one has professional depth in all 10 domains. Maybe you got lucky and your particular test happened to be geared more toward your strengths...who knows? Anyway, I'm still skeptical of this claim.</p> “…but keep in mind that the first time pass rate is over 70%”

I'd like to know your source for this statistic, especially since ISC2 does not publish pass/fail rates.


“Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials.”

Not sure how that's possible seeing as how no one has professional depth in all 10 domains. Maybe you got lucky and your particular test happened to be geared more toward your strengths…who knows? Anyway, I'm still skeptical of this claim.

]]> By: Matt K http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-244156 Matt K Thu, 29 Apr 2010 17:26:39 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-244156 <p>"...but keep in mind that the first time pass rate is over 70%"<br><br>I'd like to know your source for this statistic, especially since ISC2 does not publish pass/fail rates.<br><br><br>"Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials."<br><br>Not sure how that's possible seeing as how no one has professional depth in all 10 domains. Maybe you got lucky and your particular test happened to be geared more toward your strengths...who knows? Anyway, I'm still skeptical of this claim.</p> “…but keep in mind that the first time pass rate is over 70%”

I'd like to know your source for this statistic, especially since ISC2 does not publish pass/fail rates.


“Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials.”

Not sure how that's possible seeing as how no one has professional depth in all 10 domains. Maybe you got lucky and your particular test happened to be geared more toward your strengths…who knows? Anyway, I'm still skeptical of this claim.

]]> By: Henry Dunn http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-241926 Henry Dunn Fri, 06 Mar 2009 22:31:56 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-241926 <p>I would agree with the ascertion that the CISSP is non technical, management oriented and the GSEC is technical. Both are neccesary, both are equally important and neither can really be compared to the other effectively. They both clearly serve different purposes. That would be like comparing the A+ with the MCSE. Not really apples apples here.</p> I would agree with the ascertion that the CISSP is non technical, management oriented and the GSEC is technical. Both are neccesary, both are equally important and neither can really be compared to the other effectively. They both clearly serve different purposes. That would be like comparing the A+ with the MCSE. Not really apples apples here.

]]> By: Henry Dunn http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-240884 Henry Dunn Fri, 06 Mar 2009 17:31:56 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-240884 <p>I would agree with the ascertion that the CISSP is non technical, management oriented and the GSEC is technical. Both are neccesary, both are equally important and neither can really be compared to the other effectively. They both clearly serve different purposes. That would be like comparing the A+ with the MCSE. Not really apples apples here.</p> I would agree with the ascertion that the CISSP is non technical, management oriented and the GSEC is technical. Both are neccesary, both are equally important and neither can really be compared to the other effectively. They both clearly serve different purposes. That would be like comparing the A+ with the MCSE. Not really apples apples here.

]]> By: Jack Campbell http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-206806 Jack Campbell Tue, 30 Sep 2008 03:36:43 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-206806 <p>Ok it is pretty fun reading the posts comparing SANS testing with the CISSP then throwing the CCNA into the mix. I had my CCNA back in 2000 I was forced to recert for a new job this year. I also have my GCIH, CEH and CISSP and I do not believe that the CCNA test has gotten any harder. I had just finished studying for the CISSP and had no desire to study again. Picked up the book for the CCNA and looked at it for 10 minutes. Took the practice tests at the end of two chapters got 90+% and decided I would take the test without studying. Needless to say I passed very easily. I love Dan's comments about the CISSP, I am mentoring the MGT 414 for SANS and it is truly like the SAT. No depth, nothing that I feel like gives me some hard skills that I can implement with in my job. But I do know I have learned about areas of security that I wouldn't have ever learned anything about if it wasn't for the CISSP.</p> <p>You want to turn the wrenches take a SANS exam, you want to have a broad range of knowledge focus on the CISSP. Let's not even bring the CEH into this conversation let alone the Security+</p> Ok it is pretty fun reading the posts comparing SANS testing with the CISSP then throwing the CCNA into the mix. I had my CCNA back in 2000 I was forced to recert for a new job this year. I also have my GCIH, CEH and CISSP and I do not believe that the CCNA test has gotten any harder. I had just finished studying for the CISSP and had no desire to study again. Picked up the book for the CCNA and looked at it for 10 minutes. Took the practice tests at the end of two chapters got 90+% and decided I would take the test without studying. Needless to say I passed very easily. I love Dan’s comments about the CISSP, I am mentoring the MGT 414 for SANS and it is truly like the SAT. No depth, nothing that I feel like gives me some hard skills that I can implement with in my job. But I do know I have learned about areas of security that I wouldn’t have ever learned anything about if it wasn’t for the CISSP.

You want to turn the wrenches take a SANS exam, you want to have a broad range of knowledge focus on the CISSP. Let’s not even bring the CEH into this conversation let alone the Security+

]]> By: Jack Campbell http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249143 Jack Campbell Tue, 30 Sep 2008 03:36:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249143 <p>Ok it is pretty fun reading the posts comparing SANS testing with the CISSP then throwing the CCNA into the mix. I had my CCNA back in 2000 I was forced to recert for a new job this year. I also have my GCIH, CEH and CISSP and I do not believe that the CCNA test has gotten any harder. I had just finished studying for the CISSP and had no desire to study again. Picked up the book for the CCNA and looked at it for 10 minutes. Took the practice tests at the end of two chapters got 90+% and decided I would take the test without studying. Needless to say I passed very easily. I love Dan's comments about the CISSP, I am mentoring the MGT 414 for SANS and it is truly like the SAT. No depth, nothing that I feel like gives me some hard skills that I can implement with in my job. But I do know I have learned about areas of security that I wouldn't have ever learned anything about if it wasn't for the CISSP.</p> <p>You want to turn the wrenches take a SANS exam, you want to have a broad range of knowledge focus on the CISSP. Let's not even bring the CEH into this conversation let alone the Security+</p> Ok it is pretty fun reading the posts comparing SANS testing with the CISSP then throwing the CCNA into the mix. I had my CCNA back in 2000 I was forced to recert for a new job this year. I also have my GCIH, CEH and CISSP and I do not believe that the CCNA test has gotten any harder. I had just finished studying for the CISSP and had no desire to study again. Picked up the book for the CCNA and looked at it for 10 minutes. Took the practice tests at the end of two chapters got 90+% and decided I would take the test without studying. Needless to say I passed very easily. I love Dan’s comments about the CISSP, I am mentoring the MGT 414 for SANS and it is truly like the SAT. No depth, nothing that I feel like gives me some hard skills that I can implement with in my job. But I do know I have learned about areas of security that I wouldn’t have ever learned anything about if it wasn’t for the CISSP.

You want to turn the wrenches take a SANS exam, you want to have a broad range of knowledge focus on the CISSP. Let’s not even bring the CEH into this conversation let alone the Security+

]]> By: Tone http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-158871 Tone Thu, 10 Jul 2008 02:52:13 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-158871 <p>Bee said "The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP." </p> <p>That's funny. Go to usajobs.gov and do a search on CISSP and then go back and do a search on GIAC or GSEC and you will find 1 result and that 1 result for GIAC states that a CISSP is required. By the way, the CISSP search gave me 93 results. </p> <p>'Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification.' Where are you getting this info from? You have to earn CPE credits after you pass the CISSP to maintain the cert or you have to retake it 3 years later. Unless you consider 3 years a lifetime, please update your resources.</p> <p>I passed Security+ in 15 minutes after studying for the CISSP.</p> Bee said “The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP.”

That’s funny. Go to usajobs.gov and do a search on CISSP and then go back and do a search on GIAC or GSEC and you will find 1 result and that 1 result for GIAC states that a CISSP is required. By the way, the CISSP search gave me 93 results.

‘Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification.’ Where are you getting this info from? You have to earn CPE credits after you pass the CISSP to maintain the cert or you have to retake it 3 years later. Unless you consider 3 years a lifetime, please update your resources.

I passed Security+ in 15 minutes after studying for the CISSP.

]]> By: Tone http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249142 Tone Thu, 10 Jul 2008 02:52:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249142 <p>Bee said "The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP." </p> <p>That's funny. Go to usajobs.gov and do a search on CISSP and then go back and do a search on GIAC or GSEC and you will find 1 result and that 1 result for GIAC states that a CISSP is required. By the way, the CISSP search gave me 93 results. </p> <p>'Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification.' Where are you getting this info from? You have to earn CPE credits after you pass the CISSP to maintain the cert or you have to retake it 3 years later. Unless you consider 3 years a lifetime, please update your resources.</p> <p>I passed Security+ in 15 minutes after studying for the CISSP.</p> Bee said “The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP.”

That’s funny. Go to usajobs.gov and do a search on CISSP and then go back and do a search on GIAC or GSEC and you will find 1 result and that 1 result for GIAC states that a CISSP is required. By the way, the CISSP search gave me 93 results.

‘Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification.’ Where are you getting this info from? You have to earn CPE credits after you pass the CISSP to maintain the cert or you have to retake it 3 years later. Unless you consider 3 years a lifetime, please update your resources.

I passed Security+ in 15 minutes after studying for the CISSP.

]]> By: Bee http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-153888 Bee Mon, 23 Jun 2008 05:08:28 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-153888 <p>The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP. That should be a strong indication that the industry is starting to put the GSEC ahead of the CISSP. Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification. What I have notices is that many CISSP "professionals" know very little about a lot. Where someone who has the GSEC knows a lot about a lot. Looking at recent jon postings you can ever see things like "CISSP or Security+ required." The CISSP is losing ground to Security+, GSEC, CCNA and others which it should!</p> The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP. That should be a strong indication that the industry is starting to put the GSEC ahead of the CISSP. Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification. What I have notices is that many CISSP “professionals” know very little about a lot. Where someone who has the GSEC knows a lot about a lot. Looking at recent jon postings you can ever see things like “CISSP or Security+ required.” The CISSP is losing ground to Security+, GSEC, CCNA and others which it should!

]]> By: Bee http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249141 Bee Mon, 23 Jun 2008 05:08:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249141 <p>The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP. That should be a strong indication that the industry is starting to put the GSEC ahead of the CISSP. Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification. What I have notices is that many CISSP "professionals" know very little about a lot. Where someone who has the GSEC knows a lot about a lot. Looking at recent jon postings you can ever see things like "CISSP or Security+ required." The CISSP is losing ground to Security+, GSEC, CCNA and others which it should!</p> The Department of Defense and others are nowing training their security officers with the GSEC bootcamps instead of the CISSP. That should be a strong indication that the industry is starting to put the GSEC ahead of the CISSP. Besides the GSEC must be taken every 4 years where the CISSP is a lifelong certification. What I have notices is that many CISSP “professionals” know very little about a lot. Where someone who has the GSEC knows a lot about a lot. Looking at recent jon postings you can ever see things like “CISSP or Security+ required.” The CISSP is losing ground to Security+, GSEC, CCNA and others which it should!

]]> By: DO http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-115538 DO Mon, 21 Jan 2008 20:50:29 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-115538 <p>Infosecwriter, drop the agenda. The simple fact is that (whether or not he has it... who cares) many people have said the same thing... just Google CISSP and GSec. I have been in the industry for more than seven years now... the CISSP exam took me less than 1.5 hours, including double-checking my answers and work. It is a fairly simple exam... I learned nothing in the bootcamp (and made everyone save the teacher angry because I knew all of the answers and he and I kept going into in-depth discussions).</p> <p>The CISSP is a weak exam because it is non-technical and covers many topics, but few things. No depth. What little depth it attempts to provide is generally wrong, though. For example, my exam had a question concerning buffer overflows and how to "prevent" them. The only somewhat correct answer is to check the range and offset, but even that's not right. In all of the domains, excluding BC and DR, the CISSP has very little information, depth, or knowledge.</p> <p>Also, just to weigh in on the CCNA thing (I agree it's completely different), I took the CCNA 1/2/3/4 route through Cisco's Networking Academy, which taught me a wealth of information that I retain today and has helped me through my college studies, work, and my research. CISSP has done nothing for me. In my case, I got the CCNA through a respectable means, rather than simply passing the exam, and I learned the most; I didn't learn anything in the CISSP bootcamp and and no issues with ANY of the CISSP exam questions (save 2 that made no sense... the English was completely messed up).</p> <p>My ultimate point is that certifications should mean nothing to you... it's the knowledge. Anyone can pass an exam (I know CISSPs who couldn't tell you the difference between a router, switch, lvl4 switch, lvl3 switch, hub, repeater, and bridge.... I know CCNAs who couldn't either). I recommend that you take classes, go to University (and apply yourself), and participate in research. Certifications and ceritificates are pointless and don't help you grow... when companies figure this out, we'll see a dramatic shift in work quality and fewer losers in our fields (I do application PT, Web-based application PT, network PT, OS PT, and vulnerability assessments for a living).</p> Infosecwriter, drop the agenda. The simple fact is that (whether or not he has it… who cares) many people have said the same thing… just Google CISSP and GSec. I have been in the industry for more than seven years now… the CISSP exam took me less than 1.5 hours, including double-checking my answers and work. It is a fairly simple exam… I learned nothing in the bootcamp (and made everyone save the teacher angry because I knew all of the answers and he and I kept going into in-depth discussions).

The CISSP is a weak exam because it is non-technical and covers many topics, but few things. No depth. What little depth it attempts to provide is generally wrong, though. For example, my exam had a question concerning buffer overflows and how to “prevent” them. The only somewhat correct answer is to check the range and offset, but even that’s not right. In all of the domains, excluding BC and DR, the CISSP has very little information, depth, or knowledge.

Also, just to weigh in on the CCNA thing (I agree it’s completely different), I took the CCNA 1/2/3/4 route through Cisco’s Networking Academy, which taught me a wealth of information that I retain today and has helped me through my college studies, work, and my research. CISSP has done nothing for me. In my case, I got the CCNA through a respectable means, rather than simply passing the exam, and I learned the most; I didn’t learn anything in the CISSP bootcamp and and no issues with ANY of the CISSP exam questions (save 2 that made no sense… the English was completely messed up).

My ultimate point is that certifications should mean nothing to you… it’s the knowledge. Anyone can pass an exam (I know CISSPs who couldn’t tell you the difference between a router, switch, lvl4 switch, lvl3 switch, hub, repeater, and bridge…. I know CCNAs who couldn’t either). I recommend that you take classes, go to University (and apply yourself), and participate in research. Certifications and ceritificates are pointless and don’t help you grow… when companies figure this out, we’ll see a dramatic shift in work quality and fewer losers in our fields (I do application PT, Web-based application PT, network PT, OS PT, and vulnerability assessments for a living).

]]> By: DO http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249140 DO Mon, 21 Jan 2008 20:50:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249140 <p>Infosecwriter, drop the agenda. The simple fact is that (whether or not he has it... who cares) many people have said the same thing... just Google CISSP and GSec. I have been in the industry for more than seven years now... the CISSP exam took me less than 1.5 hours, including double-checking my answers and work. It is a fairly simple exam... I learned nothing in the bootcamp (and made everyone save the teacher angry because I knew all of the answers and he and I kept going into in-depth discussions).</p> <p>The CISSP is a weak exam because it is non-technical and covers many topics, but few things. No depth. What little depth it attempts to provide is generally wrong, though. For example, my exam had a question concerning buffer overflows and how to "prevent" them. The only somewhat correct answer is to check the range and offset, but even that's not right. In all of the domains, excluding BC and DR, the CISSP has very little information, depth, or knowledge.</p> <p>Also, just to weigh in on the CCNA thing (I agree it's completely different), I took the CCNA 1/2/3/4 route through Cisco's Networking Academy, which taught me a wealth of information that I retain today and has helped me through my college studies, work, and my research. CISSP has done nothing for me. In my case, I got the CCNA through a respectable means, rather than simply passing the exam, and I learned the most; I didn't learn anything in the CISSP bootcamp and and no issues with ANY of the CISSP exam questions (save 2 that made no sense... the English was completely messed up).</p> <p>My ultimate point is that certifications should mean nothing to you... it's the knowledge. Anyone can pass an exam (I know CISSPs who couldn't tell you the difference between a router, switch, lvl4 switch, lvl3 switch, hub, repeater, and bridge.... I know CCNAs who couldn't either). I recommend that you take classes, go to University (and apply yourself), and participate in research. Certifications and ceritificates are pointless and don't help you grow... when companies figure this out, we'll see a dramatic shift in work quality and fewer losers in our fields (I do application PT, Web-based application PT, network PT, OS PT, and vulnerability assessments for a living).</p> Infosecwriter, drop the agenda. The simple fact is that (whether or not he has it… who cares) many people have said the same thing… just Google CISSP and GSec. I have been in the industry for more than seven years now… the CISSP exam took me less than 1.5 hours, including double-checking my answers and work. It is a fairly simple exam… I learned nothing in the bootcamp (and made everyone save the teacher angry because I knew all of the answers and he and I kept going into in-depth discussions).

The CISSP is a weak exam because it is non-technical and covers many topics, but few things. No depth. What little depth it attempts to provide is generally wrong, though. For example, my exam had a question concerning buffer overflows and how to “prevent” them. The only somewhat correct answer is to check the range and offset, but even that’s not right. In all of the domains, excluding BC and DR, the CISSP has very little information, depth, or knowledge.

Also, just to weigh in on the CCNA thing (I agree it’s completely different), I took the CCNA 1/2/3/4 route through Cisco’s Networking Academy, which taught me a wealth of information that I retain today and has helped me through my college studies, work, and my research. CISSP has done nothing for me. In my case, I got the CCNA through a respectable means, rather than simply passing the exam, and I learned the most; I didn’t learn anything in the CISSP bootcamp and and no issues with ANY of the CISSP exam questions (save 2 that made no sense… the English was completely messed up).

My ultimate point is that certifications should mean nothing to you… it’s the knowledge. Anyone can pass an exam (I know CISSPs who couldn’t tell you the difference between a router, switch, lvl4 switch, lvl3 switch, hub, repeater, and bridge…. I know CCNAs who couldn’t either). I recommend that you take classes, go to University (and apply yourself), and participate in research. Certifications and ceritificates are pointless and don’t help you grow… when companies figure this out, we’ll see a dramatic shift in work quality and fewer losers in our fields (I do application PT, Web-based application PT, network PT, OS PT, and vulnerability assessments for a living).

]]> By: Network Security Blog » Network Security Podcast, Episode 75 http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-110434 Network Security Blog » Network Security Podcast, Episode 75 Sat, 05 Jan 2008 21:32:45 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-110434 <p>[...] Information Security: Comparing the CISSP and GSEC certifications [...]</p> [...] Information Security: Comparing the CISSP and GSEC certifications [...]

]]> By: JeffBolden.net » Security Certs: Oh How I Love/Loath Thee… http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-80029 JeffBolden.net » Security Certs: Oh How I Love/Loath Thee… Fri, 07 Sep 2007 11:14:33 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-80029 <p>[...] interest (and some amusement) that I was following the recent comments between Daniel Miessler (original post and followup) and Marty McKeay (here and here) in regards to the comparisons/differences between [...]</p> [...] interest (and some amusement) that I was following the recent comments between Daniel Miessler (original post and followup) and Marty McKeay (here and here) in regards to the comparisons/differences between [...]

]]> By: dmiessler.com | More Refined Thoughts on the CISSP http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-79186 dmiessler.com | More Refined Thoughts on the CISSP Mon, 03 Sep 2007 23:56:31 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-79186 <p>[...] have been taking a bit of flak regarding my post comparing the CISSP to the GSEC. It’s been interpreted as negative towards the CISSP, which I suppose is fair to some degree. [...]</p> [...] have been taking a bit of flak regarding my post comparing the CISSP to the GSEC. It’s been interpreted as negative towards the CISSP, which I suppose is fair to some degree. [...]

]]> By: Alex http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-79149 Alex Mon, 03 Sep 2007 19:58:05 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-79149 <p>Dear "Infosecwriter", you can find someone in (ISC)2 registry only if they gave permission for their personal information to be published. That does not mean that Daniel is not a CISSP and I really don't think he is under any obligation to prove his membership to YOU. Your obsession with checking his certifications only shows that you are just not getting it! Experience, skills and ability to perform logical reasoning is much more important that any certification.</p> Dear “Infosecwriter”, you can find someone in (ISC)2 registry only if they gave permission for their personal information to be published. That does not mean that Daniel is not a CISSP and I really don’t think he is under any obligation to prove his membership to YOU. Your obsession with checking his certifications only shows that you are just not getting it! Experience, skills and ability to perform logical reasoning is much more important that any certification.

]]> By: Alex http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249139 Alex Mon, 03 Sep 2007 19:58:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249139 <p>Dear "Infosecwriter", you can find someone in (ISC)2 registry only if they gave permission for their personal information to be published. That does not mean that Daniel is not a CISSP and I really don't think he is under any obligation to prove his membership to YOU. Your obsession with checking his certifications only shows that you are just not getting it! Experience, skills and ability to perform logical reasoning is much more important that any certification.</p> Dear “Infosecwriter”, you can find someone in (ISC)2 registry only if they gave permission for their personal information to be published. That does not mean that Daniel is not a CISSP and I really don’t think he is under any obligation to prove his membership to YOU. Your obsession with checking his certifications only shows that you are just not getting it! Experience, skills and ability to perform logical reasoning is much more important that any certification.

]]> By: Infosecwriter http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-78818 Infosecwriter Sun, 02 Sep 2007 18:04:41 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-78818 <p>What give me the idea you don't have it? Simple… Miessler is not in (ISC)2's certification database. This tells me you don't have it: https://www.isc2.org/cgi-bin/cert_verification.cgi. If you have a CISSP, you need to fix the issue with (ISC)2. Posting your certification number for others to verify your claims would also be appropriate since you're not in the database.</p> <p>I’ve seen your name on SANS for the GSEC and am awaiting confirmation from ISACA on the CISA.</p> What give me the idea you don’t have it? Simple… Miessler is not in (ISC)2′s certification database. This tells me you don’t have it: https://www.isc2.org/cgi-bin/cert_verification.cgi. If you have a CISSP, you need to fix the issue with (ISC)2. Posting your certification number for others to verify your claims would also be appropriate since you’re not in the database.

I’ve seen your name on SANS for the GSEC and am awaiting confirmation from ISACA on the CISA.

]]> By: Infosecwriter http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-249138 Infosecwriter Sun, 02 Sep 2007 18:04:00 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-249138 <p>What give me the idea you don't have it? Simple… Miessler is not in (ISC)2's certification database. This tells me you don't have it: https://www.isc2.org/cgi-bin/cert_verification.cgi. If you have a CISSP, you need to fix the issue with (ISC)2. Posting your certification number for others to verify your claims would also be appropriate since you're not in the database.</p> <p>I’ve seen your name on SANS for the GSEC and am awaiting confirmation from ISACA on the CISA.</p> What give me the idea you don’t have it? Simple… Miessler is not in (ISC)2′s certification database. This tells me you don’t have it: https://www.isc2.org/cgi-bin/cert_verification.cgi. If you have a CISSP, you need to fix the issue with (ISC)2. Posting your certification number for others to verify your claims would also be appropriate since you’re not in the database.

I’ve seen your name on SANS for the GSEC and am awaiting confirmation from ISACA on the CISA.

]]> By: sd dietz http://danielmiessler.com/blog/information-security-comparing-the-cissp-and-gsec-certifications/comment-page-1#comment-78648 sd dietz Sat, 01 Sep 2007 22:36:15 +0000 http://dmiessler.com/blogarchive/information-security-comparing-the-cissp-and-gsec-certifications#comment-78648 <p>I always enjoy discussions like this. They show the ad hominem attacks on both sides of the same coin. As a CISSP, CISA, GCFA, G7799 and I have have forgotten more about security than most know. Neither is superior to the other. They both have their strengths and weaknesses. I could describe some of the critical weaknesses of the GIAC program in the same way I could with the ISC2 program. In both instances, descriptions would add no value and also compromise the TOS of both exam processes. The real issue for each and danger for each is how quickly technology changes but the elements of good security remain the same. I still state 90% of good IT Sec is common sense. GSEC focuses on latest technology, but no always on best logical practice. CISSP focuses on best practice and logic but not always the latest technology. If I were wanting to hire a FW engineer, I would want to know whether they can manage the ruleset for the named firewalls be it an outdated Guantlet or the latest rev of Checkpoint or Juniper. But what do I know. I have forgotten it already.</p> <p>Enjoy the world, it will be different a nanosecond from now</p> <p>SD Dietz</p> I always enjoy discussions like this. They show the ad hominem attacks on both sides of the same coin. As a CISSP, CISA, GCFA, G7799 and I have have forgotten more about security than most know. Neither is superior to the other. They both have their strengths and weaknesses. I could describe some of the critical weaknesses of the GIAC program in the same way I could with the ISC2 program. In both instances, descriptions would add no value and also compromise the TOS of both exam processes. The real issue for each and danger for each is how quickly technology changes but the elements of good security remain the same. I still state 90% of good IT Sec is common sense. GSEC focuses on latest technology, but no always on best logical practice. CISSP focuses on best practice and logic but not always the latest technology. If I were wanting to hire a FW engineer, I would want to know whether they can manage the ruleset for the named firewalls be it an outdated Guantlet or the latest rev of Checkpoint or Juniper. But what do I know. I have forgotten it already.

Enjoy the world, it will be different a nanosecond from now

SD Dietz

]]>