Re: University Degree or CISSP

["Dave Aronson (SecBasics)" <sfbasics2dave () davearonson com>]

soumyadipta_das () yahoo com writes:

> Is it better (in terms of technology and industry acceptablity) to get a
> university degree on information security than certifications such as 
> ccna/ccsp, ceh (or security+) and cissp?

It depends on a number of things.

First, what do you want to DO?  Are you intending to be a security analyst, a writer of security-related software, a 
pen tester, or what?  The attitudes towards degrees and certs vary widely between these fields.  The closer the job 
gets to black-hattedness, the less important BOTH of them become, but degrees more so.

Second, do you have a degree already, of any kind?  I don't know about elsewhere, but here in the USA, that is an 
absolute requirement for most regular corporate technical jobs.  Some also demand it be in an area directly relevant to 
the job; for security engineers, this could be specifically computer security, or possibly computer science, 
information systems, software engineering, etc.  However, the *added* employability from having *higher* degrees is 
generally small, except in the federal government, or sometimes their contractors looking to put you in contract slots 
that require specific degrees.

Third, it depends what you've done with the knowledge that the degree or cert claims you have.  If the paper is fresh, 
people might think it's still fresh in your mind and give the paper more weight.  If it's been quite a while, though, 
they're going to look more at what you've done, which will thus be reinforced in your mind, and assume that you've 
forgotten pretty much everything else.

Fourth, it depends what other experience you've got, that is at least tangentially relevant.  For instance, if you want 
to write security software, it would help to have a good background in programming, or at least using popular pieces of 
security software.

Last, it depends on the person you're asking to evaluate you.  Some view certs as a good thing, some as neutral, and 
some even as *negative*, especially MS certs.

Long story short, there are no hard and fast rules.  You can probably get the certs much more quickly and cheaply, 
possibly with just self-study and a day or two off to take exams, so in my position (CompSci-degreed, in the US, with 
about 20 years experience), I'd go for that first.  YMMV.  Either way, try to get an employer to pay for it!  :-)

-Dave