Training Advisor hed: Is security your specialty? dek: if you know what Peter Norton knows, you can write your own ticket. by Molly Joss

In the new kind of world we're living in these days, security is more important than ever in all aspects of our lives--including our computer systems. Cyber-terrorism is a real threat, which only increases the number of possible threats to a company's computer system. Whether you're concerned about the possible sabotage of your systems by disgruntled employees, marauding viruses, or state-sponsored destruction delivered via the Web, these days you have a right to feel a little paranoid.

That's why it's my bet, and the opinion of other analysts, that the demand for computer security professionals (CSPs) will exceed supply for at least the next several years.

I have written before about general certification training and testing for CSPs, and these programs are still available and still viable. In this column, I want to tell you about a security certification program whose sponsor is a familiar corporate name: Symantec, makers of many security products including the Norton line of virus detection and eradication programs. According to the company, you will find Symantec products at work defending the digital assets of 98 of the Fortune 100 companies.

Symantec has grown steadily over the past few years and is now a major player in the computer world. More than 4,000 people work for the company in offices all around the world. Last year the company took in almost $1 billion in revenue. With the increased emphasis on cyber-security and the company's firm standing in the industry, this year's revenues may well exceed that number.

The company has put together a comprehensive training and certification program designed to help companies and individuals learn about its products and to become CSPs. Depending upon your interests and professional aspirations, you could choose to become certified in a particular product or in a particular technical category. You could even combine a certification in one product with the corresponding technical category certification to become a real security guru.

No matter which option you choose, let me warn you that this is not a program for the faint of heart. The training programs are in-depth and challenging. You also need a solid understanding of how networks function, including a background in network protocols. Symantec doesn't say that a network certification is a prerequisite, but it makes it clear that successful certification candidates must have a solid foundation of TCP/IP knowledge and proficiency in operating systems.

To me, this program is a good next step for people who have gotten Cisco or Microsoft networking certifications, even if they have let those certifications lapse. If you're one of these folks and you're looking for a challenge that can lead to a more interesting, better-paying job, this program could give you what you're looking for.

Program specifics

The Symantec Product Specialist (SPS) certification is for individuals training in a specific Symantec solution, such as Norton Antivirus CE, NetRecon, NetProwler, or Enterprise Firewall/ Velociraptor Firewall. Symantec offers a two-day training course for each product certification (the NetRecon certification training takes one day).

Symantec develops and administers the training courses; its Web site lists dates and locations of courses. The prices for the courses are surprisingly modest compared to the prices that other major computer corporations are charging for product training on this level. Of course, this is the kind of training for which employer underwriting is common, including travel and hotel expenses.

You could go for more than one product certification. Symantec recommends that you also have at least three months (and preferably six months) of hands-on experience with the particular product before you take the certification training.

Choose the courses you take and the order in which you take them based on the kind of security work you want to do after you achieve the certification. Symantec categorizes its products into four areas: firewall and VPN technologies, vulnerability management, intrusion detection, and virus protection and content filtering. For anyone whose job involves protecting a network, intrusion detection and vulnerability management are natural choices. My guess is that most professionals will end up with multiple certifications across these four areas.

If you're just starting out, the best way to approach the process is to get some experience in a particular Symantec product, then take the training and attempt the exam. If you don't pass, go back to step one and get at least a few more months of experience before taking the class and the exam again.

To become a Symantec Certified Security Engineer (SCSE) you need to pass the certification exams for one of the four areas of specialization outlined above. You must also pass the security awareness exam. As I write this, Symantec is still working on the course and exam content for the security-awareness component of the certification. Check the company's Web site for the latest details.

To become a top-level security guru, you'll need to pass the exams for all four categories within an 18-month period and pass the security-awareness exam. Then you get to call yourself a Symantec Certified Security Practitioner (SCSP). You'll also know so much about computer security that your skills should be in great demand as a consultant.

You must renew your certification every 18 months. You may not need to re-train each time, but if there has been a major product upgrade during that 18-month period, it's probably a good idea to opt for the training.

If you're not sure you want to take the time for the training, you might try testing your skills by taking one of the beta exams that Symantec puts out once in a while. You have to answer some questions about your experience, as any good beta tester does. You'll also have to answer all the questions on the test, which might take some extra time. Still, it's a good way to test your skills while you help out.

As is the case with the majority of IT certifications, you can take the exams at any of a number of third-party testing centers. The exams are computerized, multiple-choice, and time-limited. You leave the test center with your score. You can retake the test the next day if you'd like, but as I said earlier, I would recommend a few months' more experience before you try again.

Other security certifications

I have written about two general computer security certification programs offered by the Information Systems Audit and Control Association and the International Information Systems Security Certification Consortium. You must have several years of experience in the computer-security field before you can get these certifications, even if you pass the exams.

These certifications indicate that you have a considerable amount of experience as a CSP, but they may be too much for many people who want to work in the security field. The Symantec certifications, on the other hand, require far less experience. That makes the Symantec certifications a good first step for people just starting in the field or for people with limited experience.

Whatever path you choose, the need for security professionals who are not afraid to take on the bad guys--or at least make it harder for them to wreak havoc--will do nothing but grow over the coming years.