The numbers don't lie: A recent poll on ComputerUser's Web asked the question, "What's the most secure tech job right now?" The overwhelming choice for second place (after "There's no such thing," ha-ha) was "information security specialist."
If your current job title sounds something like that, odds are you have all the work you can handle. If that title sounds like something you'd like to get into, now's the time to act--while the market is still hot.
But unlike other training tracks, getting security-related certifications is still a relatively scattershot process. That situation is likely to change as IT security becomes a bigger industry. Despite that, you might be best off looking for training in some general areas of security, and waiting for certification standards to solidify over time.
Another general guideline to keep in mind is that there's value in versatility. Certifications that focus on security typically teach skills necessary to secure a particular vendor's software or hardware. Trouble is, not many companies use only one product to secure its networks, so a vendor-specific security certification demonstrates that you can secure just a portion of a network's resources. Vendor-specific certifications are best for security professionals who already have a strong, broad understanding of how a secure network is built, maintained and protected. Knowing how to run Network Brand X might not help you if you don't know the general ins and outs of all networks.
Start at the beginning
To begin, it might be a good idea to become acquainted with some basic security concepts. Presuming you have a solid knowledge of how computers and networks function, look into a basic security cert such as CompTIA Security+. The CompTIA Security+ certification is meant for folks with at least two years' of networking experience and a thorough knowledge of TCP/IP. If you don't feel that you're quite there, look into A+ and Network+ certifications first.
This certification will show that you know your stuff when it comes to general security concepts, access control, external attack, communications security, infrastructure security, basics of cryptography, and operational and organizational security.
Building from the basement up
From there, you want to find training that will show you the IT security ropes in more specific terms, and give you a marketable certification.
That's where the Global Information Assurance Certificate (GIAC) certification might come in. The GIAC teaches a wide foundation that includes multiple vendors and operating systems before moving on to individual vendors.
The GIAC's foremost certification, the GIAC Security Engineer (GSE) certification, is actually a set of certifications. As with the Cisco Certified Network Associate (CCNA) and the Microsoft Certified Systems Administrator (MCSA), the GSE process starts with the basics: the GIAC Security Essentials Certification (GSEC), a certification that demonstrates an understanding of the basics in securing a network.
The GSEC shows that you know the common forms of attack, the damage these attacks can do, and the most tried-and-true procedures for fighting them. If you've earned the GSEC, you know the difference between a buffer overflow exploit and a Denial of Service (DoS) attack and the common techniques for securing a machine against each attack.
The full GSE requires six certifications that cover securing Windows, intrusion detection, firewall setup, and securing UNIX systems. When it's all said and done, the GSE might be best-suited to a senior-level security administrator whose job is to manage a heterogeneous network--in other words, the person who will set security policies, educate users about safe practices, monitor networks for attacks or breaches, harden servers, and design more secure networks.
There are numerous other GIAC certifications, each designed to stand on its own and represent mastery of a particular set of knowledge and skills:
GIAC Security Essentials Certification (GSEC)
GIAC Certified Firewall Analyst (GCFW)
GIAC Certified Security Leadership (GSLC)
GIAC Certified Intrusion Analyst (GCIA)
GIAC Certified Incident Handler (GCIH)
GIAC Certified Windows Security Administrator (GCWN)
GIAC Certified UNIX Security Administrator (GCUX)
GIAC Information Security Officer (GISO)
GIAC Systems and Network Auditor (GSNA)
GIAC Certified Forensic Analyst (GCFA)
GIAC IT Security Audit Essentials (GSAE)
A little dab'll do ya
As you can see, security training is a pool that gets wider as it gets deeper. From the GIAC, you can wade into a sea of vendor-specific certifications that will drown you if you don't approach it carefully. Just keep in mind that once you have the basics down via a Security+ and GSE, you should be able to pick up more narrowly focused certs while you work.
