Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Dark Reading Radio: The Real Reason Security Jobs Remain Vacant
Newest First  |  Oldest First  |  Threaded View
fabipefi
fabipefi,
 User Rank: Apprentice
7/28/2014 | 2:51:31 PM
Re: Certifications vs Experience
"As Governor, I'll battle regarding jobs and Iowa employees, not outsource jobs like my Democratic challenger and Governor Master," Hulsey stated.

The evaluation demonstrates how Burke company-has her father's organization Journey bicycles that outsourcing over 99PERCENT of the production to Taiwan and China wherever they spend employees less than MONEYTHREE each hour.

Condition Consultant Brett Hulsey MNS acts about the Assemblage Work, Power, and Tourisms Committees, offers university levels in Politics Economy and Organic Technology, was a Dane County Boss regarding fourteen decades, has an energy and ecological consulting company, and assisted develop two sophisticated Iowa bioenergy crops.
Robert McDougal
Robert McDougal,
 User Rank: Ninja
5/28/2014 | 5:29:35 PM
Re: Certifications vs Experience
What I have experienced is that the individuals who have the large laundry list of certifications generally view certs as the finish line.  Some of the most talented security professionals I know do not have a single cert.  The difference is in passion for security of the quest for money.
Paladium
Paladium,
 User Rank: Moderator
5/28/2014 | 7:58:27 AM
Certifications vs Experience
Wanted to add to the discussion.  I have seen my share of over certified security professionals that do not have the necessary hands on experience to support their wealth of certifications.  This can be a trap for an organization who 1) do not understand what the problem is they are trying to address in the vacancy, 2) large quantities of certifications give the impression of "knowledge", often over riding candidates who have extensive hands on practical experience in the field.  Certifications do not mean that the individual can fill the role effectively, or bring the necessary wisdom of cause and effect analysis (especially in IR events).

As a rule of thumb I look for three years of direct hands on experience PER security certification.  If they have a CEH then I want to see three years of CEH hands on experience.  If its a management role then I want to see five years of direct management experience to support that CISM certification. Certifications should be a capstone achievement that *supports* a security professionals accomplishments within the cyber security space.  It must never be a replacement for.  

I personally think there is a certification mill out there that is making a lot of money for educational firms, but producing very little actual hands on experienced candidates to pull from.  Great for the education business, not so good for those of us on the front line.
RetiredUser
RetiredUser,
 User Rank: Ninja
5/27/2014 | 8:56:34 PM
Moderate Fear?
I'd be interested to know how many companies are short on security staff not due to salary but due to a moderate to high fear that hiring talented security professionals opens them up to a potential breach.  Whether the fear is founded or not, I've seen it at work (my perception, not putting words in mouths), and good assets who were rough around the edges were passed over for cleaner but less talented hackers.  Trust is huge, especially when the talent you're looking at might have a criminal record, but it's part of the hiring dance and sometimes a bigger deal breaker than salary.
Kelly Jackson Higgins
Kelly Jackson Higgins,
 User Rank: Strategist
5/27/2014 | 4:10:01 PM
important topic
This should be a very enlightening and relevant discussion. Can't wait to tune in!


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-23896
PUBLISHED: 2022-06-28
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
CVE-2022-29519
PUBLISHED: 2022-06-28
Cleartext transmission of sensitive information vulnerability exists in STARDOM FCN Controller and FCJ Controller R1.01 to R4.31, which may allow an adjacent attacker to login the affected products and alter device configuration settings or tamper with device firmware.
CVE-2022-30707
PUBLISHED: 2022-06-28
Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed (CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00), CENTUM series where CAMS function is used (CENTUM VP, CENTUM VP Small, and CE...
CVE-2022-30997
PUBLISHED: 2022-06-28
Use of hard-coded credentials vulnerability exists in STARDOM FCN Controller and FCJ Controller R4.10 to R4.31, which may allow an attacker with an administrative privilege to read/change configuration settings or update the controller with tampered firmware.
CVE-2022-34750
PUBLISHED: 2022-06-28
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikib...