Great
@John wrote:
I have over 20 years industry experience and recently (Apr 2017) received my CISSP. One thing that struck me in my seminar week was the number of people (almost half) who lost their certification due to lack of CPEs. Don't let this happen to you. Seriously. The last thing you want is to have to fork out the money to take the test all over again.
CPEs are important. They provide evidence that you are an active participant in the infosec community. They're easy to earn, but don't shrug them off or take them lightly. Earning CPEs will make you better at your job:
- Attend a conference. I can't stress this enough. Almost every region in the US has a weekend conference within a few hours drive. Do it. For about $150 and the cost of beers and hotel room, you can not only earn a ton of CPEs, you'll learn real stuff from practitioners and have the opportunity to meet your peers. Again, do it. I'll definitely be at THOTCON and DerbyCon, maybe Black Hat/DEF CON, so if you don't know anyone hit me up and you won't be there alone.
- Subscribe to the (ISC)2 Twitter feed. Heck, if you're not on Twitter, you're not getting the latest infosec news. (ISC)2's Twitter feed provides pretty good news and a lot of opportunities to earn CPEs.
- Subscribe to InfoSecurity Professional magazine. Hey, you paid for this. Use it. Answer the quiz and get 2 CPEs. That's 12 easy CPEs a year.
- Be social. (ISC)2 has a ton of local chapters out there who host tons of small events. You get credit for these. For the small annual fees many of the chapters charge, it's worth it.
- Be anti-social. (ISC)2's website has links to lots of webinars where you get credit for learning. Not as interesting as going to live events and sharing a beer with someone, but better than watching Elf for the 47th time on Netflix.
If you or your chapter has cool ways to earn CPEs, feel free to post up.
Great points, John. Getting CPE's has been a struggle for me on and off over the years. These days, it's simply harder to find time to attend these things. While I used to attend a lot of week long conferences (something like the RSA Conference will surpass your annual needs), it's harder and harder to do so lately.
That said, one of the best ways IMO is to reach out to your VAR/Vendor rep etc. and see if they have lunch and learns and other industry events. Most will often have very good events on security trends or even new products (yes, some can be 'salesy', but you can still extrapolate good information from them). And more often than not, the venue are top notch. I've been to a few Cisco events that were held at Morton's or Capital Grill. Yes, you're spending 3 hours for just an hour of CPE, but you're also getting a great lunch.
For those in regulated industries - contact your local LEO and see what they offer. Often times there will be fraud or cybersecurity task forces that you can join and participate in annual meetings that will not only provide great info, but also get to talk to some industry experts. A few years ago, I attended a local task force meeting that was held at the USSS training facility in MD. This included a presentation from the legal/compliance exec of Target that talked about the breach. It also included a tour of the facility afterwards and some demonstrations from the Presidential Protection Detail.
