@mgoblue93,
I apologize if I didn't communicate this well. I was attempting to establish why you don't see such a high number of job postings requiring or requesting certain IT certifications when compared to government. I will address each of your points below.
Just referencing my previous posts, when I bring up the difference between public and private, it's from the notion of how the CISSP is viewed? What does having the CISSP in a job req really truly mean for an organization?
The CISSP and any other certification, degree, or diploma is an Appraisal Cost for an organization of its service capability. It serves as a method of examining the service provider (employee or contractor) and determining if they posses a baseline set of knowledge.or aptitude. It then permits an organization to decide, as a result of that baseline if additional Preventative Costs are required by training existing service providers, or replacing them with more capable service providers.
It's NOT to suggest that only the public sector believes in having qualified people on staff. Quite the contrary as both sectors consider cyber a priority equally. Let's not get hung up on jargon either. You can have a private sector employee without a cert who is just as qualified as a public sector employee who got their cert solely as a condition of employment.
I apologize if I stated somewhere that a certification causes someone to be qualified. What I was trying to convey was that a certification program is a way for an organization to appraise if their service providers meet basic training and knowledge requirements.
My personal opinion, the private sector doesn't care about CISSP certifications because that piece of paper hasn't shown a direct benefit (meaning $$$ -- business are in the business of making money first and foremost) to the bottom line.
I agree with you. When an organization wants to make a change, hopefully they do it using real information. Typically this is done with the assistance of a Management Accountant who conducts a Cost of Quality ("CoQ") assessment. The question to be answered here is, "Does requiring our service providers to be certified increase retained earnings?" The problem in many organizations is that the estimated savings from a reduction in Internal and External Failures is hard (or takes too much time and effort) to assess - or the estimate is that the impact to the brand will be minimal or temporary enough to outweigh the cost of adding additional controls.
> In the Private space this is notoriously hard to get people to quantify.
> In the Public space, especially the Department of Defense, the Internal
> and External Failure Costs are very much quantified
Where does that information come from?
I am talking about estimating the savings in preventing Internal or External Failures before they happen, rather than quantifying the loss after it happens.
The difference between the public and private arenas are, that the public space has an entire (Intelligence) community that assesses and reports on their threats, and has had a regulatory or administrative requirement to appraise their capabilities to defend against them for ages. The private sector is only just catching up with the requirement in certain specific sectors such as the introduction of regulations that impact baseline computer security such as HIPAA. In the case of an organization subject to HIPAA for example, t is entirely reasonable to assume obtaining the services of a certified specialist in healthcare IT security has a return on investment in reducing Internal/External Failure Cost such as through avoiding litigation and civil penalties.
The concepts that I'm referring to here are part of the Common Body of Knowledge for the Institute of Management Accountants ("IMA"), blended with the Risk Management portion of the CBK for the CISSP under (ISC)^2.
I think Sony, Target, Equifax would like to have a word with you about the impact, publicly, about their breaches.
You are kind of making my point. There is an interest in increasing security after the costs are established from a realized security incident. What was the certification and training requirement for their IT and Security staff, and what was their estimated savings from Internal/External Failure Costs from implementation of certification prorgams before they calculated the losses from their breeches?
