@Sylvia589,
Before writing off the CISSP program as a con, kindly consider this:
- A cybersecurity incident has crippled an organization, damaging its information systems, its reputation, the morale of its personnel, and its financial health.
- The previous CIO is gone, along with the CISO and other IT executives. The auditors have delivered a slamming report, and you’ve been brought in from the outside to clean-up the mess, rebuild the IT Department – both technology and staff – all while working under an externally imposed deadline, with a mandate to save money, not spend it, due to the phenomenal costs the company has already incurred.
- Your first few days on the job reveal the problems to be systemic, and not just with security. Portfolio, program, project, process, procedural, personnel, supply chain, asset, financial, and change management are train wrecks, occurring in silos that don’t communicate with each other.
- Your name came up as part of the candidate search. The keyword “CISSP” put your resume at the top of the list. None of the other C-suite executives know what that means, and know little about IT in general, much less security, but the audit report recommended that the new CIO hold the CISSP accreditation.
Why?
The eight domains that are tested in the CISSP exam cover the areas that are pain points in this—and many other—organizations. You need not be a subject matter expert in all eight (although, I’ve found it helps tremendously). You should know enough about each to delegate as needed, and know whether the technical people that report to you are truly competent, simply appear competent, or worse.
How would a certifying body test for this?
There will undoubtedly be some either/or binary questions, “Does a given technical concept provide both integrity and confidentiality? True or false.” However, those point to purely technical knowledge, and do not query you on your ability to decide what is the “best”approach to a given situation. Questions that test for this may be in a multiple choice format, and the majority of the choices may “answer the mail” from a purely technical standpoint, but only one choice is practical from a business, legal, financial, or human resource standpoint. Even the most experienced technologist may know little or nothing about their business from the viewpoint of those departments and thus fail to answer correctly.
An underlying precept that’s sets a CISSP apart from his or her peers is that they are more than competent engineers, more than team leads, more than project managers. Yes they have “been there, and done that,” but nowadays the CISSP accreditation is supposed to tell an organization that you are qualified to serve as a trusted advisor to the company’s President, the CEO, and the Board of Directors. They are called upon to demonstrate technically competent leadership, not management or administration, and they can parachute into a disaster on day one and hit the ground running. From there, they can develop an architecture and strategies to minimize risk, inculcate a culture of security, and save money doing so. That is what the certification is intended to show, and candidates preparing for it must realize what they're signing up for; what organizations will expect from people with those initials next to their name.
@Ben_Malisow, an (ISC)2 instructor exhorts his students to avoid buying “a $10 lock for a $5 bike.” If you ask the security person which is the “best” lock, they may point to the one offering the most security, even if it costs $10. If you ask the business person, they’ll want to consider the cost – and do so from a risk management perspective. It’s unlikely that they’ll want to spend $10 to protect a $5 asset. We call this “wearing the CEO hat” and I exhort my clients and students to do it.
I see many posts from people who are attempting this test while still learning the fundamentals.
That is a mistake, and may be the cause of many of the frustrations expressed here.
This exam does test knowledge of certain undisputed facts, and those can be studied for. However factual knowledge alone does not make a good leader. The ability to think on your feet, process dozens of incoming and conflicting pieces of information, and quickly decide (with a large measure of self-confidence) that your decision is the “best” one, or does the “most” to appropriately respond to the incident, is the hallmark of leadership and grace under fire.
Those qualities are difficult to test for in a written exam, and practice tests face the same limitation, which is why I caution strongly against most of them.
In my previous careers in the military and law enforcement written exams were part of comprehensive testing, with role-playing, physical testing, and on-the-job training, among other things. That is probably a better approach, but isn’t available through (ISC)2, so if you haven’t got the material down cold you’ll need a mentor or coach who knows how to get you there, unless you’re autodidactic and possess enough self-awareness to know what you don’t know.
I’m fortunate enough to have come to terms with the vastness of my ignorance a long time ago, so I’m self-taught, and it took me more than 20 years to get where I am. That timeline is fine if it weren’t for the drastic global workforce shortage, so when one of my staff approaches me about becoming a CISSP, I run them through a thinking exercise that I noted in a different post.
If the CISSP is still the most appropriate certification for them, I start bringing them to my client meetings, so they can see the depth and breath of questions and concerns I’m expected to answer and address (without preparation) at 6 or 7 AM every morning.
I also begin “walk-around” testing. For example, we’re walking past a wiring closet and I tell them that we smell smoke, and say “talk me through how you’ll respond.”
On another walk, I’ll ask them – in rapid fire – to give definitions of “due diligence”, “personally identifiable information (PII),” the difference between RAID 10 and RAID 15, how the annual rate of occurrence is calculated, describe the components of COBIT, and why we salt hashes. You may never see questions like this on the test, I can ask the person I’m coaching these questions all day long, as my clients ask them of me. My environment is a bit unforgiving. Today I was asked about MPLS and firewall configurations, CMMI, SQL injections, Disaster Recovery plans, hypervisors, and legal liabilities.
Sitting in a roomful of people and saying to a client, “I’m sorry, I need to research that and get back to you,” is not an acceptable response, any more than the surgeon who says “Oops!” In the middle of a procedure.
Accordingly, I have a higher bar than (ISC)2; I won’t invest my limited time in a person if they haven’t paid their dues by working in every domain, not just two of them. That’s because you might master the test, but you won’t last very long as a CISO, CTO, CIO, or consultant like me if you’re only truly competent in 25% of IT.
On walks, over coffee, and at lunch each day, I’ll drill, drill, drill. This can go on for several months. When they can answer my questions correctly, calmly and understandably, time and again, they’ll realize that they have the knowledge—and the confidence—to become a CISSP, if they so choose.
Lloyd Diernisse
ISC2 Authorized Instructor and Learning Tree International Certified Instructor
Lean Six Sigma Black Belt | CISSP-ISSMP | CCSP | CGRC | PMP | TBM | CSM | CMMI-A | ITIL-Fv3
