Does the Certified Ethical Hacker add value to a CISSP

A young colleague asked about the value of the CEH certification. Would it "Add Value" to his existing CISSP? The syllabus looked interesting to him and he wondered how prospective employers would view this.

This was my reply:

There are TEN domains to the CISSP's CBK. People come to security from
many walks of life and fields of endeavour and information security has
many facets beyond protecting networks and hosts from malicious attack.

There have been times in my career when the work covered by the CEH
would have been relevant, but back then neither the CEH not the CISSP
existed. But even back then I realized that the real problem was not
the networks or the hosts or the system administrators.

Each decision you make, each certification and specialization you focus
on leads you down a career path. I've often criticised "reactive mode"
security. The same I'd apply to your career. Is this a proactive move?
Is there a career plan here? Where do you see yourself in five or ten
years? How long do you expect to be doing Pen Testing?

Many of us took the CISSP not as a learning exercise but to validate our
already existing skills and experience. You can read in the archives
tales of people at the seminars that pre-dated "boot camps" who wrote
the books that the exam questions were based on. I mention this
because of the way you have worded your question. Are you interested in
the CEH as a validation of your experience or do you expect the course
to teach you Pen Testing? If the latter, then I'd think again.

But ultimately it boils down to the issue of your career. Many of the
older members of this forum, and older CISSPs in general, have very
diverse backgrounds. There is an old joke about a Phd being a 'delta
function', you know more an more about less and less. Many career moves
are like that. I mention this because I, and others, feel there is a
point in a career where it is the width of experience, the 20-20
peripheral vision, the understanding of context, the ability to avoid
Errors of the Third Kind, that employers value.

Yes, it depends on your age - which you didn't mention - and other
factors. Context is, as I keep saying, everything.

Maybe one day I'll go back an finish my degree in Social Anthropology.
All in all I feel understanding people and the social dynamics of
organizations is more relevant to communicating and effecting the
changes needed to bring about good security practices. But that's me,
my context an my career objectives.

You need to make it clear what are yours before you can say whether a
CEH - or any other certification for that matter, is relevant to you.

As Robert Heinlein said:

A human being should be able to change a diaper, plan an invasion,
butcher a hog, conn a ship, design a building, write a sonnet, balance
accounts, build a wall, set a bone, comfort the dying, take orders, give
orders, cooperate, act alone, solve equations, analyze a new problem,
pitch manure, program a computer, cook a tasty meal, fight efficiently,
die gallantly. Specialization is for insects.

Related articles by Zemanta

• Society of Payment Security Professionals Welcome 50 New CPISM/CPISA's (pindebit.blogspot.com)
• Ethical Hacking: Beat Hackers At Their Own Game (shegeeks.net)
• "A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship,..." (secretenemyhideout.com)
• Ethical Hacking - Beating Bad Guys for Fun & Profit (giveaway) (geekmommy.net)
• Sci-fi writers take US security back to the future | Jenna Lang (guardian.co.uk)
• Get Paid To Hack (joetech.com)