So the market is forcing me to get one of the security certifications, like the CISSP. It doesn’t matter that I have more then 15 years of experince and pretty much saw each case those certifications cover first hand. Sure, I can pass the exam but I don’t see the point, besides they charge you an enormity for it and you need to maintain it each year by paying more money. It’s all about the money.

On the other hand you have people that are certified and are worth crap. For example, last month I had to help someone with a risk assessment, he has 3, not 1, 3 certifications. He failed to see the obvious, even after I pointed it to him. Why? He was caught up preparing his check lists, methodology, tables, report formats, standards, etc, etc, etc. he failed to see the MOST obvious vulnerability, right in front of his freaking face.

But he is certified.

I hate this. Anyone can pass a freaking exam. However it takes more than just a piece of paper to think like a hacker, like a adversary, like a security expert.