certificates 'prove' experience

[Metgod]

Ok, I just read a disturbing article...

How the hell does a certificate prove you're the best for a job ? How does it prove you have experience ? how does it prove a damn thing other than one knows how to read a book about the test itself just to pass it to be some superior person ?

And why if this is the trend, are so many networks compromised ? I guess it is because the truth is, certificates don't mean a damned thing.

I'll be honest.. I don't hold *ANY* certificates what so ever. And honestly, I can't be bothered to get any. I just don't fucking care. Why should i ? it doesn't prove a damned thing. It's just like an SAT test for college / university level students. It means NOTHING at all. *NOTHING* Unless of course you say you know how to take a test is something. Seriously, how important to success in a school is knowing how to take a test ? It's just pathetic.. abso-fucking-lutely pathetic.

And yet, employers look for it.. why ? I don't get it but it annoys the shit out of me. Seems to me employers are looking for proof that is nonexistant and/or just someone who can learn to read a book specifically showing someone how to take a test.... yeah, like that's gonna make a successful security person... I mean why even ask for other job experiences in applications if this is the case ? Stupid...


The article, which can be found at  http://www.nwfusion.com/news/2003/1105seccert.html  explains how someone lost their job with 20 or so years of experience to someone just because he didn't have a certificate and someone else did (who had much much much less experience) is just sad and a damn shame.


Met.

[Uneek]

I'll hire someone with experience or even the desire to learn the right way, over someone with 10 MS certs with no experience, a.k.a. Paper Admin, any day of the week... (and I have and will continue to do so!)

[Metgod]

Yeah.. we know what the truth is but so many don't know.. it's pretty sad.

Reminds me of my mom's career.. Been an employee for 33 years of (unnamed company). Back then things weren't required as much. And she is one of the top employees (she's an engineer) and comes up with fantastic solutions, new things, etc. She even helps with things like the budget and other yearly tasks like that. And yet, today, this same person would not get the job because of NO college education. That's sad... because not only would the company lose out (and they'd lose a lot if she wasn't part of her company) but the person with potential would lose out too.


Thanks for the response, Neek!

Met.

[DHD]

Hmm, I think that employers just look logic on things, that if the person have a certificate, then he must be good, the things is that, that isn't the case. It might get changed but how?

/DHD

[Metgod]

I honestly don't think it's gonna change. Some decades back it wasn't like how it is today (in regards to companies). If you look around, even on this board (Zerored has made some small rants about this), you'll see that there are all these 'security' schools, that don't understand that security isn't taught, but learned through experience. I don't care who it is; if you don't keep up to date (and most won't after they have this certificate) you aren't worth anything. Besides, the schools can not possibly cover everything. (how much you want to bet they don't go over IP session hijacking or IP spoofing ? in detail.. or how to help block it [not too hard actually] etc.).

They might go over the issue of not writing your passwds down, but then again they might not. Even then, most are lkely to write them down. Do they cover the issue that the human is the weakest link in security (i.e., social security) ? So many things one learns through experience and not 'school'.

Now as for this message.. the sad thing is, busineses are so damn ignorant that they will take someone with an 'education' over those who don't have one. And yet, the one without an education probably is a hell of a lot more experienced.

I don't see this changing, sadly, because businesses (and the gov't too!) are stupid. I remember reading about how an agency set up some classes.. for I don't know.. say 12 weeks ? But it was only 12 weeks.. er.... right, as if that's enough.

I am thinking that security through obscurity is also an issue here. But I won't get in to that.

Oh, and lastly, a perfect example of someone who isn't as experienced as he could be (due to illness) is me! I haven't kept up to date and I don't know much about the current technologies and exploits and so on. The only difference here, though, is that I do have experience in the past, AND I do love to learn and I'll be damned if there is a problem I won't fix! Thus, I could be a better choice than some paper admin...

Cheers,
Met

[godaigo]

Just playing devils advocate here (and also to try to breath some life back into this board) from a "business mans" viewpoint the certificate makes sense. In other words when you have a hiring board who is not competent to evaluate the qualifications of the applicants (which happens all too often at big companies) they look for certain "minimum" standards. Basically that is what the degree or the certificate insures. It tells someone who can't independently evaluate that the applicant meets a "minimum" standard that has been agree'd upon throughout the industry. So basically it allows them some sort of control over a process that they aren't really qualified to evaluate and judge. As far as they know the person who has 20 years of experience is not really what they need because who knows what they've been actually doing and what type of training they have. Whereas with the certificate holder the non-techie can at least pretend to evaluate that reality. I think this is why you see that experienced people often start out at small companies or get re-hired to small or highly specialized companies. The people doing the hiring are not just HR hacks, but are actually qualified to evaluate someones skill level.

Having said all that I do wish there were some equitable manner in which experience could count for a lot more in the hiring process, because as Metty and others have pointed out it's often much more important, especially in emerging fields.

disclaimer: Just so everyone knows I do have advanced degree's, so I may be biased  

Cheers....

[wilnix]

I think it depends on the certification / degree. I would definately look highly at a CCIE compared to an MCSE...

Wilnix