Best Information Security Certifications
The employment outlook for people holding Information Security certifications is extremely favorable as the use of technology continues to skyrocket in the work place.
Information systems have become a necessity in order for companies to compete in the modern business world and a quickly growing demand of InfoSec professionals are needed to protect that information.
The threat of individuals misusing information has grown alongside IT and is a popular topic in the media and news. Companies have become more aware of such threats and their need to hire the right people continues to increase.
Having the right InfoSec Certification will help you stand out amongst other candidates and give credibility to your skill set. There are several credentials which are recognized around the world and even in many government agencies. We have listed some of the most recognized certifications along with their requirements, costs, and even where to find training. Get serious about your InfoSec career today, a high paying job in the industry is waiting for you!
1. CISSP – Certified Information Systems Security Professional
The CISSP is a globally recognized IT certification that is offered by the International Information Systems Security Certification Consortium also known as (ISC)2. It is awarded to individuals who have demonstrated a high level of competence in various fields of information security.
These individuals are said to have expert understanding and skills which are vital to the creation, guidance, and management of security standards within professional organizations. There are over 93,000 CISSPs in over 149 countries and it is even required for employment in some industries. It is highly recognized by IT organizations; therefore, continually popular among IT pros.
Candidates must meet several requirements including five years of work experience in two of (ISC)2‘s domains (focus areas of their body of knowledge). The 10 domains within the body of knowledge include: access control, telecommunications and network security, information security governance and risk management, software development security, cryptography, security architecture and design, operations security, business continuity and disaster recovery planning, legal/regulations/investigations/ and compliance, and physical security.
For those with a four-year degree, only years of work experience is required. Along with experience requirements, there is also a thorough exam that future CISSPs must complete. The exam consists of 250 multiple-choice questions and has a six-hour time limit. The passing score is 700+ out of a total 1,000 points possible.
There are three concentrations that can be added later to the CISSP to further specialize. Those concentrations include:
- CISSP Engineering
- CISSP Architecture
- CISSP Management
CISSP Requirements
- 5 years of full-time experience within 2 of the 10 (ISC)2 domains, or 4 years of experience with a degree
- Pass CISSP Exam
- Receive endorsement from (ISC)2 Member
- Subscribe to the code of ethics
- Submit all of the above within 9 months of passing the CISSP Exam
- Renew certification by earning 40 Continuing Professional Education (CPE) credits per year, or 120 CPE credits within three years
- Pay annual certification maintenance fees
CISSP Costs
- CISSP Exam Registration: $549
- Exam Rescheduling Fee: $50
- Exam Cancellation Fee: $100
- Application Processing Fee: $50 (only for certain locations)
- Annual CISSP Maintenance Fee: $85
- Study Materials: Varies
Additional Resources
2. CISA – Certified Information Systems Auditor
The CISA is another designation which is globally recognized in fields of audit and information systems security. It is issued by the Information Systems Audit and Control Association (ISACA) and is known for being a high paying certification.
Information systems auditors are skilled in analyzing and implementing controls within an organizations IT infrastructure. They help ensure that companies have proper systems in place to achieve desired goals, to maintain accuracy of data and reporting, and to secure company data and intellectual property from theft or loss. Most CISA holders work as information technology audit managers, directors, and consultants.
Becoming a CISA is not an easy task as there are several requirements that must be met including: 5 years of work experience in relative fields, passing the CISA certification exam, agreeing and adhering to the code of ethics, and earning 20 hours of qualified continuing education credits each year. There are options which allow candidates to substitute up to 3 years of the work experience requirement with various types of formal education.
The CISA Exam is known to be difficult as it has less than a 50% pass rate among those taking it for the first time. Test takers must get 450+ points out of the total 800 points to pass. It is a 200 multiple-choice question exam that consists of five areas of expertise including:
- The Process of Auditing Information Systems
- Governance and Management of IT
- Information Systems Acquisition, Development, and Implementation
- Information Systems Operations, Maintenance and Support
- Protection of Information Assets
CISA Requirements
- 5 years of full-time work experience in a related area of expertise (can substitute up to 3 years with various types of approved education)
- Pass CISA Exam (can be taken before work experience is achieved)
- Subscribe to ISACA’s code of ethics
- Apply for CISA Certification within 5 years of passing the exam
- Maintain certification by earning 20 relative Continuing Professional Education (CPE) credits per year
- Pay annual certification maintenance fees
CISA Costs
- CISA Exam Registration: $440 for ISACA Members and $625 for Non-Members
- Exam Rescheduling Fee: $50
- Exam Cancellation Fee: $100
- Annual CISA Maintenance Fee: $45 for ISACA Members and $85 for Non-members
- Study Materials: Varies
Additional Resources
3. CEH – Certified Ethical Hacker
In order for companies to prevent unwanted access of their computer systems and data, they need to explore their own security weaknesses. This is where Certified Ethical Hackers come into play. These Professionals are trained to find and fix IT system security vulnerabilities that unethical or “blackhat” hackers might try to find and exploit.
They are required to become familiar with the same tools and techniques that malicious hackers might use, so that they can better prevent unwanted breaches in security. CEH candidates must learn techniques such as hacker reconnaissance, scanning, gaining access, maintaining access, covering tracks, and various types of system attacks.
This mid-level certification is important for anyone hoping to work as an ethical hacker. The main requirement for receiving this credential is to pass the exam; however, there are quite a few steps for becoming eligible to take it. In order to sit for the CEH Exam one must simply complete an EC-Council official training, apply for eligibility, and purchase an exam voucher. Students who do not attend an official training will have to meet more educational and experience requirements.
The CEH Exam is divided into 7 sections and are weighted as shown below. Candidates must get 70% or higher on the 125 question exam within a 4 hour period.
I. Backround 4%,
II. Analysis/Assessment 13%
III. Security 25%
IV. Tools/Systems/Programs 32%
V. Procedures/Methodology 20%
VI. Regulation/Policy 4%
VII. Ethics 2%
CEH Requirements
- Complete an Official CEH Training to qualify for the exam OR meet the following requirements to qualify:
- 2 years of information security experience
- Educational background reflecting specialization in information security
- Eligibility application fee of $100
- Submit Exam Eligibility Application Form
- Purchase an official exam voucher
- Pass CEH Exam (within 3 months of application approval)
- Renew certification by earning 120 relative (ECE) credits every 3 years
- Pay annual certification maintenance fees
CEH Costs
- CEH Exam Voucher: $500
- Eligibility Application Fee: $100 (for those not taking Official live-type Trainings)
- Annual Maintenance Fee: $20 for Non-ECE Scheme Members and $80 for ECE Scheme Members
- Study Materials: Varies
Additional Resources
4. CISM – Certified Information Security Manager
The CISM is another certification that is offered by the Information Systems Audit and Control Association (ISACA). It is internationally recognized and popular among candidates who also have CISA or CISSP designations. It is more focused on the management side of an information security program.
Those holding this certification can be expected to understand how to develop and oversee a successful security program within a professional organization. They find critical security issues within an enterprise and help put systems in place that can better the governance of information. This certification helps bridge the gap between the audit side of information security and the IT side.
Those looking to become certified will need to pass the CISM Exam, agree to ISACA’s code of ethics, submit evidence of a at least five years of information security experience, and maintain the certification through continuing education/maintenance fees. The CISM Exam is scored based on a scale from 200 to 800, with 450 being the passing score. There are four Domains or focus areas of the exam which include:
- Information Security Governance – makes up approximately 24% of exam questions
- Information Risk Management and Compliance – makes up approximately 33% of exam questions
- Information Security Program Development and Management – makes up approximately 25% of exam questions
- Information Security Incident Management – makes up approximately 18% of exam questions
CISM Requirements
- Pass CISM Exam (Can take before meeting the experience requirement)
- Submit verified evidence of a minimum of 5 years work experience (must be gained within 5 years of passing the exam)
- Agree to Code of Ethics
- Apply for CISM certification
- Maintain certification by earning 20 hours of CPE credit every year and at least 120 contact hours every 3 years
- Pay annual certification maintenance fees
CISM Costs
- CISM Exam Registration: $440 for ISACA Members and $625 for non-members
- Exam Rescheduling Fee: $50 or $100 (depends on how early in advance you reschedule)
- Exam Refund Processing Fee: $100 (must request well in advance of candidate’s scheduled test date)
- CISM Certification Application Fee: $50
- Annual CISM Maintenance Fee: $45 for ISACA Members and $85 for non-members
- Study Materials: Varies