Navigating your IT security certification, part 1

You don’t have to read too many news articles to know that Internet security is on everyone’s mind. Even Hollywood knows this and is trying to cash in with hit shows like Person of Interest, </Scorpion>, and the Emmy-winning Mr. Robot. Major corporations are also taking notice. Gartner is forecasting worldwide enterprise security spending to total $96.3 billion in 2018, an increase of 8 percent from 2017.

It is no wonder with 50% of respondents reporting an increase in the number of cyberattacks from last year and four out of five indicating it was likely or more likely their enterprise will experience a cyberattack in 2018 (according to the 2018 ISACA State of Cybersecurity Study). Even this past election cycle isn’t immune to accusations of stolen emails and hacked servers.

But not all is doom and gloom; for the IT professional, this is a great climate for those looking to update their skills and join the relatively new and growing sector of IT security. Don’t believe me? In a March 2018 article posted by Forbes, five of the top 15 most valuable IT certifications are security based, and all had an average salary north of $100K. Security certification has become a serious and well-respected career.

Now you are probably wondering, where does one start in getting a piece of this lucrative cyber pie? As I quickly found out myself, this is not an easy answer. There are many different certifications around security to choose from and many different companies and organizations offering them. But don’t fret; let me help you carve the right path and get you on your way.

Being a security professional is not about finding the one perfect certification; it’s more about finding the right combination of certifications. What certifications you seek depends on what areas of security you’re most interested in and how high up the corporate ladder you wish to climb. The most popular certifications are those that are relevant to all areas of IT security.  But before we get into too much detail, I think it is important to establish some baselines. One does not simply jump immediately into security without a solid background in the general IT hardware and networking field.

If you’re going to attempt entering a security field and IT is not a current profession or hobby of yours, then I’d suggest tackling a couple of certifications to get you started. The first is CompTIA A+ where all IT begins by focusing on learning the standard computer hardware, basic operating system functionality, and general troubleshooting. From there, I’d recommend getting certified in CompTIA Network+, which will get you familiar with basic networking concepts like IP addresses, DNS, domains, routing—essentially everything that defines the framework that Internet security relies on.

Okay, you are now an IT expert. So, what next? It’s good to start with the basics of security, and the best certification for that also comes from CompTIA. Their Security+ covers all the core concepts in IT security from Wi-Fi passwords and firewalls to employee best practices. Although this doesn’t necessarily go deep into any one area, it provides an excellent starting point and a balanced overview of the major topics.

So, what next? After you have Security+ under your belt, you can start considering some specialty certifications. One of the most popular next steps is EC-Council’s Certified Ethical Hacker (CEH) certification and Certified Security Analyst (ECSA). One of the best ways for a company to ensure that their systems are hardened (or secure) is to hire someone to try and break in. And since recruiting hackers from the Dark Web is considered very unwise (really, don’t do it), they instead look for those trusted individuals who are trained to think like a hacker. Based on that premise, the ethical hacker certification was born. Once certified, you will understand the tools (like Kali Linux) and the techniques (like penetration testing) that you can use to assure companies that their systems are indeed secure.

Another very popular certification is EC-Council’s Computer Hacking Forensic Investigator (CHFI) certification. Like the television show CSI, it is an area of the security field that focuses on how to collect and analyze digital evidence to detect when something is about to or has happened. Most companies know that it’s not if you will be hacked, but when. And with any hack or attack, there are always telltale signs or fingerprints that are left behind, leading companies to hire professionals to look for these to identify areas that may need more hardening, to avert an pending attack, or to clean-up after the damage is done under document what happened. This certification is about learning the skills for detecting or mitigating the aftermath of a successful hack.

That’s all we’re covering in this post, stay tuned for part 2 where we will continue down the road to more advanced IT security certification…

About the Author:

Martin Schaeferle

Vice President of Technology | LearnNowOnline | Eden Prairie, MN

Martin Schaeferle is the Vice President of Technology for LearnNowOnline. Martin joined the company in 1994 and started teaching IT professionals nationwide to develop applications using Visual Studio and Microsoft SQL Server. He has been a featured speaker at various conferences including Microsoft Tech-Ed, DevConnections and the Microsoft NCD Channel Summit. Today, he is responsible for all product and software development as well as managing the company’s IT infrastructure. Martin enjoys staying on the cutting edge of technology and guiding the company to produce the best learning content with the best user experience in the industry. In his spare time, Martin enjoys golf, fishing, and being with his wife and three adult children.