The Security+ Certification's Evolution and Remake Over 10 Years
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
The CompTIA Security+ is nearing its tenth birthday. To date, more than 60,000 people have the Security+ certification. By now I assume many of earliest adopters are well advanced in their careers. Some likely specialized in one facet of information security for their companies, moved to senior management positions, or continued on as consultants. In any case, the Security+ gave an important foundation to many information security professionals over this past decade.
But a decade is a long time. For information security, it’s very long, having witnessed huge changes in technology, connectivity, attack techniques, and motives. But one thing hasn’t changed: the attempts—purposeful or not—to get unauthorized access to protected assets. The access attempt might be to read, makes changes, or outright destroy that asset.
Unauthorized attempts are the reason we have a job, right? There has always been the need to assure confidentiality, integrity, and availability to those assets. How we provide that assurance must adapt—and that’s where the Security+ certification must adapt, too.
Changes in Technology, Tactics, and Motives
To begin with, technology has changed by an order of magnitude. Over the past 10 years we’ve kept true to Moore’s Law, which generally suggests the number of transistors packed away in an integrated circuit doubles every 18 months or so. Yes, things have gotten smaller, faster, and consume less power. And as hardware becomes more powerful and takes less space, we rely on it to perform more tasks in real-time than we could have dreamed of only a few years ago.
Connectivity changed at a similar pace. These days, using online services for personal banking or social contact is not just for the youngest generation. Nearly everyone goes online to connect with friends and family as well as do their day-to-day work and life in one way or another. Reliance and trust in online services is at an all-time high. Unfortunately, so is the variety of attack methods and tactics.
The tactics used by us (assuming you’re one of the “good guys”) and them have also changed. Tactics are changing faster than ever before. As a result, security professionals responsible for combating the “bad guys” are forced to specialize. Understanding malware is now a full-time career path. Incident response is a highly valued specialization. Lastly, exercising skills to work with law enforcement can mean the difference between a successful prosecution and a criminal beating the charge.
More scary than the evolved tactics is the evolved motivations behind their use. Not long ago, the best and brightest hacker would deface a website for the greater pubic to see. Now, the best and brightest are feared because their actions are never seen or traceable. Only the depleted bank account remains. Money talks, the rest walks.
Individuals wishing to keep up with the pace need to be involved. People wanting to prove worthy to fix the problems, and apply the solutions—those people need to be involved. Simply understanding the concepts is far from enough. It takes application and practical know-how. Is the Security+ certification thinking the same?
Is the Security+ Exam Adapting as Well?
On the surface, the exam profile remains the same: 100 questions over 90 minutes. Student must get a score of 750 or above to pass. While CompTIA doesn’t require prerequisite experience, they recommend two years of security or network experience. That’s where the similarity between previous and present exam versions end.
At the time of this writing, the Security+ exam is in its third version. (However, the second version is available until end of 2011 for candidates wanting to leverage older study materials.) The latest exam version is recreated from top-down, from its purpose, the topics (“domains”) and of course, individual questions.
Maybe the smarter question is this: is the Security+ exam changing to reflect the students’ best interests? After much analysis of the objectives, the answer, in my opinion, is a big yes.
New Exam Starting With a New Purpose
The examination has a new purpose and it’s most transparent from studying the exam’s objectives. The purpose is clear: analyze and implement. For example, reading the objectives from the older exam, they commonly began with “explain,” “understand,” and “compare and contrast.” Compare that to how objectives from the newest exam begin: “analyze and differentiate,” “carry out,” “use and apply” and implement. The purpose has clearly shifted from understanding concepts to having practical know-how.
New Topics and Breakdown
CompTIA publishes the exam breakdown, starting with the top six areas or “domains,” down to each topic, sub-topic and bullet points of expected content. They offer a full blueprint with how “weighted” or the percentage of each of the six areas within the exam. For example, Cryptography takes up 11% of the newest exam, a drop from 15% in the previous version. Meanwhile, objectives covering threats and vulnerabilities used to be distributed across three domains, whereas now you have a dedicated “Threats and Vulnerabilities” domain occupying 21% of the full exam. The only other domain close to that is Network Security, also 21%, full of “implement” objectives and content.
Again, studying the objectives and breakdown makes it clear that the purpose is toward implementation. I want to go into much more detail, but this article can only be so long. Suffice to say, topics and sub-topics are moved around to best serve the purpose.
The Security+ in Numbers and Your Career
How does having the certification impact your career? On November 14, 2011, the results from a recent survey of IT professionals were published. The survey asked how their certifications affected their career. End result: a strong correlation between getting the certification and a promotion, salary raise and/or a new job. Interestingly enough, security certifications were shown to be the most beneficial and “the CompTIA Security+ named the single most popular” certification. (And yes, I’m certain the survey wasn’t sponsored by CompTIA.)
We mentioned earlier that 60,000 people to date are Security+ certified. But how many are seeking the certification today? According to Security+ certification product manager Carole Balkcom, the number of people seeking the Security+ is accelerating. Now, more than 2000 people a month are signing up, or twice the average since Security+ started 10 years ago. The certification is actually gaining popularity and if it isn’t already, it’s becoming the de facto foundation.
Summary
We established 10 years is a long time for certifications, especially those covering information security. Technology, processes, and people change quickly. We established conceptual understanding is not enough to keep up with this change. Instead it takes people wanting to be involved. Fortunately, those behind the Security+ certification apparently feel the same as we do. The Security+ exam, in its third version today, shows a large push toward application and implementation. And we established an increasing number of people are seeking that kind of certification. In the case you do not yet have the Security+, it seems now is the time to strongly consider preparing for it.
References
Evolution from SY0-201 to SY0-301
Interview with product manager, Carole