My entire foundation as some one that designed and implemented networks was reversed, and I ended up working doing penetration testing, risk assessments, and various types of IT audits and consulting projects.

Without the initial industry experience, I’m not sure I would have had a foothold. Although some people can “break” directly into security, the best foundation in my mind is to start learning a normal IT disciplline: development, networking, windows, database administration. From there, learn security as a concept, and from your initial knowledge you’ll at least have something to say about one area of security, and perhaps that’s where you specialize. Since I wasn’t a developer, I’d make a pretty awful application penetration tester, but then again I’d never posit to be one.

To succeed in a field that is based on deconstruction, try learning to construct something first, then at least you can tell people how to put it back together when you break it.

I probably should have said “Then it lists a bunch of sites that are using this image without credit.”, but what’s done it done.

I was more pointing out the terminology “stolen”. Technically it’s “infringing”, no? :)

@miniterdod — fined or jailed? Really? That seems a bit of a harsh reaction.

I thought this time around the exposing-the-hoax photos came pretty much on the heels of the hoaxes themselves. People want to know they’ve been hoaxed more than they want to believe the hoax.

You raise some very good points. Of course, there is no perfect way to do this, and the system does result in a “learning margin” rather than learning/dollar. Measuring learning is difficult, especially measuring potential learning. It may not be possible to forecast anything reasonably. In the end, as you state, you have to answer “is this certification right for me?”

However, for a security practitioner, I would argue that the 100% “learning margin” you get in accounting or marketing may be worth more than a 20% learning margin in yet another security cert. My own studies in the fields of Psychology and Economics, for example, have done more for my career than picking up a GWEB or GWAPT cert would have. There comes a point in security where it seems people add certs to add certs and focus more on the letters than the learning. Personally, I doubt that a fourth, ninth or fifteenth certification really adds much career or income-wise when compared to your third, eighth or fourteenth certification.

This is, of course, bad news for certification companies that seem to be creating paths and “ladders” to success. I wish they worked, but I have yet to see much evidence than anything beyond three certifications in a field do much to benefit one’s career.