Certification in Information Security

In a future post (or series of posts) I'd like to go into more depth about the range of certificates available in information security and its specializations, such as cyber forensics and privacy protection.  For the moment, I'll just make some comments as to why this is such a growth area for certification, with Career Onestop now listing 128 different certificates for information security analysts.

Part of it is simply that corporate security departments are notoriously risk-averse, and possessing certificates provides a certain level of cover in the event that the worst does occur.  One can say "we took all necessary precautions, we are CompTIA Advanced Security Practitioners here" - so when that data breach occurs, the IT Security guy can say that it would have happened to any organization, we just got unlucky and were hit with that one "super worm" or whatever you may have...

It's also a new and emerging field in which there still are not many certificates and degrees issued by reputable colleges and universities.  Sure, if you search for "information security certificate" on Google you will get a few established colleges - one of the University of London colleges, Stanford, and Devry come up for me - but demand still seems to outstrip supply at these institutions, leaving a gap for occupational and industry associations to fill.

And, on some level (and I realize I might be going out on a limb here), I think there is a "security guard badge" effect going on with the blossoming certification ecosystem in information security.  Although your typical mall cop lacks the backing of the state to enforce the law, if you take the time to observe their uniforms you will often see quite elaborate badges that seem to be deliberately designed to evoke the authority of law enforcement.  Indeed, many members of the public probably give no thought whatsoever to the legal differences between a police officer and a private security guard - when you see a badge that looks similar to your local police department, you may assume that the officer has the same powers of arrest and deserves the same level of respect, and you probably don't notice the fine-grained differences between the security guard's badge that, underneath the customary American eagle and shield may have "Securitas Corporation" in little letters, and the badge of your local police department - which, unless you're a cop or a frequent criminal, you probably aren't really familiar with anyway.  (And, incidentally, I've found that if you want to tease a security guard at your local shopping center/stadium/bank/museum/overly fortified office building, saying "nice badge" is a great way to get under their skin!)  Because private security in all forms relies on imitating the sanction of the state that characterizes "real" law enforcement to elicit compliance, it doesn't surprise me that they create certificates that imitate the degrees one would expect professional law enforcement officers to posses, enhancing their legitimacy and power within the organizations in which they work.