Computer Certification: 2007 in Review and a Peek at What Lies Ahead

By Anne Martinez

Page 2 of 4 1 2 3 4

Most Notable New Certification

A tip of the hat goes to the folks over at SANS Institute for their new certification, GIAC Secure Software Programmer (GSSP). The certification itself is a solid one, addressing the critical skill area of secure coding practices and identifying developers who know how protect against application vulnerabilities. It is offered in specialties tied to particular languages such as C, Java, PHP, PERL, and others. The sharp way the GSSP fills a marketplace credentialing need is only half of the story; an equally admirable accomplishment is how SANS is going about the testing itself.

Bucking the trend of other certification exams out there, GSSP testing provides a service beyond simple pass/fail reporting, it provides detailed feedback on how the candidate performed on various objectives covered by the test. Each score report identifies individual strengths and weaknesses, reporting on how the candidate scored in each area in relation to the best possible score as well as the average score for each task area. You can view a sample score report on the SANS Web site.

This is a real service and which should be emulated by other certification vendors, putting the emphasis on skills improvement as well as on skill confirmation. Some of the original certification programs used to provide such feedback, if not in as much detail, but this has largely fallen by the wayside due to security concerns and other issues. CompTIA has been one of the few to keep up a version of this over time, and the SANS Institute has brought it back in a big way. Let's hope that other certification vendors will consider doing the same, or even something better.

Trends in Certification Testing

From the test distribution standpoint, several things of note happened in 2007. First, exam security continues to be an issue of concern. Maintaining the integrity of the testing process is key to protecting the value of certification. In the past, tactics such as exposing candidates to a limited pool of questions, policing so called braindump sites, requiring photo IDs, and physical test center security have all been employed without complete success. Just this December, however, Cisco Systems announced that it will be introducing several innovations in the coming year to further combat exam fraud. These will include collecting digital photos and digital signatures of all test takers to further ensure the candidate's identity. This is likely a first step toward using biometrics to confirm identity, not just with computer certification testing, but with other professional testing programs as well.

Perhaps also in response to security concerns, several vendors who have utilized online testing in the past have switched over exclusively to proctored testing. This includes SANS Institute's Global Information Assurance Certification (GIAC) program, which has been employing online testing for many years.

Page 2 of 4 1 2 3 4