{"id":227,"date":"2017-09-13T08:57:39","date_gmt":"2017-09-13T06:57:39","guid":{"rendered":"http:\/\/www.scag.co.za\/wordpress\/?p=227"},"modified":"2017-09-13T08:57:39","modified_gmt":"2017-09-13T06:57:39","slug":"on-security-architecture-and-certification-part-1","status":"publish","type":"post","link":"https:\/\/www.scag.co.za\/wordpress\/2017\/09\/13\/on-security-architecture-and-certification-part-1\/","title":{"rendered":"On security architecture and certification, part 1"},"content":{"rendered":"

Professional certification is a necessity in the IT industry. Tertiary education <\/span>barely<\/span> scratches the surface of the required skills in the broad range of career paths available to an IT graduate<\/span>. Some career paths have many certification options available to them. With security being no exception, the problem is that security certifications are misunderstood and often very expensive<\/span>.<\/strong><\/p>\n

In this post, I will dispense with my thoughts on certification in the security industry and how they may be useful to a security architect<\/span><\/span>. *Note: I had planned one post for my thoughts on this topic, but it seems I have a lot to say. So I have decided to split the post up into a series of posts(this being the first).<\/span><\/p>\n

Security architecture is a cross-cutting field requiring skills in a wide range of areas<\/span><\/span>. In particular, technical knowledge of enterprise-wide disciplines is essential. <\/span>In this article, I <\/span><\/span>shall<\/span><\/span> be focusing <\/span><\/span>specifically<\/span><\/span> on the needs of an application security architect<\/span><\/span>.<\/span>
\n
\nWhat certifiable skills does a security architect need?<\/strong>
\nIt is not enough to have a strong affinity towards security. The security architect needs to provide inputs into the other specialized architectures, from a security perspective. Therefore a security architect needs to have good knowledge of network, data, infrastructure, application and enterprise architecture and how to apply security to them. This doesn’t mean the security architect should be looking at getting certification in these areas, but reading about the topics would certainly help where experience in the area has not materialized yet. Network security certifications in particular are usually vendor driven, and this wont help the architect who needs to ideally be technology agnostic in this area.<\/p>\n

Having technology specific certifications has its place depending on the architects role, but having generalized certifications will help the architect adapt to a broader business need. Security specific certifications for the most part are technology agnostic, and cover a broad range of topics. But this is where deciding on which certification to do becomes tricky. An application security architect needs to have strong technical skills, knowledge of architectural frameworks, and knowledge of compliance frameworks. In addition they need to know about risk, but most importantly how to communicate that risk in a language the audience understands.<\/p>\n

Traditionally<\/span><\/span>, architects from all fields have strayed a bit too far from where they got their hands dirty coding in the early days of their careers<\/span><\/span>. <\/span>This tends to result in the typical “ivory tower” kind of architecture, which is undesirable<\/span><\/span>. <\/span>Personally<\/span><\/span>, <\/span><\/span>I feel<\/span><\/span> an architect that is willing to throw together some code to <\/span><\/span>elucidate<\/span><\/span> an idea or proof of concept is <\/span><\/span>extremely<\/span><\/span> valuable<\/span><\/span>. Their code doesn’t have to be amazing, it <\/span>just<\/span><\/span> has to get the idea across. <\/span>The engineers can then work with an actual technical artifact as opposed to written documentation<\/span><\/span>. <\/span>I would stop short of certifying in this area though, as many architects tend to have some level of development background (usually a computer science degree)<\/span><\/span>. <\/span>Provided that<\/span><\/span> the coding skills <\/span><\/span>are exercised<\/span><\/span> once in a while, a computer science degree would <\/span><\/span>typically<\/span><\/span> suffice<\/span><\/span>. <\/span>An architects code will rarely (if ever) make it to production, so the architect need not be a coding rockstar (it does help, though)<\/span><\/span>.<\/span><\/p>\n

\"Security<\/a>
*By no means a complete skillset<\/figcaption><\/figure>\n

There are of course, many soft skills required of a security architect, but these cant be gained through certification. Similarly to a consultant, an architect will never be an expert in every field. What matters is the ability to use what knowledge they have to understand the environment in which they are working.<\/p>\n

This is the first post of a series of posts, which I will be releasing as I complete them. The next posts will be:
\nPart 2, The state of play: Security certification
\nPart 3, CISSP: So special it needs its own post
\nPart 4, What other certifications are out there, and their value<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Professional certification is a necessity in the IT industry. Tertiary education barely scratches the surface of the required skills in the broad range of career paths available to an IT graduate. Some career paths have many certification options available to them. With security being no exception, the problem is that security certifications are misunderstood and … <\/p>\n

Continue reading “On security architecture and certification, part 1”<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[43,44],"tags":[],"class_list":["post-227","post","type-post","status-publish","format-standard","hentry","category-architecture","category-certification","entry"],"_links":{"self":[{"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/posts\/227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/comments?post=227"}],"version-history":[{"count":11,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/posts\/227\/revisions"}],"predecessor-version":[{"id":243,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/posts\/227\/revisions\/243"}],"wp:attachment":[{"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/media?parent=227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/categories?post=227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.scag.co.za\/wordpress\/wp-json\/wp\/v2\/tags?post=227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}