Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'd like to do a course about web security. I've seen some certifications that could be interesting:

What do you know about these certifications? are they recognized?

I'm not trying to become a hacker, I just want to ensure I have enough knowledge about web security to cope with today internet. From my inexpert point of view, "Certified Secure Software Lifecycle Professional" looks exactly as I want, the problem is that it cost more than 500 bucks!

Why certification? well, I want to learn but I would like also have a way to demonstrate to a future employer/customer that I had to study and pass exams, not only attend to a course.


share|improve this question
How much experience do you have in software engineering? Both of the (ISC)² exams require (or at least suggest) 4-5 years of experience. If you don't have the required experience, there might be an "entry-level" certification that you could look at in the mean time. –  Thomas Owens Jun 23 '11 at 10:35
I have around 7 years of experience. –  NullOrEmpty Jun 23 '11 at 10:54

1 Answer 1

up vote 4 down vote accepted

I don't know the first one, but the bottom two - CISSP and CSSLP - are both certifications I have. Neither one is going to give you enough specifically web security related information to make you into a knowledgeable web security developer. CISSP is a very broad certification where the qualifying candidate is expected to know a little bit about a very wide spectrum of security techniques.

CSSLP is a bit narrower - its specifically focused on software, so the candidate is expected to know a smaller subset of the CISSP topics, in more depth. There will be good software security stuff in there - stuff that is applicable to the web as well as any other software product. Again - not specifically a "web security" certification if that's what you're after.

In prowling around the ISC2 website, did you make to this page?


Filling that out for the CSSLP will get you exactly what the CSSLP cirriculum is these days. When folks are studying for these exams, they live and die for the "CIB" because it's the most up to date, bottom line description of what's going to be on the exam.

Unfortunately, I got myself a CSSLP before they implemented the test and cirriculum, I was in a lead batch of people who were certified to give the certification some street cred - so I can't speak much to whether I learned anything interesting the course of studying.

I can say that while CISSP has gotten a strong foothold in some industries, the CSSLP hasn't. ISC2 has a good reputation, but I haven't seen the strong push for CSSLP certified developers. IMO, that's because there's a big enough foot hold of generally good ways to interview for programmers, that the risk is not high that you'll hire a dud. But for security wonks, it's all over the map, and an organization typically only hires one or two - so CISSP ratings are much more helpful.

My biggest critique is that this is NOT a hands on course. If you thought you'd be staging, hacking and protecting software as part of your coursework -- think again. The course will prepare you to do well on a multiple choice exam. It'll have a lot of good information, but the application of the theory will be left up to you. Another tip - ISC2 produces courses and other companies produce courses. Look around and see what curriculum works best for you. ISC definitely structures courses for the CIB, I can't speak to other companies, but I've seen plenty of books labeled CISSP that where only tangentially related - your best bet is to compare the CIB to the cirriculum.

As an interviewer, my reaction is - a certification proves that the guy can take a test. Interviewing is the better indicator on whether the guy can do his job. I don't need him to take a test, so he better be able to talk about actual work that he's done (in the classroom or the cubicle) when we do our interview, or I don't care WHAT certification he has! Mileage varies only slightly in a world where my customers are demanding certifications... then I may be forced to keep searching until I find those guys that can do the job AND have certifications. But if I have to choose, I'll take the guys who knows how to do the job every time.

share|improve this answer
I see. Actually what I want is learning, and if I can get a certification or something that probes it, the better, but ... if the aim of the CISSP is just get the badge... it's not what I want. I already have a bunch of useless and meaningless Microsoft certifications already :D Thanks for your answer, quite the information what I was looking for. –  NullOrEmpty Jun 24 '11 at 11:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.