Need Advice from IT Security Experts

[marianne202]

Ok, my son will graduate in January from the local CC with a Network Professional certificate and a Security Specialist certificate. He is working in the school's IT department doing equipment and software installation, set-up, trouble shooting and repair. He is on track to finish his AAS in Information Systems Security next May. He had 3 years of previous training in HS in computers that also included building and repairing the schools computers. He also participated in the new Virtual Enterprise program co-sponsored by Apple. His goal is to work for the government doing cybersecurity / computer forensics. Now that you know his background here is where we need some assistance from those in the field.


We are looking at BS degrees and trying to decide on the best one for him. Here are the choices we have found, but we are looking for other suggestions, keeping in mind he doesn't qualify for any Pell Grant or other funds, so cost is a factor.


AMU BS in Information Systems Security

TESC BSAST in Information Technology

EC BS in Information Technology w/ concentration in Cybersecurity Technology

EC BS in Information Technology w/ concentration in Information Security

While EC's are more attractive based on degree type and title they do require more math which isn't his best subject. AMU's degree is interesting, but I don't know about cost and acceptance. He may also be able to use his FEMA credits at AMU that he can't use at EC. He is also planning on taking some certification exam and I'm not sure if AMU will apply those towards the degree.

What value do undergrad certificates provide? Here are a few he was considering.

AMU's undergrad certificate in Cybercrime Essentials.
EC's undergrad certificate in Cybersecurity
NC State's undergrad Computer Forensics

We are hoping once he gets the certificates in January, he will have some industry certifications (we are trying to decide the best ones for him) and be ready to move into some full-time work. The CC would actually like to hire him if they can get some funding approved. That would be the best of both worlds.

My last question, should he finish his AAS degree or transfer right into the BS? The CC won't accept much in the way of CLEP / DSST exams so he would have to sit through Gen Ed classes that don't thrill him. I'm thinking being able to just test out of these would be faster and easier.

I'm hoping those of you with some experience in this field can offer some suggestions. I'm also not familar enough with AMU's acceptance of transfer credits and CLEP/DSST and industry certs. I want to get him through this process as quickly and easily as we can so he can start racking up some real world work experience. I know the government won't hire him fresh out of school, so the sooner we get him in meaningful work the better.

Thanks for your help and suggestions.

[contactmail]

If he wants to work the government in security he needs 1) Experience 2) Certifications 3) Security Clearance 4) Degree (maybe)

For example, here is a security job description for an Information Assurance Analyst government contractor position:

Code:

Certifications:
DoD Required: (IAT Level III) ISC ² CISSP, GSED, SCNA, CISA, GCIH

Technical Required: At least one or more of the following: MCP, MCSE, CCNA, CCNP, MCITP Enterprise Administration

Experience: At least four years of practical experience working with various data (network and system) technologies, with a minimum of two of those years focused on security. Knowledge of certification testing tools. Understanding of basic DoD facility security requirements. Knowledge of DISA Security Technical Implementation Guides (STIG). Experience in DoD 8570 and 8530 requirements.

Clearance Level Required at Start Date: Secret

Minimum Education Requirements High School or Equivalent

1) Experience: Some government jobs have crazy experience requirements like at least 10 years but there are some jobs also have requirements like "6 years of experience or a Bachelors degree and 2 years of experience". So getting the degree is a good way to easily meet the experience requirements.

2) Certifications: If he wants to work in security, then he should start with the Security+ and work towards getting the CISSP and at least one Microsoft certification. If he wants to do IT administration, he should get the Security+ and the MCITP: Enterprise Administrator certification. For networking, get the Security+ and CCNA.

3) Security Clearance: If he will be working for the government doing security he will most likely need at least a "Secret Clearance" at a minimum. So that means either join the military or find one of the few jobs that don't require a clearance at hire but will sponsor him for one.

4) Degree: As long as it is an IT degree he should be fine. It doesn't need to be in security because he will have to get certifications like Security+ or CISSP to meet DOD requirements. Job descriptions I have seen say something like "A Bachelor's Degree from an accredited institute in an area applicable to this position (e.g. information systems, computer science, math, or engineering)".


Undergrad certifications are most likely not going to help. If I were him, I would finish the AAS in Information Systems Security and get whatever degree I am most likely to finish quicker. Then start getting a jump start on accumulating job experience and work on IT certifications. Keep in mind that a security job is an advanced level job and he may need to work other jobs to get to that level (Systems Techician > Help desk > Jr. System Admin > System Admin > Information Assurance Analyst).

[OE800_85]

I'm not working in these fields, but I know quite a few people who are. If I were you, and your son is really serious about getting a high level position like the one you mentioned, I would avoid any degree that's IT or Information Systems or whatever. These are often watered down programs that are for business people. The big sell today is "business and technology together" but he will be MUCH better off with an actual Computer Science Major. I think in most office situations a CIS or IT professional degree or whatnot would be ok, but for the government and so forth, they would likely be looking for Computer Science majors.

Also, get all the certifications you can, you may as well. They're very practical and not particularly tough.

[sanantone]

Correct me if I'm wrong, but I don't think computer science programs touch on many of the concepts in information security, information assurance, or cyber security. While someone may be able to get an IT security job with a CS degree, I don't think it's the ideal program. I believe IS is more business oriented than IT and that CS is mostly focused on software and theory. IT programs tend to be more practical covering hardware and software without all of the theory. IT security people have to understand networking and how people interact with technology. People are probably the biggest security vulnerability. These are the schools recommended by the NSA for the field your son is interested in. Most of the programs linked are in information assurance, information security, cybersecurity, and IT/IS programs with those concentrations.

Centers of Academic Excellence - Institutions - NSA/CSS

For a security clearance, outside of the military, doing an internship or getting an entry-level position with the federal government is the easiest way to obtain one. Government contractors will not sponsor for most positions and they require a lot of experience anyway. Departments and agencies that regularly require employees to have clearance are the Department of State, FBI, CIA, NSA, DIA, various DoD civilian intelligence agencies, Department of Homeland Security, NGA, and various federal law enforcement agencies.

[contactmail]

Yea, I would argue that Information Security is closer to business than computer science.

Consider the domains for the Certified Information Systems Security Professional:

Access Control
Information Security Governance and Risk Management
Software Development Security
Cryptography
Security Architecture and Design
Operations Security
Business Continuity and Disaster Recovery Planning
Legal, Regulations, Investigations and Compliance
Physical (Environmental) Security

Plenty of areas that a business degree & IT degree would be helpful for.

[scorched]

My job is a Global Enterprise Architect in IT. I work in govt sector consulting to the CIO's and section chiefs, plus I teach cybersecurity to Civil Air Patrol cadets for the CyberPatriot: The National High School Cyber Defense Competition competitions. If your son has access to a local CAP or other organization, this is a decent hands on learning scenario. Plus 3 primary defense contractors run it, and you get visibility into this world quickly. Between my job, CAP and my own college work, time is limited, but I am willing to be somewhat of a mentor to help.

But in my almost 20 years in IT what I have seen is that the degree really only matters in a few cases. If you want to be a programmer, then you need a degree in CS.
And if you want to do true computer systems development, then you need an engineering degree. The rest of IT is more of meh who cares as long as you have a degree. If you get a business admin degree with a specialty in IT, IS, MIS, CIS, or cybersecurity he will do just fine. This will allow easy access to an MBA which gets you into senior management slots later on. Certifications do matter when your first getting started, and you want to be associated to cybersecurity, then get a few basic operating system certs like vmware, microsoft, linux, solaris, etc.. Do not ignore the vmware one, everything is virtualized today with vmware dominating the market, and you will need to understand it. And I suggest getting a copy of vmware workstation for your home laptop or computer to practice security on. Make sure you learn a good scripting language like perl or python, and at least one good programming language like c, java or .net. You will this invaluable when doing security and need to automate things.
But then go for the security specific ones like Security+ to get you going, then move on to advanced ones like CISSP, CEH, CISA, CISM.

So a good way to get some really cheap training for these certs!? the IEEE, the institute of electrical and electronic engineers at IEEE - The world's largest professional association for the advancement of technology. Join this and the associated computer society, you will get access to discounts at Excelsior plus other colleges, you get free software from microsoft(listed below), and you get access to the Element K training(also linked below). This is an amazing access to web classes that provide all the training you need to pass most if not all IT related certifications. To join both it should be less than $100 for an entire year, and you can take as much training as you can handle. Elementk does claim some kind ace ceu credits but its pretty limited. Element K Course Completion Certificates
An alternative is the Association of Computing Machinery. Welcome — Association for Computing Machinery, the same element k access is available.
CEH is an awesome deep certification, at my stage in career, certs no longer matter, but I took the element k course for the knowledge, just never took the actual test. But you will love this class.

Online Computing Technology Courses | IEEE Computer Society

Expression Studio 4 Ultimate
Expression Web Designer
Project Professional 2010
Visio Professional 2010
Visual Studio 2010 Ultimate
Vista Business Edition
Windows Vista Enterprise
Windows XP Professional

Hope this helped.

[OE800_85]

Hey guys, perhaps my last post didn't come off right. I think recruiters, in a lot of fields, aren't necessarily concerned with the practical knowledge you've gained. There is a ton of on-the-job training for these kinds of positions, and they recruit people at a very young age. What they want is to see someone's ability, how capable they are of taking on a workload, not necessarily what they already know. For this purpose, I would put (most types of) Engineering, Computer Science, Physics, and Mathematics over anything else, and so does the NSA:

Frequently Asked Questions about the National Security Agency (NSA)

The link provided earlier is a list of institutions, they didn't mention anything about hiring people from these programs/institutions. However this link does, and I think there's a very important part here:

"Entry into an intern program is extremely competitive and generally restricted to entry-level external hires, although intern positions are sometimes also open to onboard personnel. Current intern programs include Intelligence Analysis, Cryptanalysis, Information Assurance, Signals Analysis, Computer Science, and Global Network Analysis. Degree types sought for most of these programs are technical and usually focus on electrical or computer engineering, computer science, mathematics, or physics. The Intelligence Analysis program emphasizes majors in International Studies (e.g., studies in Asian-Pacific, Middle East, or Far-East) and Computer Science."


Just google "most employable degrees". They're not always at the top, but Computer Science, Engineering, Physics, and Mathematics consistently do well up there.

Last point, and this is from an employment perspective. A computer science degree major will simply give you more. I can't think of many jobs that would require a MIS-Information Security or whatnot, that a CS major couldn't get. However, I can think of many that a CS major can get, that others can't.

[scorched]

what a lame response. i have friends at that agency, and a CS from TESC simply will not even get your resume noticed against all the one with degrees from MIT, GT, CMU, Stanford. That intern program only selects the BOB's.
otherwise its the person, not the degree. I have NO degree and make about 2.5x what a typical PhD makes.
And have CS PhD's on my team..and they tend to be the least valuable person on the team because they can code, and thats about it. the most valuable are technical people with business.

I know of a lead cyber intelligence analyst job at one of my customers and I can assure you they fully recognize MIS and CIS type of degrees. Further proof is that you can have a BS in Political Science or Criminal Justice, as long as you have the skills and certs to back it up

So I can assure anyone reading, that you will get hired without a CS degree, because as long as you have a degree backed up with certifications and experience you will be golden.
And a BA can lead to an MBA and put you in the corner office way faster than CS can get you there.

[OE800_85]

I think it's a whole other world when you're talking about the schools you mentioned above. People fight tooth and nail just to get into those programs, I would assume that's off the table for most of us here, I mean let's be honest. If someone's in MIT Engineering, CLEP/DSST, and so forth would be a waste of time for them. I think if you're gonna compare majors, you should compare them at the same school. If you're wondering, yes I think CS at MIT is much better than MIS/CIS at MIT, if they even have that program, for that matter.

I literally just showed you actual information, from NSA. Confirmed sources, from the horse's mouth, if you will. You've simply replied with personal experience and hearsay.

I think the topic of what you actually learn is not relevant to this particular debate, it's simply what recruiters in top agencies want. He was clear about where he wanted to go. I'm just being honest...in my opinion, he has no chance of working at that level with an MIS/CIS degree. Those degrees are meant for people who do a mix of business and technology. You know what they say, jack of all trades, master of none.

The "establishment" puts much more value on a CS Major than an MIS. Whether you actually learn more or not, is a totally different argument.

If you're curious about my reasoning for why they think so, here are some things to consider:

CS is much heavier on mathematics
CS is much heavier on coding
CIS has a lot of business courses, but the majority of them are introductory (Accounting I and II, Intro to Finance, Econ, not necessarily groundbreaking stuff)

Let's also look at wall street. True, a place that's become infamous for greed, but has some of the smartest people in the world, regardless. The majority of these people studied mathematics, or a very math-heavy finance program. In the end, the core subjects (mostly STEM) reign supreme. It's why Bill Gates invests in them.

Final word: I will probably get the BSBA CIS degree. But let's not kid ourselves here, from a recruitment point of view, it's not the same as a CS major.

[OE800_85]

If you're curious about the difference between a CS and CIS/MIS degree, look here, a good summary:

education - Computer Science v.s. Computer Information Systems v.s. Management Information Systems - Stack Overflow

Top answer. The thread is a bit old (2009) but frankly the degree structure hasn't changed much in that time.