BA Computer Science TESC

[jmed]

Hi, Geezer. Congrats to your son; he's going into a great field.

I'm a CISSP Info Assurance consultant (with a 10+ year software dev background, so ryoder you are not alone, but I agree it is rare to find), who does a big mix of system admin, programming, secure code review, virtualization admin, database admin, and security nowadays.

I agree with ryoder, but just wanted to point out that the government & IA industry is moving in the direction of more security not just from a systems perspective, but also from a software perspective. So in the future more and more developers will need to understand InfoSec, especially in regard to secure coding.

There are a few certifications now targeting that need
- CSSLP (Certified Secure Software Lifecycle Professional)
- GSSP (GIAC Secure Software Programmer, with separate tests for Java, .NET, and C)

I think, especially if he's looking to work for the government, this is a good way to combine interests in InfoSec/InfoAssurance and programming.

Most IA people I come across are not very technically knowledgable. There are a lot of government and military regulations to keep track of and documentation to write up to show programs are in compliance, and lots of IA people focus on that. I like the technical side personally.

CEH is not too hard to study up for in free time. Neither are Security+, Network+, Linux+. The government actually requires tech folks to have Security+ at a minimum if they do anything security-related, or something more advanced like CISSP.

Check out http://www.hackthissite.org and MetaSploit if he wants to look into learning more about pen testing. There are other good resources, but those are popular with would-be ethical hacker folks.

Side note: I think pen testers make less than software dev folks, so if he has no strong preference either way, have him go software+InfoAssurance or OracleDBA+InfoAssurance, those pay more than straight systems/network stuff often.