Is the CSSLP worth it?

Last week I passed the (ISC)2 Certified Secure Software Lifecycle Professional (CSSLP) exam. Here are some thoughts (not bound by the (ISC)2 NDA):

Cert Types

There are two classes of certification within the (ISC)2 family: member and associate. The only difference between the two is how many years of experience you have in the subject area. For full membership, you need to have 4 years experience in at least 1 of 8 domains. If you have been doing devops for at least 4 years you will most likely be fine. If not, then you can go for the “associate” cert with the understanding that you have 5 years to gain that experience.

Summary: If the reason you are getting this cert is to have some letters on your resume, you might want to just go for the associate level. Who knows where you will be in 5 years.

Preparation

Option 1: Experience

This cert focuses on security aspects in the full lifecycle of “enterprise” application development (read: .Net/Java). Honestly, I do not believe that my 18+ years of PHP development would have prepared me to pass this test, even though I had several years of Java dev in the midst. There were too many questions on processes, Microsoft, Java, and acronyms. My three years in the infosec arena certainly helped, but did not cover all the bases.

Option 2: Official Training  = High cost / Low risk

If you prefer live training, want to make dead sure you pass the test, and you have $2695 laying around, you can take (ISC)2’s official week-long trainings.  The also have self-study classes from $99 up to $695. If your company wants to pay for this, awesome! Good luck with that. (ISC)2 also has CSSLP Flash Cards on their website, but in my case they only represented about 60% of the concepts on the exam I took.

Option 2: Job training portals = Low cost  / Medium risk

Through my office, I was able to take the free FedVTE online CSSLP training. The 20-hour series of videos from CMU were great as an overarching review of security practices (when they say 20 hours they really mean 30+ hours). I feel that these trainings only provide a 60% solution. The information is great and highly recommended, but if your goal is passing, it won’t be enough by itself.

Looking back I also had access to the CSSLP resources on Skillport/Skillsoft. Make sure to check your company offerings.

Option 3: Read the book

There are several books out there purporting 90% passing rates. Looking at the comments on the latest official (ISC)2 offering will not give you much hope of passing. Not being too confident in scope of the FedVTE Computer Based Test (CBT) class, I purchased Conklin’s CSSLP Certification All-in-One Exam Guide. Similar to the CBT, the material covered was broad but still did not cover all the areas of the test. The Microsoft specific areas of the book were definitely helpful, coming from a Linux world.

Summary: GetConklin’s book. If you are on a budget, use the official (ISC)2 training and books as a last resort.

Exam

Time: You have 4 hours to complete 175 multiple choice questions at a Pearson Vue center. I managed to finish in under 90 minutes. ie. You have plenty of time to read each question carefully.

Content: As a CBT, each persons’ exam should be different, so YYMV. Although the practice exams got me a bit scared, I did not encounter any “Which of these 4 ISO standards is the right one?” A fair number could be solved just by process of elimination. Having the years of experience certainly helped with a number of questions that the CBT and books overlooked.

Passing: I was surprised when I first looked at this test, as you only need a 70% to pass. Part of that may be the fact that the test is “a mile wide and an inch deep“.

Completion

Unlike certifications you might be used to, (ISC)2 and some others require you to be endorsed by someone who is an active (ISC)2 member in good standing. Hopefully you already know someone who is a member and can vouch that you have the required professional experience. In a couple weeks that should be me as well.

Prospects & Alternatives

A search today on some of the more popular boards reveals job postings for CSSLP professionals.

• Monster: 225
• Dice: 25
• Indeed: 163
• SimplyHired: 213

These numbers are not all that great, especially since I did not place a geographical restriction on the search.

There are many other security related certificates out there. CASP, CISSP, GWEB, and CEH are some of the more well known.Though some colleagues believe the value has been watered down in recent years, there are over 10x more jobs requiring a CISSP certificate. In many postings where CSSLP shows up, it is paired with one of these other more well known options.

Summary: If you are getting this to find a new job, other certs have more flexibility.

Value

Cost: Certs are not cheap. The CSSLP exam costs $595, plus, to keep your cert active, you must pay $100 and receive 30 Continuing Professional Education (CPE) credits per year. Training can be expensive as well. If your company is willing to pay for it, great! Out of pocket, ouch.

Visibility: This is not a well known cert. Despite the (ISC)2 website saying “CSSLP Named #1 Tech Cert that is Paying Off by Foote Partners” (for the first half of 2014), the job market says otherwise. Granted, it is no longer 2014 so perhaps it did pay off for 6 months.

Credits: Many certs these days require you to receive CPE credits to stay “active”. I plan on using the CSSLP as 50 CPE credits to renew my Security+ cert.

Usefulness: This cert material is useful, especially if you do not have a formal CS degree, or you are moving more toward leading teams or project management. It is a SDLC focused cert after all. There was a broad mix of useful security practices, “enterprise” situations, and supply chain considerations. At the very least, government recruiters like to see tons of certs on resumes.

Conclusion

It seems that certain people (especially government related entities) think the only way a person can know material is if they have paper proof. If you are looking to switch toward the security industry but lack the experience, I would check out the Security+ exam first.  Several government agencies will accept that as proof that you know enough security to get in the door. If you already have 5+ years in infosec, go for the CASP or CISSP instead. They both have broader visibility. However, if you are a PHP developer and plan on working just for PHP companies, the ZCE is a much better place to start, with its lower upfront cost and no yearly maintenance fee.