Are IT certs really a measure of talent?

In FCW's Oct. 28 story on IT certifications, a couple of readers disagreed with the contention that the credentials are the be-all, end-all to security hiring – or even necessarily the right answer.

Madwhitehatterwrote:

I'd rather see companies hire people who've been going to hacker conventions for the last decade than someone who did a 40-hour boot camp and got a brain dump. The government will stay behind when they don't have people who know the subject doing the hiring.

Amber Corrin responds:

The big problem there is recruiting the people attending hacker conventions. There may be a few talented individuals here and there who are willing to take on civil employment or working for someone else in a corporation, but by and large, you're talking about people whose very nature skews away from that type of work.

Tom Kellerman, vice president for cybersecurity at cloud security firm Trend Micro said it best at an event in October: "The U.S. has a culture of bastardizing the hacker community as a whole," he said. "If you're technically sophisticated and you know how to become a mission [yourself], why would you want a boss?"

An anonymous commenter wrote:

The only benefit of certification is for the certification providers! It takes critical finances, time and resources away from defense projects with little to no benefit in return. Experience is by far the premier indicator.

Amber Corrin responds:

But how do you measure that experience? I'm not defending certifications, merely playing devil's advocate – and reporting to you the response I got when I expressed a similar sentiment. Most commonly, certification requirements are used at least as a front-end filter in the hiring process rather than a guarantee of IT security savvy. But it's possible – maybe even likely? – that credentials end up being more than just a checked box that gets your resume past the first phase.