Who Needs CISSP for Ethics?
Last year I discussed the value of the CISSP with respect to its code of ethics. Today while renewing my ISSA membership, I was presented with the following:
The primary goal of the Information Systems Security Association, Inc. (ISSA) is to promote practices that will ensure the confidentiality, integrity, and availability of organizational information resources. To achieve this goal, members of the Association must reflect the highest standards of ethical conduct. Therefore, ISSA has established the following Code of Ethics and requires its observance as a prerequisite for continued membership and affiliation with the Association.
As an applicant for membership and as a member of ISSA, I have in the past and will in the future:
* Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;
* Promote generally accepted information security current best practices and standards;
* Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;
* Discharge professional responsibilities with diligence and honesty;
* Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and
* Not intentionally injure or impugn the professional reputation of practice of colleagues, clients, or employers.
Please check the box indicating you have read the above statement and agree to its principles:
It looks to me like ISSA has the ethics bases covered. If I agree to that statement, I get as much value as being a CISSP as far as ethics goes.
Unfortunately, misdirected efforts like DoD 8570.1 attach significance to the CISSP out of all proportion to its worth.
The primary goal of the Information Systems Security Association, Inc. (ISSA) is to promote practices that will ensure the confidentiality, integrity, and availability of organizational information resources. To achieve this goal, members of the Association must reflect the highest standards of ethical conduct. Therefore, ISSA has established the following Code of Ethics and requires its observance as a prerequisite for continued membership and affiliation with the Association.
As an applicant for membership and as a member of ISSA, I have in the past and will in the future:
* Perform all professional activities and duties in accordance with all applicable laws and the highest ethical principles;
* Promote generally accepted information security current best practices and standards;
* Maintain appropriate confidentiality of proprietary or otherwise sensitive information encountered in the course of professional activities;
* Discharge professional responsibilities with diligence and honesty;
* Refrain from any activities which might constitute a conflict of interest or otherwise damage the reputation of employers, the information security profession, or the Association; and
* Not intentionally injure or impugn the professional reputation of practice of colleagues, clients, or employers.
Please check the box indicating you have read the above statement and agree to its principles:
It looks to me like ISSA has the ethics bases covered. If I agree to that statement, I get as much value as being a CISSP as far as ethics goes.
Unfortunately, misdirected efforts like DoD 8570.1 attach significance to the CISSP out of all proportion to its worth.
Comments
As far as Certs go, they are a necessary evil in the business. Like you said earlier, it's just a way to get past the HR screening process.
Code of ethics for professional bodies are good, but unless that body has some disciplinary authority beyond merely revoking membership, the ethics codes have about the same validity as the good old loyalty oaths of the 1950's.
The issue I see is the 'CISSP Boot Camps' or 'examination review' classes. Two weeks before the exam, I called ISC^2 to confirm the location, and I was asked if I had taken their exam review courses. When I indicated I had not, the individual on the phone suggested I would have a much better chance of passing through the course rather than self study. I believe this contradicts the spirit of the certification as an 'experience based' cert.
If ISC^2 wants to maintain the credibility of the CISSP designation, boot camps and exam review classes have to go.