The many similarities between SSCP and Security+ make it all the more important that you understand the differences between them as you decide on the best way to validate your knowledge to commence or progress your cyber security career.
An SSCP vs Security+ comparator involves a side-by-side look at two very solid early-stage security certifications from two of the most respected professional organizations out there.
While these qualifications share certain characteristics, they have important differences in terms of assumed knowledge and scope. The big question for any aspiring cyber pro should be, “Which certification would be the best use of my time and money?” The answer to this depends on several factors, including your current level of experience and future career goals.
To help you decide, here’s our Security+ vs SSCP comparison, complete with a look at what each certification consists of, who it’s for, and the type of jobs it can help you land.
What Are SSCP and Security+?
SSCP (Systems Security Certified Practitioner) from (ISC)2 and Security+ from CompTIA are certifications aimed at professionals in the early stages of their security careers.
Both certifications are vendor-neutral: i.e. rather than testing your knowledge surrounding specific types of technologies, they enable you to validate your expertise across a range of environments, hardware, and network types.
There is, however, an important difference between the two qualifications in terms of their intended audience. The biggest clue to this difference can be found in the entry requirements for each exam.
As we’ll see later, CompTIA recommends getting some IT admin experience and foundational networking knowledge under your belt. However, there are no formal eligibility requirements for Security+.
With Security+ therefore, we’re talking about an entry-level security certification. Working on the assumption that you already know your way around the basics of networking and IT admin, this certification enables you to build and demonstrate the knowledge you’ll need to step into junior security roles.
By contrast, to use the full SSCP credentials after your name, (ISC)2 requires you to have at least one year of professional experience. In comparison to Security+, it’s fair to say that the intended audience for SSCP is effectively one step ahead in terms of knowledge and experience.
Both of these certifications cover a broad range of knowledge, and there’s some overlap in the topics covered. However, the fact that they are aimed at slightly different audiences means that there are important differences in terms of structure, difficulty, and – crucially – immediate job prospects.
About SSCP
SSCP is a junior to intermediate-level security certification from (ISC)2 (The International Information System Security Certification Consortium).
In terms of reputational pedigree, you’re on strong ground with (ISC)2: This is the same organization behind the advanced-level CISSP (Certified Information Systems Security Professional) accreditation, which is pretty much the closest thing the security industry has to a certification standard.
SSCP is heavily focused on security administration and operations. It’s designed to show that you have both the experience and the foundational knowledge necessary to implement, monitor and administer an organization’s IT infrastructure using security best practices, policies and procedures.
So digging a little deeper, with the SSCP qualification to your name, it demonstrates (among other things) that you understand the following:
- The differences between various types of security controls, and when to apply them across a network
- Secure deployment of assets throughout their lifetime, from initial deployment, right through to archiving and disposal
- Applying and maintaining authentication and access controls
- The risk management process, continuous monitoring and analysis of results
- Incident response and recovery, including the implementation of business continuity plans and disaster recovery plans
- Cryptography, the implementation of secure protocols and public key infrastructure (PKI)
- Managing network security, including the operations and configuration of firewalls and other network-based security tools.
- Systems and applications security, including the deployment of mobile device management (MDM), the configuration of cloud security and secure virtual environments
Let’s say you have some experience of working in an IT environment already – e.g. in an assistant administrator role – and your job involves one or more elements of information security. SSCP is meant to build upon and validate your existing hands-on knowledge.
For employers, SSCP provides assurance that you have the proven technical skills to step up from junior operative-type roles into positions that carry more responsibility and technical know-how. These jobs might include the following:
- Database Administrator
- Network Security Engineer
- Security Administrator
- Security Analyst / Consultant
- Systems Engineer
- Systems / Network Analyst
About Security+
CompTIA Security+ is all about gaining and validating your baseline knowledge. The certification is designed to show that you can handle precisely the type of core tasks you’d be expected to do in an entry-level information security role.
In a similar way to SSCP, Security+ comes from a highly-respected professional association. In the case of Security+, it’s the globally-recognized trade body, CompTIA (The Computer Technology Industry Association).
When you land your first job as a security professional, your day-to-day to-do list can be quite varied. Example tasks include monitoring for potential and emerging threats and vulnerabilities, responding to and remediating security alerts, breach investigations, secure configuration of systems – and possibly also helping with the preparation of management reports and internal policies.
Security+ can help give you confidence, fill in any knowledge gaps, and demonstrate that you have the skills necessary to handle this type of workload. With this foundational certification on your resume, you demonstrate to potential employers that you can do the following:
- Detect various types of compromise and understand penetration testing and vulnerability scanning concepts
- Install, configure, and deploy network components while assessing and troubleshooting issues to support organizational security
- Implement secure network architecture concepts and systems design
- Install and configure identity and access services, as well as management controls
- Implement and summarize risk management best practices and business impacts
- Install and configure wireless security settings and implement public key infrastructure
As such, Security+ is a useful qualification to boost your credentials for a wide range of entry-level IT security roles. Examples include:
- Assistant Systems Administrator
- Security Administrator
- Junior Penetration Tester
- Network Administrator
- IT Helpdesk Assistant
- Trainee Security Engineer
Exam Details
Security+ and SSCP are both wide-ranging foundational certifications that offer a great deal of study flexibility, allowing you to learn at your own pace. The two exams cover quite similar ground, although there are differences in emphasis to reflect the differences in assumed knowledge and experience of their intended audiences.
SSCP
To earn your SSCP certification, you need to pass the ISC2 SSCP exam. This is a single 4-hour test comprising 150 multiple-choice questions with a passing grade of 700 out of 1,000 points. The exam is available in English, Chinese, German, Japanese, Korean, and Spanish.
(ISC)2 periodically refreshes the SSCP content and the weighting given to each subject area. This is to make sure the certification continues to reflect the technical skills and practical security knowledge that businesses and IT security professionals are facing.
At the time of writing, the SSCP exam comprises seven security domains weighted as follows:
- Domain 1. Security Operations and Administration – 16%
- Domain 2. Access Controls – 15%
- Domain 3. Risk Identification, Monitoring and Analysis – 15%
- Domain 4. Incident Response and Recovery – 14%
- Domain 5. Cryptography – 9%
- Domain 6. Network and Communications Security – 16%
- Domain 7. Systems and Application Security – 15%
When you feel ready to be assessed, you need to follow (ISC)2’s exam registration process. You’ll then be redirected to the Pearson VUE website, where you’ll be able to arrange to take the test at whichever local Pearson VUE testing center is most convenient for you.
Security+
Earning your CompTIA Security+ certification requires you to pass a 90-minute exam comprising a maximum of 90 questions. The latest exam version is SY0-601. It is marked out of 900 with a passing score of 750.
The content of the exam is broken down into five major domains:
- Attacks, Threats, and Vulnerabilities (24%)
- Architecture and Design (21%)
- Implementation (25%)
- Operations and Incident Response (16%)
- Governance, Risk, and Compliance (14%)
The type of questions you will encounter will be a mix of multiple-choice questions and some practical problem-solving challenges which CompTIA refers to as performance-based questions (PBQs).
In a typical Security+ multiple-choice question, you might be presented with a specific scenario relating to a common security-related challenge (securing corporate assets on an employee’s personal device, for instance), and asked to select the best course of action.
With a PBQ, you can expect to be provided with a simulation of a real-world setting (a mock-up of a network diagram, for instance), and asked to drag and drop components into their correct positions.
CompTIA lets you take the Security+ exam either in-person at a Pearson VUE test center that’s convenient for you, or online through the Pearson OnVUE remote exam proctoring service. You can explore these testing options to decide which one works best for you via the CompTIA testing guide.
Winner: Draw
This is a very close one to call; not least because the two exams are aimed at different audiences. SSCP wins on content depth. However, in our view, what you really want from a comprehensive foundational exam is breadth: i.e. topline coverage of a wide range of concepts that will come in useful in lots of different roles.
SSCP is really good at validating your security administration and operational skills, so in terms of exam content, it’s more of a deep-dive into those specific areas. If you have a very clear aim of progressing from a junior IT admin assistant to a systems security administrator with more responsibility, SSCP is definitely the way to go.
Despite having fewer subject domains, the Security+ domains are wider in scope. The exam touches on areas such as governance, risk, and compliance, threat vectors – as well as the operational side of security. Particularly if you are looking to get your first security job, the Security+ content is going to be relevant to a wide variety of roles.
Eligibility Requirements
Predictably, the entry-level security certification in this SSCP vs Security+ comparator does not come with any hard eligibility requirements. For the more advanced qualification, you need work experience to get the full accreditation.
SSCP
To be awarded the full SSCP accreditation, you must have a minimum of one year of cumulative paid work experience in one or more of the seven SSCP knowledge domains listed above.
For the purposes of eligibility, work experience is accrued monthly. In other words, to accrue a single month of qualifying work experience, you need to have worked at least 35 hours per week for four weeks. Part-time work and internships can also count towards your work experience as detailed in (ISC)2’s eligibility guidelines.
If you don’t yet have the requisite work experience, you can still sit the exam. If you pass it, you earn the Associate of (ISC)2 designation which shows employers that you’ve successfully completed the assessment. You then have two years to build up your work experience to the required level after which you can start using the full SSCP title.
Security+
There are no hard eligibility requirements to sit the Security+ exam and be granted the certification.
Nevertheless, CompTIA suggests that you build up at least two years of experience in IT administration before taking the test. Ideally, this should include a focus on security. They also recommend earning your Network+ certification (or equivalent) as a way of gaining a solid grounding in networking principles.
We can see the reasoning behind CompTIA’s two-year work experience recommendation. Namely, it’s a good idea to be familiar with IT infrastructure – and what it takes to maintain IT services and networks in a corporate setting – before you sit your Security+ exam.
That said, being on payroll in an IT admin role is by no means the only way to pick up the knowledge you need to succeed with this exam. If you’re lacking the recommended on-the-job experience, a comprehensive Security+ preparation course is a highly effective way of bridging any practical knowledge gaps.
Winner: Security+
Security+ is significantly easier to obtain than SSCP. Whereas (ISC)2 requires you to have a certain level of experience under your belt before you can use the full SSCP title, there are no formal requirements for gaining the Security+ certification.
Exam Difficulty
Security+ and SSCP are for IT security professionals who are at a relatively early stage of their careers. So, in each case, the focus is on gaining a thorough grounding of the type of concepts you’ll need to apply in real life. Both are achievable with the right level of prep.
SSCP
There’s a very good reason why (ISC)2 stipulates a work experience requirement for SSCP. This is a pretty grueling (4 hours) assessment that’s really designed for professionals who already have a solid practical grounding in IT administration and operations.
In terms of content, SSCP is framed very much from a business-oriented perspective: i.e. it’s concerned not just with how to apply and configure security measures, but how to apply them in such a way that the strategic objectives of the business are met.
As an example, you are expected to have knowledge of the inter-related disciplines of business continuity planning (BCP) and disaster recovery planning (DRP). In turn, this involves drilling into areas such as audits, training, implementation, and dry-runs for such plans.
It means that SSCP necessarily involves building up a thorough knowledge of some rather complex concepts that tend to go above and beyond the content you would expect to find in an entry-level exam such as Security+.
Security+
With Security+, we’re firmly within entry-level territory. This doesn’t mean it’s “easy.” The exam itself covers multiple and diverse topics from threat categorization through to governance principles, so there’s a lot of content to digest.
Familiarization with the content, along with plenty of practice, is the key to success. This is especially the case for those scenario-based PBQs we mentioned above. Here’s a taste of what to expect.
Winner: Security+
We’re not really comparing like-for-like here, as SSCP is designed for a more experienced audience than Security+.
What’s clear, however, is that students with less experience behind them should find the Security+ exam much more approachable and easier to get to grips with than SSCP.
Job Opportunities
No Security+ vs SSCP comparison is complete without determining which certification is best for landing you a job. For this, we’ve done a search of jobs via Indeed in the United States where each certification was mentioned in the job spec. Here’s the results:
SSCP
There are currently 2,654 jobs listed.
Typical roles advertised
- Information Security Officer
- Associate Security Analyst
- Security Operations Engineer
- Senior Helpdesk Technician
- Information Security Analyst
- Database Administrator
Examples
Security+
There are currently 7,020 jobs listed.
Typical roles advertised
- Security Administration Analyst
- Data Center Technician
- IT Security Specialist
- IT Systems Administrator
- Assistant Security Analyst
Examples
Winner: Security+
Security+ beats SSCP because of the volume of job adverts that specify it. Among employers and recruiters, we know that Security+ is one of the most widely-recognized certifications out there. So, particularly if you are seeking to land your first junior-level role, it’s definitely a wise choice.
Cost and Recertification
For both SSCP and Security+, you need to show that you are taking steps to maintain your knowledge of industry developments in order to maintain your certification. You demonstrate this by earning a certain number of “credits” during the period of certification.
(ISC)2 refers to these as continuing professional education (CPE) credits, and CompTIA refers to them as Continuing Education Units (CEUs). In each case, credits can be earned by undertaking activities such as attending conferences, seminars and webinars, self-study, and earning additional certifications.
Each organization has its own rules on what counts as a valid credit. Further information can be found in the (ISC)2 CPE guidelines and the CompTIA guide to CEUs.
SSCP
The initial exam cost for SSCP is $249.
The certification is valid for three years. However, maintaining your certification requires payment of an annual maintenance fee (AMF) of $125. Within that three-year period, you need to obtain a minimum of 60 CPE credits in order to recertify. More information can be found in (ISC)2’s recertification guidelines.
Security+
The initial exam cost for Security+ is $392.
The certification is valid for three years. Within three years of earning your certification, you must earn at least 50 CEUs to qualify for renewal. This can be achieved through a single activity (e.g. earning a higher-level certification), or through multiple activities such as attending seminars or participating in IT industry events. A total of $150 in continuing education (CE) fees is also payable per three-year period in order to renew. For more details, see CompTIA’s renewal path guidelines.
Winner: Security+
SSCP has a lower exam cost, but is more expensive to maintain than Security+. By way of illustration, SSCP’s total cost of certification and maintenance for the first three years is $624. For Security+, it is $542.
SSCP vs Security+: What’s Better ?
In an SSCP vs Security+ comparison, we are really talking about two different types of exams designed for students or IT security professionals at different stages of their career. So the question is less “Which one’s best?” and more “Which one is best at this stage of my career?”
Let’s say you are already in a junior cyber role focused around operations. If your main aim is to move up the career ladder, SSCP is a solid choice for moving into positions that require proof of higher levels of technical expertise.
However, If you are aiming to secure your very first job in this field, Security+ is the obvious choice. The reason is simple: it’s the most widely-recognized foundational security certification out there.
from StationX https://bit.ly/45QUeXD
via IFTTT
No comments:
Post a Comment