Mike Holcomb’s Post

ICS/OT Cyber Security Certification Paths - One of the most common questions I get about the ICS/OT cyber security world is what certifications exist and which have the most meaning. While learning about ICS/OT cyber security does not always mean taking a certification course, becoming certified can help demonstrate your knowledge and passion in a subject area while accelerating your learning - especially if you are new to the field. Not only this, but being certified can help demonstrate your knowledge and passion to potential clients and hiring managers. Here is how I explain them: 1. ISA 62443 Cybersecurity Expert Series ISA 62443 is considered the gold standard today in understanding how to properly secure an ICS/OT network. It makes complete sense that the International Society of Automation (ISA) team would put together a series of certifications for demonstrating ICS/OT cyber security knowledge. The series is comprised of four courses, each with their own dedicated certification (see the included picture). If you complete all four courses and the associated certification exams, you become an "ISA 62443 Cybersecurity Expert." For the purpose of comparison, some refer to this as the "CISSP of the ICS/OT world" as being the most generally recognized and accepted. Unfortunately, you must take each course before taking the corresponding certification exam. Compared to the SANS certification courses, the ISA classes are considered affordable and cost effective. 2. SANS ICS/OT Certifications The heavy weights of the ICS/OT cyber security space in terms of knowledge and real-world experience by far are the three certifications (GICSP, GRID and GCIP) and associated courses from the SANS Institute. Unfortunately, the price at approximately $10,000 USD (for the course and certification attempt) each these days, can put these courses out of price range for a lot of people. Each course provides participants with a tremendous amount of knowledge from industry and world leaders in the field such as Robert M. Lee and Tim Conway. I consider myself very fortunate to have been able to take these courses through my current employer. If I was a hiring someone for an ICS/OT cyber role and was evaluating certifications, these would be my first choice, especially the GRID certification based on the course written (and taught often) by Rob Lee (more on my incredible experience with this course in another post.) 3. Vendor Certifications While ISA and SANS take up most of the space in the certification market, there are other ICS/OT vendors that provide training courses with associated certifications. I have not taken any of these other certifications, but I would be curious to hear everyone else's feedback from those that have. The one vendor I hear about the most in this space is exida. What else am I missing in the ICS/OT cyber certification world? #icssecurity #icscybersecurity #otsecurity #otcybersecurity #cybersecurity

A good breakdown by a seasoned practitioner. IT/OT/IOT i believe is the cyber way of the futureas w see the convergence of these discipilines every day.

As entry-level cyber security professionals or cyber security students we are all too focused on obtaining entry-level certifications, me being one among the herd. Having completed 2 entry-level certifications namely ISC2 CC and Google Cybersecurity, I would like to take this opportunity to share my experience with both certifications. The ISC2 CC is a brand-new certification and I don't think it's as famous as CompTIA Security+. But, for students like me, who tend to be short on finances to afford paid training and exams, ISC2 CC is a worthwhile addition to our list of certificates. As of now, both the training and exam are available from ISC2 for free. I know, 'cause I utilized this opportunity 😃. Though it may not be as famous as other certificates out there, the topics covered and the training is no slouch either. For someone just beginning their journey into the cybersecurity domain, it explains all the fundamental concepts in easy-to-understand video lectures and has quizzes at the end of each module to test our understanding. The same can be said about the Google cyber security course. The training materials from the Google course are well-structured and easy to grasp. There are a few differences between the two. The practical hands-on labs that is available on the Google course are absent from the ISC2 course. Then again the ISC2 certification exam is predominantly MCQ-based and if I had to talk percentages I would say 70% of questions are direct MCQs on the core concepts and the rest are scenario-based questions that can be answered with a little bit of thoughtfulness. The networking part of the Google course focuses on what tools and technologies we can use to secure our networks where whereas the same in the ISC2 focuses on the basics of networking along with Network Security. ISC2 also has modules that go a little bit deeper into disaster recovery and business continuity and this is not the case with the Google course. Then again the Google course talks more about concepts like NIST Frameworks which is not at all a part of the ISC2 training. In my opinion, as a beginner in cyber security, one should aim to get both certifications. Though they are both entry-level certifications, each deals with a different aspect of the cybersecurity domain. Going through both training courses helped me gain a well-rounded understanding of cybersecurity.

What Cyber Security Certification Is Best for You? What Cyber Security Certification Is Best for You? How Much Does a Cyber Security Certification Cost? What Are the Requirements to Choose the Right Cyber Security Certification? What Benefits Does the Right Cyber Security Certification Offer? Unlock Your Cyber Security Career: What Are Your Options? With the rise of cybersecurity threats, businesses and governments are investing billions of dollars to safeguard their systems. A cybersecurity certification can make you stand out and progress in this rapidly-evolving industry. These certifications cover a vast array of topics, from user information and device access control to risk management and cryptography. They help expand areas of expertise while informing people about new technology and industry methods. To read more, go to: https://lnkd.in/exeKMreT