We’ll compare and contrast two of the leading cybersecurity certifications — the (ISC)² Certified Information Systems Security Professional (CISSP) and the GIAC Security Essentials Certification (GSEC) — and explore their prerequisites, the material covered on the exams and possible training options.
Give your career a boost with top security certifications: CISSP vs. GSEC
As a cybersecurity professional (or information security professional), you’ve likely considered the benefits of certifications such as the CISSP and GSEC and wondered which would be better for you to achieve to effectively prove your background and expertise in the profession. “The CISSP is ideal for experienced security practitioners, managers and executives interested in proving their knowledge across a wide array of security practices and principles,” says (ISC)². “[The GSEC is ideal for security professionals] to demonstrate they are qualified for IT systems hands-on roles with respect to security tasks,” says SANS Institute. (ISC)², or the International Information Systems Security Certification Consortium, issues the CISSP credentials to qualified candidates who can pass an exam to show their knowledge and skills on a range of security topics — along with an experience requirement. Those who take roles in networking, system administration, programming or security can look at attaining this credential, which is respected by employers worldwide. GIAC, or the Global Information Assurance Certification, supplies the GSEC credentials to qualified, working professionals who can pass its exam to prove expertise on a range of topics. These topics include network security, hardening operating systems and handling cybersecurity incidents. GSEC does not have an experience requirement and is generally considered a more entry-level certification compared to the CISSP. Both certifications are a great option but deciding which to pursue depends on the focus of the candidates. The (ISC)² certification is based on overall, theoretical knowledge of the cybersecurity realm. Its scope ranges through a wide variety of areas and requires strong experience to pass the test. The GIAC credential is more concentrated on technical aspects and could be of value to employers who are looking for hands-on professionals. According to GIAC itself, “GSEC is more focused on what security professionals actually have to do, and goes deeper in technical concepts.”
Topics covered by CISSP and GSEC exams
Simply knowing the topics covered for your certification might help you choose the right credential and determine if you’re ready to take the exam.
CISSP
The CISSP tests if candidates have the knowledge, skills and abilities in the field of IT security. The certification is appropriate for professionals whose daily tasks include monitoring systems (the software and hardware) and identifying risks associated with each network component to prevent any possible cyberattacks. Due to the wide coverage of cybersecurity topics, as seen below, it is also great for those asked to design and manage cybersecurity programs for their organization.
Security and risk management — 15% Asset security — 10% Security architecture and engineering — 13% Communication and network security — 13% Identity and access management (IAM) — 13% Security assessment and testing — 13% Security operations — 13% Software development security — 11%
Find updates to the exam below:
The (ISC)² CISSP CBK 2021 — take a closer look at the eight domains The (ISC)² CISSP exam information — get details about how the exam works The CISSP computer adaptive training (CAT) exam — learn about the CAT exam format
CISSP CAT exam information
Number of questions: 100-150 Length of exam: 3 hours Exam question format: multiple-choice and advanced innovative questions Passing score: 700 out of 1000 possible Exam language availability: English Testing Center: (ISC)² authorized Pearson Professional Centers (PPC) and Pearson VUE Authorized Test Center Selects (PVTC Selects) in a proctored environment. Find out more about online proctored exams (On VUE)
GSEC
The SANS Institute issues the GSEC. The credential requires passing a computer-based exam validating a candidate’s specialized knowledge on a range of technical security topics. The GSEC certification covers many items:
Access control and password management Active defense Contingency plans Critical controls Cryptography Cryptography algorithms and deployment Cryptography application Defense-in-depth Defensible network architecture Endpoint security Enforcing Windows security policy Incident handling and response IT risk management Linux security: structure, permissions and access Linux services: hardening and securing Linux: monitoring and attack detection Linux: security utilities Log management and SIEM Malicious code and exploit mitigation Network device security Network security devices Networking and protocols Securing Windows network services Security policy Virtualization and cloud security Vulnerability scanning and penetration testing Web communication security Windows access controls Windows as a service Windows automation, auditing and forensics Windows security infrastructure Wireless network security
As you can see, the GSEC covers an extensive number of hands-on topics. Candidates should keep in mind that GIAC requires its certification holders to possess information security knowledge beyond that of simple concepts and terminology.
GSEC exam information
Number of questions: 180 Length of exam: 5 hours Exam question format: multiple-choice and advanced innovative questions Passing score: 73% Testing Center: Remote proctoring through ProctorU, and onsite proctoring through Pearson VUE All GIAC certification exams are web-based. They are proctored, open-book format, but not open-internet or open-computer
CISSP or GSEC?
Both are valued credentials and require investment in time and money to achieve and maintain. So, which certification will it be? Once decided, just know there are long-term requirements for maintaining credentials. Continuing professional education (CPE) credits can be applied to maintain the certified GSEC designation. The same also goes for if you hold the CISSP certification that requires CPE credits — they can be obtained by attending industry events or conferences. To help you decide which credential is right for you, consider the following factors and points of comparison.
What is the best way to train for any of the certification exams?
(ISC)²’s CISSP self-paced online training course is a suitable option in preparing for your exam GIAC’s affiliate SANS Institute offers SEC401 (a security essentials boot camp style course) that can help to prepare for the rigorous GSEC certification exam Third-party courses from training partners offering skills training and certification boot camps can fit anyone’s schedule, needs and learning style
An evolving cybersecurity skill set
As cybercrime, hacks and attacks continue to evolve, the role of IT professionals cannot remain the same. Today’s modern digital world has hiring firms leaning towards individuals who can demonstrate true talent, who are willing to continue their knowledge building and can keep pace with the many changes in the IT security realm. Certifications can pinpoint specific expertise in hardware, software and networks while testing candidates on formal knowledge as well as tools of the trade, needed skills and hands-on abilities. Explore your career options and then opt to acquire the relevant certification in line with the occupation you are seeking. Choosing between CISSP and GSEC might seem easier, with CISSP as the preferred option thanks to its worldwide reputation; however, GSEC and its technical hands-on focus can be even a better option for candidates with fewer years of experience or who aspire to roles like auditors, forensic analysts and penetration testers in addition to those as security managers and IT engineers.
Sources
SEC401: Training for the GSEC certification, SANS CISSP – The World’s Premier Cybersecurity Certification, (ISC)² GIAC Security Essentials (GSEC), GIAC CISSP vs. the GSEC Certification, (ISC)²
