Q. Do Security Certifications really make a difference? Has security certification helped your career? What do you think the future for Security Certifications will look like; will they be more, or less important than they are today?

A. Yes, security certifications make a difference. Possession of CISA, CISM, CISSP e.t.c, as I mentioned earlier, is an indication of security authority in the IT industry. Also, IT professionals and managers need to have security certifications that would enhance their standing as generalists, who would be prudent in any security situation within their organizations. For example, Information Systems Audit and Control Association (ISACA) came up with following analysis: 1. More than 1,400 CISAs are now employed in organizations as the chief executive officer (CEO), chief financial officer (CFO) or an equivalent executive position. 2. More than 2,300 serve as chief audit executives, audit partners or audit heads. 3. More than 3,500 serve as chief information officers, chief information security officers, security directors, security managers or consultants. 4. More than 5,400 serve as audit directors, managers or consultants. 5. Nearly 13,000 additional CISAs are currently employed in managerial or consulting positions in IT operations or compliance. You can see with me that the statistics attests to the importance of the knowledge, skills and recognition achieved by IT security certified professionals.

For my career, the designation has not only made me an authority in the field but bestowed additional audit and security responsibilities and affording me an opportunity of being part of important IT assurance and consulting engagements. The future is bright for those with security certifications. They are the future business leaders – CEOs, CFOs, chief audit executives, audit partners or audit heads, chief information security officers, security directors, security managers or consultants. Definitely, there will be more certified professional in the future so long as the importance of enterprise IT security would not be ignored.

Q. Finally, what tips and advice would you have for students, who are working to get their ISACA CISA certification or interested in IT security and audit? What would you encourage them to do?

Studying for CISA examination is one step in achieving this Certification. There are a lot of study aids out there to prepare for the exam. CISA Review Manual is a great resource for this exam. The manual reflects a complete syllabus for the CISA examination. Like I said it is only for review purposes and does not preclude extensive study of related text books on information systems. Students should also visit ISACA website for an updated textbooks that covers CISA topics and exam question model. It is also important to attend review classes. Experience in IT audit, control and security is very relevant and emphasizes hands on. Students should seek for IT audit experience in order to understand what the issues are. In summary bear in mind that for you to be certified, you must pass the examination, agree to adhere to ISACA's Code of Professional Ethics, submit evidence of a minimum of five years of professional IS auditing, control, or security work, and abide by a program of continuing professional education.
Again, thank you for having me.