What kind of education should my son get for a career in security

[bradlymathews]

He is thinking if going to Heald for a 2 year degree in computer security. Is this a good idea? Or should he go the community college/university route? Grandparents left him a small sack of money so that is not a consideration. Just want what will give him the best start.

Any other advice?

Thanks,
Brad

 

[Langly]

What sort of classes are offered at that 2 year school for security?

 

[gangolfus]

The best education he can get is real world experience. He should go wherever has the best co-op or intern program that will help him be on site at a company learning from someone doing security professionally.

 

[AliceCooper]

The best education he can get is real world experience. He should go wherever has the best co-op or intern program that will help him be on site at a company learning from someone doing security professionally.

This if he has the opportunity, also don't rule out certifications such as the CISSP.

 

[l3thal6]

Just have him start out by hosting a website from home, securing your home network and them maybe he could try to find some small security consulting jobs, after that just keep moving up!

 

[Nicklebon]

This if he has the opportunity, also don't rule out certifications such as the CISSP.

A CISSP cert requires at least 5 years of experience in 2 or more of the 10 domains as well an endorsement from someone who is already a CISSP. It is not an entry level cert.

 

[wixter]

The best education he can get is real world experience. He should go wherever has the best co-op or intern program that will help him be on site at a company learning from someone doing security professionally.

+1...in the IT world this is the primary indicator of how well someone will likely do in a job, assuming that the right questions are asked during an interview. I was rather lucky myself in that I got my career start before I even finished high school in the early '90s. Back then hardly anyone knew much about PCs in general so if you were able build your own PC you were already looking a stable career just doing that...can't do that today because its so common and easy to do.

I got a lot of exposure early on before I even had a job and then just leveraged that knowledge and experience into the next one. I didn't realize at the time just how much the dot.com boom was going to impact our global economy...don't think anyone could say with any real expertise that they knew exactly what was happening. Companies throwing money at you left and right all because you had a tech background and they didn't even half understand why they wanted you; the directives just came down from 'up top' and that was that. Then the whole Y2K craze hit and a freaking deluge of money just opened up as if a flood of money of biblical proportions.

Stuff like this will never happen again, unless say, a real quantum computer is actually available to private companies, not that junk from D-Wave either. I don't write all of this to rub it in, rather once the money dried up, all anyone had left was their experience. There were a lot of paper cert guys floating around back then too. They saw the money being thrown around, wanted some of it, got a cert or 2, dumb HR people hiring them and they didn't know jack shit. After the dot.com thing went bust, these people were tossed.

I survived because I live and breathe this stuff (IT, in general I mean). There are a lot of people who will IT as a career will kill your soul, and I can't disagree. If you decide to make this a career today starting fresh, your son had better damn well have an absolute love for this stuff 24/7 and want to remain committed to learning the latest tech every year, and staying up-to-speed on it the rest of life...at least until he retires. That isn't always easy to do and I'm the type of guy who does fit this special profile of crazy.

This if he has the opportunity, also don't rule out certifications such as the CISSP.

Do you happen to know of anyone today that is an HP certified printer tech? No? How about a general IBM PC certified tech? Never even heard of these certs?? Oh they existed all right, back in the late '80s and on during that timeframe. PCs were the sort of new plaything in the IT world back then because no one expected they could even touch the big iron mainframes for real heavy production usage. Today, who the hell needs a good cobol programmer? A lot of large companies that have old legacy architecture, that is one answer. But that old architecture will be gone one day; you just don't know when exactly.

My point here is that certifications can come and go, just like that HP cert I mentioned. Look at how much of a nosedive CompTIA's A+ cert has taken in the last 15 years. 15 years ago that cert alone would generally be enough to get you an entry level job somewhere doing "tech" stuff; today, it's worthless.

I'm not typing all these paragraphs for a stroll down memory lane. I am trying to illustrate my experiences in how people used to think back when I first started in this industry and how much it has changed. I could write a book about how things are done differently today. I'm mainly trying to help by saying that certs aren't always going to be the guaranteed method of getting your foot in the door. The one thing I hate about certs these days is the maintenance. IT is always evolving, thus you have to keep current on them with CPEs and whatnot. I understand it, I agree with it, but I do hate it. If you get a degree, that degree is there with you for life. Nothing will ever take it away. Experience too is always with you for life.

If your son, even if he lied and was allowed to take the CISSP exam, what will his resume look like. Fresh outta school, no experience, recently passed the CISSP? Get real...no one will put him in any position of authority.

Definitely try to get a degree. Definitely try and always go after every opportunity possible and show those people who can hire him that he has determination and really wants that job. Age old advice, but it's still applicable even today.

 

[bloodypulp]

join the military and get a security clearance.

 

[nOrVow]

OSCP/OSCE/GCE > all other certs.

I heard the CISSP is a joke as well.

 

[Electrofreak]

+1...in the IT world this is the primary indicator of how well someone will likely do in a job, assuming that the right questions are asked during an interview. I was rather lucky myself in that I got my career start before I even finished high school in the early '90s. Back then hardly anyone knew much about PCs in general so if you were able build your own PC you were already looking a stable career just doing that...can't do that today because its so common and easy to do.

I got a lot of exposure early on before I even had a job and then just leveraged that knowledge and experience into the next one. I didn't realize at the time just how much the dot.com boom was going to impact our global economy...don't think anyone could say with any real expertise that they knew exactly what was happening. Companies throwing money at you left and right all because you had a tech background and they didn't even half understand why they wanted you; the directives just came down from 'up top' and that was that. Then the whole Y2K craze hit and a freaking deluge of money just opened up as if a flood of money of biblical proportions.

Stuff like this will never happen again, unless say, a real quantum computer is actually available to private companies, not that junk from D-Wave either. I don't write all of this to rub it in, rather once the money dried up, all anyone had left was their experience. There were a lot of paper cert guys floating around back then too. They saw the money being thrown around, wanted some of it, got a cert or 2, dumb HR people hiring them and they didn't know jack shit. After the dot.com thing went bust, these people were tossed.

I survived because I live and breathe this stuff (IT, in general I mean). There are a lot of people who will IT as a career will kill your soul, and I can't disagree. If you decide to make this a career today starting fresh, your son had better damn well have an absolute love for this stuff 24/7 and want to remain committed to learning the latest tech every year, and staying up-to-speed on it the rest of life...at least until he retires. That isn't always easy to do and I'm the type of guy who does fit this special profile of crazy.



Do you happen to know of anyone today that is an HP certified printer tech? No? How about a general IBM PC certified tech? Never even heard of these certs?? Oh they existed all right, back in the late '80s and on during that timeframe. PCs were the sort of new plaything in the IT world back then because no one expected they could even touch the big iron mainframes for real heavy production usage. Today, who the hell needs a good cobol programmer? A lot of large companies that have old legacy architecture, that is one answer. But that old architecture will be gone one day; you just don't know when exactly.

My point here is that certifications can come and go, just like that HP cert I mentioned. Look at how much of a nosedive CompTIA's A+ cert has taken in the last 15 years. 15 years ago that cert alone would generally be enough to get you an entry level job somewhere doing "tech" stuff; today, it's worthless.

I'm not typing all these paragraphs for a stroll down memory lane. I am trying to illustrate my experiences in how people used to think back when I first started in this industry and how much it has changed. I could write a book about how things are done differently today. I'm mainly trying to help by saying that certs aren't always going to be the guaranteed method of getting your foot in the door. The one thing I hate about certs these days is the maintenance. IT is always evolving, thus you have to keep current on them with CPEs and whatnot. I understand it, I agree with it, but I do hate it. If you get a degree, that degree is there with you for life. Nothing will ever take it away. Experience too is always with you for life.

If your son, even if he lied and was allowed to take the CISSP exam, what will his resume look like. Fresh outta school, no experience, recently passed the CISSP? Get real...no one will put him in any position of authority.

Definitely try to get a degree. Definitely try and always go after every opportunity possible and show those people who can hire him that he has determination and really wants that job. Age old advice, but it's still applicable even today.

I'd argue that starting at a help desk job and moving upwards (or changing jobs to something better) every year or two will do more for someone these days within 4 years than a Bachelor's degree will.

Years back, I had from a call center job during which where I spent a few years with a side job doing desktop support (as my own boss) and then moved to a job where I started along with 18 others, mostly RIT grads with Bachelors degrees, at a new service desk. Within a few months, I was the Team Lead. My handful of years of experience put me well ahead of many of those college grads.

So, I'm certainly not saying that a degree isn't worth the trouble. But I've been hired for positions "requiring" a degree because I was able to demonstrate that I have the necessary experience and knowledge. If you want my opinion, a degree is great for opening doors to opportunities, but a equivalent experience can be even better.

 

[Biznatch]

Experience > Degree > Certs.

At a bare minimum, get a BS. Even with the degree, it's not going to be easy getting a job, but almost every single job I looked for listed a BS as a requirement. Sure he could do it without one, but it sure as heck isn't going to make life any easier. Plus like everyone says, the degree shows an overall higher level of education, and shows you can stick to that shit for 4+ years.

To recommend anything but a degree (or at least one of those tech trade schools) is just foolish, and will most likely hurt him in the long run.

 

[tangoseal]

A+ then Network+ then Security+ then CCNA-Security and he will be pro and making like 80-150K a year after getting about 7-10 years real experience.

I disagree with College which is a big waste of money and time unless you achieve experience first then go to school later.

 

[Dark Shade]

Experience > Certs > Degree

IMO, a BS is BS in the field of IT. Information Technology is one of those great industries that are always ahead of academia. We just hired on our intern from last year and he graduated with a BS in CS with no experience or certifications, and he's far greener than I was with a BS in History, a CCENT and a few years in the field when I started in the same position he's in.

Speaking from experience.

 

[Nicklebon]

A+ then Network+ then Security+ then CCNA-Security and he will be pro and making like 80-150K a year after getting about 7-10 years real experience.

I disagree with College which is a big waste of money and time unless you achieve experience first then go to school later.

Skip any and all things CompTIA.

Nothing against the CCNA-Security but a CCNA is good enough unless your looking at a Cisco only shop and those are becoming rare. Further, unless your son wishes to be stuck at the help desk forever a 4 year degree is the minimum education level. The head monkey at a help desk is still a monkey. To move into an engineering, design or management role he will need the degree.

 

[Electrofreak]

Skip any and all things CompTIA.

Nothing against the CCNA-Security but a CCNA is good enough unless your looking at a Cisco only shop and those are becoming rare. Further, unless your son wishes to be stuck at the help desk forever a 4 year degree is the minimum education level. The head monkey at a help desk is still a monkey. To move into an engineering, design or management role he will need the degree.

Funny, this "head monkey" at a service desk a year ago is a WAN data technician who spends all day making config changes in enterprise equipment and providing network consultations for corporate IT administrators, and who is being courted by two different departments (Managed Router and Data Security Engineering) for a promotion. And I don't even have an Associates degree or any certifications. Experience trumps all.

So, no, you're incorrect, with exception to your statement about CompTIA certs.

 

[bradlymathews]

Thank you all for your time and advice. I am not at all surprised about the disagreement between the experience vs education argument.

I myself am mostly a self-taught software engineer, having started as a 10 year old with TRS-80's in the 1970's, so I tend to lean toward the "Just Do It!" crowd.

However, I also majored in CS at a technical high school so I have deeper fundamentals than my younger brother who is entirely self-taught. He can program circles around me in JS, CSS and Java but is very week in algorithms, optimization, design and architecture and comes to me for help with those. (Last year I had to teach him what a register was.)

It seems to me that computer/network security requires a lot more "deep" concepts and understanding to be truly effective and that means education.

Plus there are those lazy HR guys who just discard all resumes that don't have a BS on it, no matter the experience.

- Brad

 

[Electrofreak]

Thank you all for your time and advice. I am not at all surprised about the disagreement between the experience vs education argument.

I myself am mostly a self-taught software engineer, having started as a 10 year old with TRS-80's in the 1970's, so I tend to lean toward the "Just Do It!" crowd.

However, I also majored in CS at a technical high school so I have deeper fundamentals than my younger brother who is entirely self-taught. He can program circles around me in JS, CSS and Java but is very week in algorithms, optimization, design and architecture and comes to me for help with those. (Last year I had to teach him what a register was.)

It seems to me that computer/network security requires a lot more "deep" concepts and understanding to be truly effective and that means education.

Plus there are those lazy HR guys who just discard all resumes that don't have a BS on it, no matter the experience.

- Brad

My experience with those grads is that they always seem to vaguely remember that "deep" concept you're trying to explain to them, but it's something they read in a book or took a test on a year or two ago. I feel like so much gets crammed in their heads that they just don't retain enough for it to be useful.

One of my team leads was a McDonalds employee who taught himself networking a couple years ago. One of our best was a Burger King manager. None of them have degrees or certifications, but they can talk networking far better than any RIT grad that walks in our doors, and that's only after a year on the job. Maybe that speaks to the thoroughness of our training, but the reality is that those grads are on about even footing with anyone else after 6 months on the job.

Don't get me wrong... one of these years I might go back and finish my degree at RIT. But it's not a priority anymore... my career is moving along very well without it. Trust me, I'm not discouraging your son from getting a degree, but rather encouraging him to pick up real-world experience as soon as possible.

These guys that talk down the help desk positions and talk up getting a degree are from a different generation. I got a help desk job to get my foot in the door, and then I set goals, did self-study, and worked to achieve those goals. I promised myself I wouldn't let myself be shoehorned into a entry-level role, to keep improving myself. Just don't let school burn your son out.

 

[Zlash]

To get a job you need experience, to get paid you need a degree unless you are very very lucky, and some places require and/or desire certs like Security+ at a minimum.

 

[eod]

Hard to discount what he may get from a 4 year university. The networking opportunities, the other topics, the internship abilities. In the end you won't be very good at any IT field if you don't have a hunger for it. The hunger is what leads to exploration and learning and reading really dry whitepapers because you are interested in just learning more.

 

[bradlymathews]

It seems to me from many of these comments, plus my own experience, that it is the affinity for your field and the hunger for knowledge and competence that are the most important characteristics. And that applies to anything.

Without these, education is like being force fed runny glop. With them it is like enjoying plates of filet mignon and fine pasteries. Same thing, different perspectives.

- Brad

 

[Dogs]

I strongly advise for going to a 4 year school and getting a traditional Bachelor's degree in whatever he's interested. On top of that, he should seek internships and student jobs in IT related areas. If he likes math, science and/or computers, majoring in math, engineering or computer science would probably be a good call, but you don't have to major in these fields. If he doesn't like math, science or computers, however, he should probably just pick a different career path. College is irreplaceable on my list of life experiences, and people who didn't go to college just wouldn't understand that.

A lot of people will tell you that college isn't worth the money. I disagree completely. If you'd like to understand what having a degree is like, think back to how smart you were before you started high school and compare that to how smart you were after you started high school, because it amounts to about the same thing. It doesn't matter what you go to school for. He could major in French, for what it's worth, and he'd still be better off than if he hadn't gone to school. There's piles and piles of little things that you gain from going to school (like friendships) that you often don't even consider.

Then there's just the fact that you should do things now while you still can. Plenty of people will tell you that college held some of the best times of their life. You have a lifetime to work full time, but you're only young, impressionable and in a position to be irresponsible with minimal consequences once. And I'm not saying he should go party his brains out and flunk out of school, because you can have a great time in college while still being productive and doing what you're there to do, which is learning. I also feel that college is most valuable while you're still young, your synapses are still firing and you're still impressionable. Better now than later.

Plus, all of these things people are telling you he should do instead of school (like getting certs) are things he could be doing while also going to school.

Beyond that, there's an awful lot you'll learn in a technical degree at a 4 year school that's just darn valuable. Security is a field in which strong understanding of computer architecture, algorithms, math and even programming are useful background to have.

Going to school also doesn't prevent you from getting experience. Most schools have some kind of help desk or other computer related student job he could pursue, and it's much easier to get hired at a college help desk when you're a student than it is to get hired at a real world IT job when you have no experience and no educational background. Internships are also extremely good ways to spend your summer, if you're a college student, as they generally train you in and put you in the role of someone doing something much higher up than if you just went out and got an entry level position in the field. At universities with strong research, most research groups within the university hire students to do various things, from programming to research. Having industry-related research experience on a resume is a pretty huge advantage. Finally, you're surrounded by people with insanely deep understanding of all kinds of subjects, called professors. Professors have a lot to give back to students, and if you make it easy for them they will teach you all sorts of incredible things. People who don't attend colleges don't get these opportunities.

Furthermore there's just the overwhelming amount of industry involvement at Universities. A a lot of companies recruit all of their technical new-hires from universities. Universities have tons of career networking opportunities and events that you simply cannot get easily elsewhere. Big names like IEEE make weekly visits to some bigger Universities and hold seminars. Just about every big name in the computing industry holds meet and greets, info sessions, interactive events, learning opportunities, tech demos, etc, on campuses frequently and apart from what you learn at these events, the people who are usually running these programs are usually also the people in charge of recruiting new hires. Clubs are often sponsored by tech companies, and a lot of engineering degrees have capstone programs that are developed by the tech companies that are doing the hiring. Finally, the career fairs at a lot of these larger universities are astoundingly large, and that's where a lot of companies get their new employees. And if nothing else, plenty of companies won't even look at you if you don't have a 4 year degree; Like it or not, that's how it is, and while it's possible to stand out and get around that, it's very, very difficult to do so.

On a side note, what happens if he spends all of this time pursuing all of these specific certifications only to find out that he doesn't actually like doing computer security at all? With a college education, changing tracks is fairly painless. Doing the equivalent with only a very specific background probably wouldn't be so painless. Say he decides scientific computing, or quantitative finance, or technical writing is his new found love? With a college education, these are easy fields to switch to. With security certs, not so much.

Without these, education is like being force fed runny glop. With them it is like enjoying plates of filet mignon and fine pasteries. Same thing, different perspectives.

I would say that this is pretty accurate, yes.

 

[RESTfulADI]

Hard to argue against a 4 year degree but I would be very cautious of these 'cyber security' degrees that every college and their mom is pimping right now. Nothing can replace real world experience and a solid foundation in networking and operating systems, that only comes with work and time.

A degree in networking, comp-sci, MIS, systems, or similar combined with internships and/or a real job should get him on the right path. From there he can specialize in security and follow a certification path.

 

[Ranma_Sao]

I would tell him to get a degree in Computer Science, or IT program if he wants, and then see if he actually likes security work. Every school I've seen has some classes in security, but alot of it depends on liking it. The other recommendation I always make, which he just missed, is go to DefCon, it's cheap, and they'll see a ton of really good security presentations, to see what field of security they like.

I'm a reverse engineer, and work on incident response, everything I do was self taught. There are now a few schools teaching reverse engineering and security, but it's still a new field. I also second the military approach as well, a lot of my security colleagues, all learned from the Air Force.

 

[stunning]

I suggest the College/University route, while in school get a student assistant job so he gets field experience and then work towards his certifications. You will gain most of your knowledge in the workforce with GREAT mentors. I came from working with servers, got my MCSE, MCITP (1 test away) and I landed a job as Network Engineer/Admin. I never worked on a Cisco Switch before, however I had general knowledge of networking and worked with HP networks prior (very little). But the fact that I was studying towards my CCNA and already had my CompTIA network +, the guy liked me and hired me. Shortly after I started (2 months) he announced he was retiring and the Network is now mine (along with the other guy they hired).

With no mentors, I am forced to learn this environment work on stuff that I have no idea what is out there...

Going to a 4 year school with help you with your fundamentals in life; problem solving, deductive reasoning, reading, writing,etc etc. They skill sets are universal in all careers where as certifications they are not.

 

[wixter]

I'd argue that starting at a help desk job and moving upwards (or changing jobs to something better) every year or two will do more for someone these days within 4 years than a Bachelor's degree will.

Years back, I had from a call center job during which where I spent a few years with a side job doing desktop support (as my own boss) and then moved to a job where I started along with 18 others, mostly RIT grads with Bachelors degrees, at a new service desk. Within a few months, I was the Team Lead. My handful of years of experience put me well ahead of many of those college grads.

So, I'm certainly not saying that a degree isn't worth the trouble. But I've been hired for positions "requiring" a degree because I was able to demonstrate that I have the necessary experience and knowledge. If you want my opinion, a degree is great for opening doors to opportunities, but a equivalent experience can be even better.

Actually I completely agree with you. I myself dropped out of college my first go-round because it turned out to not be what I was really interested in, which is the general IT field we all know today. Colleges back then, the closest types of majors they had were computer science, electrical engineering, or some were more forward looking and had computer engineering...which all that was was EE with about 4 different,extra types of classes.

Then all of a sudden one year colleges EVERYWHERE advertised their new IT degrees, focusing on admin stuff, PC stuff, networking stuff, things like that. I'm reading the materials for one listing their faculty with all these years of experience and thinking "where the hell did they come up with this? This program didn't even exist last year!"

Yeah colleges generally can't keep up with the latest technology that matters to most businesses, this is true. However I do still place value in obtaining the degree. I lucked out because I managed to land a job without a degree and my employer paid my tuition.

For me, having a degree is nothing more than simply checking off a requirement box on an application for future jobs that you never have to worry about again. I am realistic - I do realize that in this field that college degree is nearly useless as soon as the majority of the classes are over with.

 

[tangoseal]

Skip any and all things CompTIA.

Nothing against the CCNA-Security but a CCNA is good enough unless your looking at a Cisco only shop and those are becoming rare. Further, unless your son wishes to be stuck at the help desk forever a 4 year degree is the minimum education level. The head monkey at a help desk is still a monkey. To move into an engineering, design or management role he will need the degree.

Nah.... just needs experience and CCNP/IE and he can tell the hiring official what his salary will be.

His best path would be go in the Military in IT and gain military experience and the govt will send him to zillions of classes and schools and he will run circles around all these college heads filled with political mush and no experience.

 

[RESTfulADI]

Nah.... just needs experience and CCNP/IE and he can tell the hiring official what his salary will be.

His best path would be go in the Military in IT and gain military experience and the govt will send him to zillions of classes and schools and he will run circles around all these college heads filled with political mush and no experience.

Can't argue with this either, I'm an MSP/consultant at big corp and they just brought in a CCNP with not much exp. and he is making at least 50-60/hr.

 

[Annihilator_4]

I don't quite understand why a couple of you are railing on a 4 year degree. Is it possible to break into the IT field with a high school degree and make good money? Of course, and in some cases he could end up being more proficient in IT than college grads. But what if he amasses all these certs and a year into his helpdesk position he realizes he hates everything about IT? He's back to being a high school graduate with worthless certs and experience that is hard to relate to other jobs. I got a degree is MIS which at my school required us to go through several business courses (finance, accounting, project management, economics, manegement) which I believe will be invaluable not only for my career but my life.

Also, I recently got my second job out of college (hurrah!!) and I kid you not 60-70% of the jobs I applied for at any notable company *required* any kind of bachelors degree. Some of my interviews lasted 30-40 minutes just going over some of my course work and what MIS is all about since it's such a new major. I plan on not wasting much time (currently collecting a couple certs) before I go back and get my masters before i'm 26. Do I think a masters is required for our field to break into the 6 figure salaries? No, but personally I want to feel like I have taken my education as far as I possibly can rather than stick to the bare minimum.

 

[Protoform-X]

These jobs that "require" a degree typically mean "or equivalent experience." I've gotten plenty of jobs that require a degree, and I certainly don't have one... Not saying anything against them, they're just not a necessity in the IT field anymore.

 

[stunning]

I hear if you have military background you get preferences for state agencies.

 

[haunter]

a 4 year uni ed will prevent a TON of chances for part time helpdesk style jobs.

thats how I started, and my degree is in psychology and Im a gainfully employed admin at local gov agency suckling at the teet that is your tax dollars

more over college was a freaking fantastic experience, and I did ALOT of growing up there

Nah.... just needs experience and CCNP/IE and he can tell the hiring official what his salary will be.

His best path would be go in the Military in IT and gain military experience and the govt will send him to zillions of classes and schools and he will run circles around all these college heads filled with political mush and no experience.

LOL yeah havent been to college lately eh? 1 of 4 years is gen ed bs, another year is moderately pointless loosely related garbage, and 2 years is generally applicalbe learning

atleast where I am from.




anyways

where you will need a degree, and generally a masters, if you ever decide you tired of the grind and want to go management side at any decent sized or government place

 

[Madnes5]

Thank you all for your time and advice. I am not at all surprised about the disagreement between the experience vs education argument.

I myself am mostly a self-taught software engineer, having started as a 10 year old with TRS-80's in the 1970's, so I tend to lean toward the "Just Do It!" crowd.

However, I also majored in CS at a technical high school so I have deeper fundamentals than my younger brother who is entirely self-taught. He can program circles around me in JS, CSS and Java but is very week in algorithms, optimization, design and architecture and comes to me for help with those. (Last year I had to teach him what a register was.)

It seems to me that computer/network security requires a lot more "deep" concepts and understanding to be truly effective and that means education.

Plus there are those lazy HR guys who just discard all resumes that don't have a BS on it, no matter the experience.

- Brad

Your responses lead me to believe that you've already got a pretty good understanding of the industry and consequently the best path for you son.

Experience is king. I won't dispute that. But much like you mention, understanding the deep concepts is incredibly important in almost all areas of security. I'm self taught myself (with some minimal schooling) and feel that I have a much better understanding of computers than the average IT person. But there is also a LOT of stuff that I DON'T know that I probably would have learned in school. I can code in several different languages. I know enough to be able to accomplish what I need to. But I'd never consider myself a programmer. I could easily write a program that sorts a ton of records. But I can't off the top of my head tell you which sort algorithm is best and why I chose it. So while I strongly feel that your son should be diving in and getting a actual job at any place he can to get _some_ experience, also attending a school will likely give him some fundamentals that he'd find difficult to learn on his own. Additionally, it will likely lead to a degree that some managers still feel is a requirement. Plus he'll get that college experience that will give him other benefits he wouldn't receive had he skipped school.

College technical programs in my experience are very poor. Especially those centered around networking, administration, or security. I've met only a very select few people who have graduated from those programs that I would consider talented and they would have succeeded with or without those programs. While I'm sure there are some good security programs at various colleges, I think the vast majority are teaching basic stuff to a large population of people that will never be very successful in the industry. I'd personally focus on a CompSci degree to start and let your son's interests dictate if he decides to continue on that path.

I think that giving your son as many tools as possible will give him the best chance to succeed. Attending college until he decides that is or is not the path for him. Help him find an internship if you can. Anything to get him some experience in the industry so he understands the dynamics of a work environment can start building his resume. Have him play around with various security tools, Backtrack, Metasploit, etc. Have him try to break web applications using something like the broken web application project. Have him start analyzing malware in a lab. Those are the types of things that will help him figure out what he's good at and what he enjoys doing.

Some possibly helpful links:
NSA student programs
NSA Coop work program
Krebs on Security blog entries interviewing various well known info security people on how to get started in security

 

[jad0083]

I know this is unrelated to security, but since I also work in the IT field, let me share my .02 cents. I have a B.S. in I.T., not even specializing in any database work, but I can tell you that his has been invaluable in me landing my career in IT.
You see, dba, for example, is not an entry level career (probably similar to a security admin), usually people start out as sys/network admins or software engineers then they move on as being a dba. Now, I have worked and still work as a DBA for 3 different enterprise shops now (2 big banks and a healthcare company), and in all of those shops, I was the youngest employee.
I remember asking my boss as to why he hired someone young as me, as most of the people I work with are around 30+-50+ years old (mid-level shop), he told me that it was I had a B.S. and that tells him that it takes commitment to finish a 4-year degree; the well-rounded skills and adaptability you acquire pursuing higher education are always sought after in the industry.
Now, I'm not saying experience < degree, as some of the excellent DBAs I work with only have a GED and not even certified, all I'm saying is that education will only help you get better(and how in the hell would it be a disadvantage having one?!?). In my case, I was able to achieve my goal much earlier than expected.

 

[stunning]

Overall people are saying Knowledge is key, the more you have it cannot hurt.

 

[Electrofreak]

Can't argue with this either, I'm an MSP/consultant at big corp and they just brought in a CCNP with not much exp. and he is making at least 50-60/hr.

I just spent the last several days fixing the mess a CCNP made of his MPLS across several sites because he thought he could fiddle around with his QoS. He went and made a bunch of changes, started tagging traffic at all different dscp values at his branches and then put the icing on the cake by removing a max-reserved-bandwidth statement at his colo which ended up disabling the QoS policy entirely outbound from his main site. Result was no outbound QoS occurring from his colo, and voice signaling packet drops (= failed calls) on traffic inbound to his branches because he was flooding the gold and silver queues with traffic (kinda happens when you start tagging almost everything) and it was causing output drops and delays.

It really saddens me, because I don't even have a CCENT and my goal is to get a CCNP... but then there's guys like that who get certs on stuff they have no experience on and give the cert a bad name.

 

[bradyrich]

I think 1 year course of computer security very helpful for the career for your son.Cisco Provide many of course like CCNA Security,CCSP , CCSE. These all course are related with Network Security.After completed these courses you will be able get better opportunity in Security field.