Devaluing the CISSP

Is the CISSP going the way of the Dodo?  Or at least going down the same path of devaluation that has haunted the MCSE for some time?  I don't think so, but Sean Walberg seems to think so.  The ISC2 is working on a program that will allow colleges to teach the 10 domains that are covered by the CISSP exam.  The students will be allowed to take the CISSP exam and if they pass they will become Associate CISSP's with 5 years to accumulate the experience necessary to be full-fledged CISSP's.  I think Sean is 100% wrong on this subject and that these courses will actually strengthen the CISSP certification.

The MCSE became a target of derision shortly after it was first created because the questions on the tests became public knowledge.  Anyone who had a good memory for unconnected facts could visit a brain dump site and pass the tests with relative ease.  A number of one-day 'cram-and-pass' classes allowed people to learn all the answers and take the tests on the same day.  The MCSE became known as "Must Call Someone Else" or "Minesweeper Certified Solitaire Expert".  Many people were able to pass the test by rote, not because they actually understood the technologies or theories behind the questions that were asked on the test.  Microsoft is still fighting the damage done to their certification to this day.

I've held the CISSP for over three years now, but shortly before I became a CISSP, I took (and passed) the CCNA exam.   The local junior college offered two semesters worth of official CCNA preparatory classes, which I took full advantage of.  I'd been a systems administrator for several years already at that point, but I knew there were holes in my knowledge that books couldn't adequately fill.  The CCNA courses filled many of those holes, and rather than making me a weaker CCNA, I believe the hands-on experience made much stronger than I could have been on my own.

Will some of the Associate CISSP's try to pass themselves off as full-fledged CISSP's?  Probably, but those are the same people who would try to pass themselves off without ever having taken the test.  Which means that this is not really much of a concern for the Associate program, or at least no more of a concern than already exists concerning false CISSP's.  I think that the value of a long term commitment to education far outweighs the concerns over possible fraud on the part of the students.

I'm not worried about this program devaluing the CISSP.  I think it will actually strengthen it by providng the students a firm grounding in the realm of security before they go out to work in the Real World.   Even if they never gain the experience required to become full-fledged CISSP's, we'll have a crop of students who at least have the knowledge to understand security concerns.  Which is lot more security knowledge than most colleges are teaching right now.