ENISA, the European Network and Information Security Agency just issued a paper on security certification: Information Security Certifications - A Primer: Products, people, processes. This whitepaper is trying to be all-encompassing. Putting the certification of the three aspects mentioned into one bag makes for a very broad scope of subject matters that have traditionally been handled separately. Even though I have to agree that if we want to ultimately certify security instead of just its aspects, the three belong together, the different fields are at a very different level of maturity (with probably products being the least widely practiced - or is it just the most expensive to perform). If we focus on the aspect of people certifications, then the ENISA report stays remarkably generic. It is maybe understandable (even though regrettable) that they don't even list the certifications currently available in the market, however they nonetheless arrive at the conclusion that Europe must do more in the area of people certification. One might take all of this with a grain of salt. ENISA's mandate is running out in 2009 and we have seen some discussion on repositioning the agency. The certifications market is certainly getting more crowded, so whether initiatives from the public sector would be warranted is a matter open for debate.
To read this article in full or to leave a comment, please click here