First of all, GIAC is the certification arm of SANS. By itself, it is not a certification. GIAC would best be compared to (ISC)2, the organization that maintains the CISSP. So it's not possible to do a true comparison of an organization (GIAC) to a cert (CISSP). When I am asked questions in writing, it can be difficult to figure out exactly what knowledge the reader is truly looking to gain without the give and take of a conversation. Therefore, in an attempt to decipher a question that many of you have asked, I'll throw out some interesting tidbits (but trust me, I'll eventually get to an answer).
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
In order to attain one of the many GIAC certifications, you have to attend a SANS event. This can be costly -- not only for the event itself but also for the travel, since they don't have an event in every major city. Although they have international events, not every event offers every class. If you can make it to one of their events, their training is top notch, and (to use a baseball analogy) their instructors go through a "farm system"-like process to get to the show. So you are almost guaranteed a major league course if you attend one of their larger events. I have a lot of respect for Northcutt, Paller, Sachs, Skoudis and the gang at SANS. But as well respected as the training may be, their certs, unfortunately, are nowhere near as well known outside of IT circles (i.e. HR Directors and consulting clients) as the CISSP.
The CISSP credential is offered by a number of training companies, some officially recognized by (ISC)2 and many not. So you have to be really careful about not only what company you use for your training, but you also have to concern yourself with who is doing the actual classroom instruction. So go with a known name like The Training Camp. If you're not careful, it can be a big roll of the dice, but if you attain what many consider the gold standard of security credentials, you will have a more recognizable credential even by those outside of the IT community.
Then there's the consideration that you may not have it in your budget to attend classroom training. Although I find boot camp-style courses to be beneficial, I also understand the commitments of time and money they require. This leaves us with the self-study method. If you decide this method is the one for you, there are plenty of CISSP materials out there, but very few for GIAC certs.
Now, let's look at the question itself. Which certification is more beneficial for a security consultant? When I see "beneficial for a consultant," I think money. So taking all of those tidbits into account -- wider availability, a more accessible self-study option and a highly recognizable certification -- I'd have to give the edge to CISSP.
Dig Deeper on Information Security Training and Certification
Related Q&A from Donald C. Donzal
Learn what certifications channel partners value with this expert advice from Don Donzal, and make sure you gain recognition and meet with success. Continue Reading
Can a former black hat ever really reform? Don Donzal tackles tough ethical questions in this expert response, suggesting community service and ... Continue Reading
A+ must be combined with Network+ or Server+ in order to count as an MCSA elective. This expert advice will help you create an exam plan that will be... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.