What is said: certifications like CISSP don’t represent the full spectrum of skills a professional needs therefore certifications are a waste of time.
Reality: certifications represent a foundational body of knowledge for new entrants to the field - to start the "scaffolding" of their knowledge. It helps employers test a candidate’s commitment to the career and so is useful as long they don’t mandate it above all else.
However, what does the ISC2 marketing material say? Let's take a peek!
Earning the CISSP proves you have what it takes to effectively design, implement and manage a best-in-class cybersecurity program. With a CISSP, you validate your expertise and become an (ISC)² member, unlocking a broad array of exclusive resources, educational tools, and peer-to-peer networking opportunities.
Prove your skills, advance your career, help earn the salary you want and gain the support of a community of cybersecurity leaders here to support you throughout your career
From https://www.isc2.org/Certifications/CISSP
So, basically, a nontechnical certification that is shallow and broad has managed to insinuate itself as the way towards being able to run a security program, and more valuable than any technical security degree, or a CS degree, or a PHD in Cryptography. It claims to be both for security pros with many years experience, but others say it is foundational material. This has then led to a negative cycle of incompotence, bringing in nontechnical types into a field that is uniquely demanding for broad technical skills normally gained through years in the trenches (SRE/development/administration/network engineering)
Is there any wonder why we have a security problem?