For the Lulz: Getting certified as a dolphin trainer (and why decent certification and qualifications matter)

Mercury ISS
3 min readOct 31, 2021

Edward Farrell

Our “for the lulz” series focuses on entertaining anecdotes with hopefully a serious lesson at the end.

I’ve been entertaining the occasional LinkedIn message from multiple individuals if I wanted to get certified. My response has gone through a number of iterations but thanks to the inspiration of a colleague I have been asking about a nonexistent certification, the AWS certified dolphin trainer, for which I recently got a hit (the meme is available here) https://websitev3.s3.ap-southeast-2.amazonaws.com/AWS-Dolphin-Trainer.html

The trainer not only guaranteed me they had the certification, but that I would pass it on the first go and that I would not have to necessarily sit the exam. The implication of course was that the individuals would sit the certification on my behalf… even though it doesn’t exist and anyone reading between the lines would have picked up that this certification made absolutely no sense…

Certifications and the process of getting certified is a significant event. As I say to my students in most courses “it’s absolutely awesome you’re taking time out to grow and develop yourself, and I am here to enable that” but purely getting certified for the sake of it, or as a shortcut to money and power is downright dangerous.

Why do we get certified?

This article is not about discouraging the certification process. I think it’s important that we have a measured standard of skills and ability. The technology industry is at the same level the medical profession was at some 130–150 years ago; at the turn of the century, it was possible to become a doctor with little or no training, or worse yet an unverified training process that caused more harm than good. The “quack” medical industry has some fairly viceral cases of a failure of prepared professionals and organisations whose consequences can be so final… however there’s not too many cases in our space that have been lethal yet.

By that same light, we are also finding our profession and a lack of preparedness given its relatively new and theories around security are still maturing.

How do we deal with the “dolphin trainer” certifications?

Continuing the theme of medical professions, at the start of the 20th century, a number of innovative activities for the time came into play, including regulation of food as well as the medical profession demanding specific levels of certification as doctors which saw a decrease in headcount of medical professionals but an increase in the quality of care. These were largely informed by rigorous assessment processes and developed bodies of knowlege.

We also need to discourage the “alphabet soup” of qualification and certification alongside the “throw bodies at the problem” mentality. For experts talking about “skills shortage” I would contest that we have in our industry not a skills shortage, but an opportunity to create a path of progression in certification to create an even more meaningful workforce and business approach that does not demand overwhelming our workforce. We would be better off with fewer professionals that we’ve taken time and effort to develop. Like the medical practitioners of old and today, we owe it to the world to ensure longevity and a quality of life.

--

--

Mercury ISS

Mercury Information Security Services are a leading provider of information security services, advice and consulting.