Security certifications are expected in the workplace, but they are no guarantee of competence, reports Stephen Lawton.