IT professionals question validity of security certification