If you work in information security, then you've probably heard of both the CISA and CISM certifications. But which one is right for you?