There's truth in this^^. I've been in IT for about 21 years. I started without a college degree building custom systems and doing both field and phone support (I had some background as I was a nerdy kid). As I gained experience and knowledge from reading books (I used to live at the Computer Literacy Bookshop in San Jose) I've had opportunities to build and manage networks, websites, client/server data driven applications, virtualized data centers and complete VDI solutions. Over time I became an expert in Windows technologies (AD, DHCP, DNS, SCCM, PKI, SQL, Powershell, Azure etc).
It wasn't until I started getting into the upper ranks that I decided I had to go back to school and finish my college degree as this was holding me back. A few years later I finished a BS in IT Security and Master's in Cybersecurity and Information Assurance. fast forward to now and I have about 1.5 years until I retire at 50. So the IT industry has been good to me. I plan on doing consulting work after I retire.
If your son is interested in Cybersecurity, Western Governors has a good Cybersecurity Program. It was recommended to me by a colleague and I was happy with it. Best of all it is very affordable.
While you don't need an Ivy league degree in this field, I think he would move up faster and have more opportunities presented to him with the degree. So he probably shouldn't wait as long as I did to get that out of the way.
One more piece of advice for him regarding the direction the industry is moving - generally speaking, a lot of the middle-tier jobs like sys admins are getting automated out of the picture. Over time you will have the architects and engineers designing, building and automating and then technicians to do the manual grunt work.
Also, as he progresses in the field he should try to get into an organization where IT is revenue generating instead of being looked at as an expense. The former usually has all the funding whereas the latter gets whatever money is left over.