Ethical Hacker Community Forums

Hello all. I'm a 19 year old college student. I will graduate next year with two Associates Degree's, one in Nework Administration, the other in Information Systems Security. I go to well known technical college here in Kentucky. Prometric, and Vue are located at my Tech school. From my time there until graduation, I will recieve my A+, Net+, CNA, MCP, MSCE, MSCA, CCNA, SCNP, SCNA. After that I'm going to get my Bachelor's degree in Computer Science. I know I want to focus my career on Security. So what other certifications are out there for Security? That are well known? Becuase I want to self study for these other certification before I graduate so I can have a edge when it comes to getting a job. Thanks for reading. By the way, this site is awesome.

After doing a little bit of research. I guess the first "Security" Certification I will start with is Security +. Is this a good stepping stone in Network Security?

quick list after Security +:
-CISSP
-CISM
-CISA
-CEH
-OSCP
-GCIH

Please note that you'll do better starting off with the more technical certs (CEH, OSCP) because the more administrative ones (CISSP, CISM, CISA) require years of employment in the field. 

security + is a good move. you should check out this link for whatever ebooks you need.
http://www.network-ebooks.com (http://www.network-ebooks.com)

I highly doubt that website legal, considering those are all copyrighted works that most people have to pay for.

I'm all for free stuff, but I wouldn't want anyone to get in trouble for copyright infringement.

I would say concentrate on your University Bacholres studies, and choose your subjects wisely. that is either choose a subject to strengthen a techical weakness, or to explore in depth more an area you enjoy and you have a slight exposure to it. one problem is that some of the universities and some of the textbook do not catch up with the latest trends, techniques,  and technologies. this can be influenced by you in the course assigmnets, and subject research during studies. if you insist and you still want to do certifications, as advised before a general security certification such as secuirty+, or similar should be useful. if you have the cash which i doubt, or your training is sponosered you can opt for the SANS masters program where you do a number of security certifications and technical reports to gain an accredidted master degree in information security http://www.sans.edu (http://www.sans.edu), it is still possible doing it as a volunteer, check SANS sites for how, however unlike other certifications you will not be finishing it in less than a year time  :)

Thanks for the insight. One cool thing about my Technical School, they allow you to come back and sit in a class for FREE! So I can keep updated with the latest technology. Well being that I wont have any kind of loans whenever I graduate because of Financial Aid/UPS/Savings, I might do the Sans Master Degree Program. It would probably pay off, and look really good on a resume. I've just started studying for the Security +. I will let you guys know when I pass. Thanks.

Sweet! Wish my University had that arrangement, from someone trying to pay for extra training after graduating take full advantage.

Welcome to EH-Net.

Wicked!  ;D  ???are you sure you're 19 to have all those stuff?.
anyway a good site for self-study is http://www.network-ebooks.com (http://www.network-ebooks.com)

iSmith, you on commission for these guys or something?

As many have said previously the downloads from these sites aren't legit, as this is ethical-hacker.net and many of us spend large amounts of hard earned currency buying legitimate copies of these resources any chance you could stop giving them free publicity?

If you need free/copy-left resources for training and study, I'd recommend google.com (http://google.com) as the only site you need.

make sure you take some programming classes, you'll need those later.

Since you already have access to Cisco equipment for the CCNA, you may want to work on your CCSP.  Make sure when you hit college for your Computer Science degree, that you pay attention in assembly class, I wish that I had paid more attention there.  If any scripting languages are taught, that will be helpful for you to pick up either there or on your own.  As far as certs go, I wouldn't go and get a lot of certs before you get experience in the workplace.  They may get you in the door some places, but if you load up on certs now, they will be a pain to maintain later.  It sounds like you already have some strong certs, with CISSP being a good one to come later, but you can use the certs in the future to potentially leverage more pay in jobs once you start.  If you are interested in SANS classes, the 504 class isn't a bad start, I really enjoyed it.

Good News. I work for UPS partime while going to school($9). I know somebody that's in charge of the IT department at UPS. I got hired making $14 an hour. WOW! I mean UPS only has one of the biggest networks in the world. So I can get more experience while going to school. I'm so happy!

cleanwithit0607,

sounds like you're getting all the breaks! 8)

Make the most of the opportunity and good luck in your new role.

Thanks RoleReversal,

I'm making the most of it, I love it. I'm so glad I'm not pushing packages anymore :)

Update: I just recieved the Sybex Security+ book. I'm in the process of studying now.

I will keep updating, this may turn into a blog. lol

**Update** I passed my Security +. Now, I don't have any experience in the security field for the CEH. Can I bypass the two year requirement or should I just opt for the OSCP?

Congrats on the pass!  Yes, go for the OSCP until you get the required experience for the C|EH exam.  Good luck!

Thanks Dengar13,

It makes sense to go ahead for the OSCP because I've been messing around with Backtrack 3 -(I recommend this distro to anybody, it's awesome), and I have learned how to crack WEP, WPA(2), and router passwords. There are plenty of tutorials on how to do this.

Side note: If you're interested, to save the trouble, install Backtrack to a USB thumbdrive, or a USB Harddrive. Windows and linux/Slackware, were just not meant to be on the same drive.

Oh yea, remember use your own network or ask for permission first.

http://irongeek.com/i.php?page=computerlaws/state-hacking-laws

Congrats!  ;D and thanks for the update.

Thanks. No problem sir, and there will be more in the future as I progress with my studies. So OSCP it is! Does anybody have any good feedback about this course?

Not yet, but I actually made the decision yesterday to enrol on this course (finances pending ;))
Might end up on the same course. When I have more information I'll let you know.

I'm planning on taking it soon as well.  Just waiting for my confirmation of my CISSP professional experience and endorsement so I can use the course for my CPE credits, too.

There is tons of feedback on this one. In fact there a board dedicated to it with tons of feed back

http://www.ethicalhacker.net/forum/index.php?board=58.0

VJ

I know this doesn't have anything to do with security, but I passed my A+ Essentials today with a 740, and I take the IT technician exam thursday-(wish me luck), then after that I take Network +. I took both Net + and A+ in highschool, and me being stupid never took the certifications, networking is my strong suit, so I might try to test out before the quarter starts. I'm still trying to roll some quarters for the OSCP.

P.S, don't ever study for two certifications at one time.

Good luck :D

Hey cleanwithit0607,

You're right. It is not security related per se, but it is good stuff to share. Sounds like a good new thread, too.

Don

Heh, my thumbdrive with BackTrack3 and tools... actually is with me almost as often as my wallet and keys and cell phone.  Actually.. it may be with me more often, since i carry it around at work when I have those in my desk.  :P  Thumbdrives are just so fun.

Same here, I love my flash drive.

A bit off topic, has anyone read the book, "Counter Hack Reloaded"? If so do you recommend it? Any other book recommendations would be nice too.

Thanks Don. I will keep updating :)

Counter Hack Reloaded is an excellent resource. It was used as the text book for my first network security class. I took it with me to my first cyber defense competition and referenced it regularly.

Thank ohtechwiz, I will order it on Amazon tonight when I get home. I appreciate your response. :)

I already have too many books on my shelf.. that I'm about 1/3rd of the way through. :P  I'll look into it when I'm done with those, good to know of another good resource though.

Yea, I hope to get to that point. I just need a good supplement to my studies, while I'm at work I get quite bored.
lolz.

But yea, I read the description of Counter Hack Reloaded, and it seemed really good.

Here is a better piece of advice than going and obtaining n^n-1 amount of certifications. GET EXPERIENCE!

That's right get a job, Ask most people in a management position what they are looking for and it's experience. Your degree will carry you, and SECURITY+ is kind of IMHO a useless certification. 100 question, 13 minutes to take the exam and it tests your ability to memorize a security dictionary.

Experience will carry you much further than the certifications. However, if you want to play in the DOD arena you will need certain certifications. but the best advice is to get in and get experience under your belt.

:P Part of the reason I have a library of 1/3rd of the way read books.. is that I'm working full time as a network/security guy.  Thank God they pay for most the books I get, since it's 'work related' haha. ;)  Also going to school fulltime to get more school based experience.. besides my on the job experience.  You're right experience is #1, but having certs = more $. 

That's what I'm trying to do. But here's the thing, at UPS they want you to have certain certifications to atleast be given the oppurtunity to get experience. I wish I could leave UPS and get a security job, but they pay my tuition, and they pay me to go to school(bonus $$). You have a good point that I should get experience, but some places just want paper certs to show you're motivated,and can learn.

Hey g00d_4sh, How did you get your start in security? Did you have Certifications before you got the job?

And those "useless" certs like Sec+ help get you in the door...

To get the experience you need (in a lot of cases) to have certs to get an interview.  

I was actually running my own landscaping business... and one of my biggest customers pulled me aside one day.. and said "Can you see yourself doing this in 10 years?"  I was like... "Nope".  And he outlined going back to school, getting some certs and working with computers.  He suggested that since I'd always been into computers, and had talked with him about his own set up and company a number of times.  He started and just sold a nation wide company that deals with Library software.  Including cutting edge OCR and whatnot.  Pretty nifty stuff, but it was our talks that got him to tell me to get a job doing it. 

I started back into school, and a DOI sub-branch was looking for a cheap student intern.  Cheap being the relative word I think.  I didn't have any certs to start with, but I had already taken a number of classes, and just had a good base to start with.  Did well at the interview, was hired on, and quickly turned full time.  And it's been rather easy to quickly move into more responsibility (and money) by demonstrating ability.  IE, everyone in the gov is retiring... and if you know a bit you're scheduled to move up quick.  40% of the federal workforce is getting close to retirement age within the next 1 to 5 years.  That.. and some of the current people who are my counterparts are rather dense, having just come up in the mentality of "I don't need to learn anything, just keep doing what I'm doing and get a check."  Since I'm actively seeking out answers to problems instead of passing the buck or sweeping it under the carpet.. and since I am not yet embittered toward the job I'm looking rather good at reviews. ;)  It has turned out to be a great opportunity though.  So, to 'quickly' answer your questions.. no I didn't have certs to get the job, it was bottom rung that quickly advanced.  I got into the security aspect because in our regional office I'm the only one interested in security, and hense keeping up to date on it.

I had no certs no experience, before the dot com bubble burst (I really hate that name) I saw an overwhelming amount of bootcamps starting to form and people were primarily after money. Somehow at 15 I saw this trend coming. When I was 17 I had my parents sign a waver and I joined the military. The military didn't ask for experience, degrees or anything. It's not for everyone but I have no regrets.

After 3 years and 4 months of service I left the AF, with 80% of a degree in CS, and about 3 years of experience working tier 3 administration. I was able to leverage that experience into a penetration testing job. Now, 7 years after I originally signed up I've got a degree that I didnt pay a dime for (monetarily wise) tons of experience, and im working through a masters degree that I've only paid about 1k for thus far. IT's an option I recommend. Navy /  AF is the way to go for tech jobs, Army is wierd with Tech which they call Communications. With the Army you are a soldier first...

What, no Marine Corps love?   ;)

Thanks for your service...thank goodness for the gold old GI Bill.

Seconded, and thank you Dengar for your yours, and Chris and all the others out there...BUT, phn1x, you got your experience by volunteering to donate yourself for 4 years to the AF.  Not everyone can, or more likely, is willing to do such.

Like g00d_4sh, I started at the bottom rung...even lower really, working as an intern at the National Aquarium in Baltimore...an UNPAID intern at 27 years of age.  That was a little rough.  But within 3 years, after having been picked up as a full-time employee, and making a few job changes, I'm doing pretty well (more than I've ever made on paper, though I was a bartender for 10 years and doing better then), am about 2 months shy of the experience requirement for my full CISSP certification and am THE security admin for a major healthcare organization in my area.

The certs help you get through the door, but working for free does an even better job of it.   ;D  Once you've got a cert or three that an HR idiot professional is looking for, the experience and your proven ability to learn and adapt are what move you along.

Good luck.  Stick around here and learn from these guys like so many of us have, and you'll go far.  Just don't expect to be making $60K over night because the (unnamed) training company on the radio commercials tells you that you will be.  Fact is, if you do your job, and well, you'll get there soon enough.

A good alternative to full time military duty if you can't or don't want to sign up for that is the National Guard.  I was in the AF National Guard for 6 years and it is a great way to get experience with IT or anything for that matter.  Not to mention the college benefits are nearly as good as full time active duty military.  Well that is my recruitment speech for the day.   :P

Yeah, starting at the top isn't generally an option for anyone.  I'm rather pleased with my current position though, and though I'm not making as much as I did running my own business, the side benefits of working for the Feds makes up for it.  I pondered military service for a bit, but I'm a tad old for that stuff anymore. :/  I don't have to worry about a draft, lets put it that way. :P  I have thought about the new cyber command though once I get more experience and whatnot.  It just looks like a fun sub-branch of the AF, and they're throwing money at it like it's going out of style.

Funny you mention that. I just came across this article regarding AF Cyber (http://government.zdnet.com/?p=3854) earlier today. I was curious to see what they were looking for so I went into their online recruiter chat. What I was told was this:

"We are currently looking for people with bachelors degrees in computer engineering."

When I asked him about security testers, his reply was simply "what about them?" Then he re-emphasized what he had already told me by re-stating they are only interested in people with a bachelors in computer engineering.

Really?  Interesting... I'm going to assume that a bachelors in computer science with emphasis on security would work.  But that is interesting their focusing on a degree.  Best hacker I ever met was an old roomate of mine from Germany.  Guy was increadible, but he never had a degree.  All he did was spend all night on the computer... very movie like, and sureal actually.  He seemed to survive and sustain his life force off of crt radiation, red bull, vodka, and Cup O' Noodle soups.  It was actually watching the shit he did that got me vaguely interested in computer security years back.  He actually was the guy who altered the "Hack the Matrix" website that the Matrix creators put up when they were first making the movie.  They brought it down and fixed the scripting vulns, but it was interesting to watch him sit there and eat through the code mentally while he was drinking vodka and eating stale Cup O' Noodle soup.  All that said, he wasn't the most reliable guy... so I can see why they might want a degree.  A degree isn't so much a show of skill, but of patience and reliability I guess.  :P Not bad traits in a job.

That does seem strange that the AF would only be recruiting people with a degree for the new Cyber Command.  If they are only accepting college graduates then how do they get any enlisted people in the command?  (For those that don't know you have to have at least a bachelors degree to be an officer in the AF.)  And let me tell you now that if you already have your bachelors degree and you go into the AF make dang sure you become an officer because that is the cushy life.  How do they get any work done if they don't have any enlisted people?  All officers know how to do is sit around and look pretty.   :D  :P

On the serious side though if you are really interested in getting into the Cyber command I wouldn't let that one recruiter dis way you.  The AF consists of probably 90% enlisted of which most don't start with degrees.

and play golf

Yeah, I couldn't quite do the golf thing.  I prefer hockey or boxing.  I'm still not sure though, whether I just want to stick with one of the civ branches, or go mil.  My job now is fairly lax, and I LOVE maxiflex scheduling. I figure AF would want me to actually... be places at specific times. ;)

Very true!  I forgot they do golf.  LOL!

Wow, it looks like everyone is using my thread as a chatroom lol. Just a little update for everybody. I just passed my A+ 602 certification with a 780. Soon as I got home I cracked open my Net + book, these certs are addicting. I also ordered Counter hack reloaded, and hacking for dummies. I had a question that I wanted to ask but it kinda slipped my mind. Will post later.


Sorry, I haven't  been able to reply to some of your post, I have been busy studying, school, girlfriend and all of that good stuff. But thankyou, It's nice to know how others got started, and how successful your path(s) were, it just motivates me to find my path so I can achieve my goals and be successful. You guys are really helpful. This really is a great community. I give credit to Don for that, and active members.