Home
Calendar
Certifications
Columns
Features
Forum
Resources
Vitals
Latest Additions
April 2013 Free Giveaway Sponsor - eLearnSecurity
Human Intelligence to Navigate the Security Data Deluge
February 2013 Free Giveaway Winner of SANS CyberCon Training
Interview: Bugcrowd Founders on Herding Ninjas for Crowdsourced Bug Bounties
Network Forensics: The Tree in the Forest
March 2013 Free Giveaway Sponsor - Mile2
Book Review: Violent Python
February 2013 Free Giveaway Sponsor - SANS
Holiday 2012 Free Giveaway Winner of Metasploit Pro by Rapid7
Course Review: SANS FOR408 Computer Forensic Investigations – Windows In-Depth
The Security Consulting Sugar High
Tutorial: Fun with SMB on the Command Line
Interview: Ilia Kolochenko, CEO of High-Tech Bridge
October 2012 Free Giveaway Winner of LearningGate Training
The Broken: Assessing Corporate Security in 2012 to Make a Better 2013
EH-Net Login
Welcome Guest.
Username:
Password:
Remember me
Lost Password?
No account yet?
Register
Who's Online
We have 43 guests online
You are here:
Home
Ethical Hacking Discussions and Related Certifications
General Certification
Security
Training Conundrum
EH-Net
May 22, 2013, 03:09:01 PM
Welcome,
Guest
. Please
login
or
register
.
Did you miss your
activation email?
1 Hour
1 Day
1 Week
1 Month
Forever
Login with username, password and session length
News
: Go back to The Ethical Hacker Network Online Magazine
Home Page
Home
Help
Calendar
Login
Register
EH-Net
>
Ethical Hacking Discussions and Related Certifications
>
General Certification
>
Security
>
Training Conundrum
Pages: [
1
]
Go Down
« previous
next »
Print
Author
Topic: Training Conundrum (Read 3081 times)
0 Members and 1 Guest are viewing this topic.
3xban
Hero Member
Offline
Posts: 608
Training Conundrum
«
on:
January 13, 2013, 09:51:29 PM »
So I am looking at what to pick for training this year, provided we have a budget for it. I am torn between a few SANS courses, 2 of which do not have any GIAC certs associated but provide some much needed information. Those would be SEC575 (mobile security) and 579 (Virtualization/Private Cloud). 575 would benefit my current role at the company. 579 peaks my interest much more because I love me some virtual machines and the architecture behind a properly implemented solution. As for the cert paths I was looking at SEC501 (Adv Sec Essentials), mostly to formalize my training as a defender. The other option was FOR610 (malware analysis), main goal is to get more formal training on this topic which has been an ongoing self-study effort.
So do I go for the straight up informational training? Or go for a cert path? Any choice will help the company really. I am the only technical/architecture security guy, so increasing my knowledge helps improve things as a whole. Though if I was to go completely selfish, I would choose FOR610 for both the experience and the cert. SEC579 would be a close 2nd.
Any thoughts?
Logged
Certs: GCWN
(@)Dewser
H1t M0nk3y
Hero Member
Offline
Posts: 864
Re: Training Conundrum
«
Reply #1 on:
January 14, 2013, 07:10:18 AM »
Only you knows the answer 3xban!
Do you have a pretty secure job? If it's the case, you don't need certs in the short term... You may be better going for a class that would help you and your employer (it will also be easier to get them to pay for the class...).
Do something you like, regardless of the cert. You must have seen by now how we, on the offensive side, praise the Offensive Security courses. We all know here that their certs are extremely valuable, but as far as I am concerned, the industry has yet to recognize them. Basicaly, being OSCP certified doesn't help you get through HR, but it helps you big time when it is time to do the real work...
So just focus on getting better at something you like. Your reputation and skills are far more valuable than certs.
And yeah, do CISSP when you have a chance...
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
3xban
Hero Member
Offline
Posts: 608
Re: Training Conundrum
«
Reply #2 on:
January 14, 2013, 11:16:02 AM »
I did consider the CISSP, I should just bite the bullet and go for it. Figure get the week boot camp and hammer out the test. Although, if I do the self study, I can probably get them to pay for the exam and then I will have extra training money left and use that for a content rich course of some sort.
I just lack peers to discuss these types of topics with locally. In my group I am the technical lead for most of the InfoSec projects and operational stuff.
Logged
Certs: GCWN
(@)Dewser
H1t M0nk3y
Hero Member
Offline
Posts: 864
Re: Training Conundrum
«
Reply #3 on:
January 14, 2013, 11:32:11 AM »
I self studied for CISSP. Here's what I did:
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,6675.msg35858/#msg35858
But you don't have to do it now. I was joking a bit in my previous post...
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Dark_Knight
Sr. Member
Offline
Posts: 292
Re: Training Conundrum
«
Reply #4 on:
January 14, 2013, 11:38:16 AM »
Quote from: 3xban on January 13, 2013, 09:51:29 PM
So I am looking at what to pick for training this year, provided we have a budget for it. I am torn between a few SANS courses, 2 of which do not have any GIAC certs associated but provide some much needed information. Those would be SEC575 (mobile security) and 579 (Virtualization/Private Cloud). 575 would benefit my current role at the company. 579 peaks my interest much more because I love me some virtual machines and the architecture behind a properly implemented solution. As for the cert paths I was looking at SEC501 (Adv Sec Essentials), mostly to formalize my training as a defender. The other option was FOR610 (malware analysis), main goal is to get more formal training on this topic which has been an ongoing self-study effort.
So do I go for the straight up informational training? Or go for a cert path? Any choice will help the company really. I am the only technical/architecture security guy, so increasing my knowledge helps improve things as a whole. Though if I was to go completely selfish, I would choose FOR610 for both the experience and the cert. SEC579 would be a close 2nd.
Any thoughts?
Do what genuinely interests you. I agree with doing the CISSP as it seems to be a necessary evil. I have been putting it off for a while now.
Logged
CEH, OSCP, GPEN, GWAPT, GCIA
http://sector876.blogspot.com
Grendel
Full Member
Offline
Posts: 242
Re: Training Conundrum
«
Reply #5 on:
January 14, 2013, 07:58:03 PM »
Go for 8570-type certs especially the CISSP. The way I see it, the high-level certs are going to improve your re-hire chances if you lose your job (never say never) or want to move on. These will get you past HR. your current job experience will land you a job with the manager in your next interview... But you have to get past HR first. Since your current employer is willing to foot the bill, expand your HR fodder.
Logged
- Thomas Wilhelm, MSCS MSM
ISSMP CISSP SCSECA SCNA IEM
Web Site:
http://HackingDojo.com
Author:
Professional Penetration Testing
Ninja Hacking
Penetration Tester's Open Source Toolkit
Metasploit Toolkit for Penetration Testing
Netcat Power Tools
3xban
Hero Member
Offline
Posts: 608
Re: Training Conundrum
«
Reply #6 on:
January 14, 2013, 08:34:37 PM »
And Thomas makes a valid point. I actually had a recruiter contact me about a gig 8 minutes from my house (current commute is 1 hour). Of course I said hell yeah (well not really I was reserved) and sent my updated resume over. But because I didn't have "GSEC or CISSP" my resume was a little light. Though I don't believe he actually read the resume or understood half the stuff on it. Told my last boss about that he was a bit shocked. I moved on and told the recruiter well if he doesn't find someone or the choice doesn't work out, give me a call. Then said to myself, I don't want my next boss to be that type of manager.
But either case, if I decide to go into freelance consulting, clients will want to see something like a CISSP on my credentials, so it is like a necessary evil.
Thanks for the input guys!
Logged
Certs: GCWN
(@)Dewser
ajohnson
Recruiters
Hero Member
Offline
Posts: 1057
aka dynamik
Re: Training Conundrum
«
Reply #7 on:
January 15, 2013, 10:17:00 PM »
I don't see the need for a course for the CISSP. The material is so dry that it's just going to go in one ear and out the other after you get a few hours into it. It's best to take the slow-and-steady approach with a book and regular review. The actual exam is almost more about interpreting the questions correctly than it is about security, so maybe you could omit studying if you have stellar analysis skills
If you're looking for resume-building certs for a job change, browse job boards and see what's hot. GSEC is popular, but it's kind of generic, and there are a lot more people with those than any other GIAC cert. The GCIH seems to be the next most popular, and that one actually has some teeth to it. The 501/GECD material is also pretty solid. I've seen a majority of the books because I've written some exam questions for that one. Again though, check the job boards and see what the demand for that one is. I would suspect you'd find that one to be very useful for your day-to-day role, but relatively weak for career changes.
Regarding the mobile and virtualization courses, you can certainly pimp those on LinkedIn and your resume. Both of those are important technologies that pretty much everyone uses, and stating that you've had a SANS course on the subject is only going to help your cause. Although, I'd view those more along the lines of icing on the cake, as opposed to major attention-getters that help you get your foot in the door. I'd put those off until you've got resume fodder under your belt.
Logged
WIP: GCFA |
www.infosiege.net
| @infosiege
The day you stop learning is the day you start becoming obsolete.
3xban
Hero Member
Offline
Posts: 608
Re: Training Conundrum
«
Reply #8 on:
January 17, 2013, 09:48:34 PM »
Thanks man, I appreciate the input. It is tough, I am basically in a generalist role at the moment. Unless we add more technical staff, I will probably remain their until I burn out or decide to hunt for another opportunity. I really do enjoy building out architectures, so long as I get to get my hands dirty a little. But the current corporate setup doesn't always allow for that. GCIH would benefit me, that part of my job I enjoy as well. Unfortunately I don't have all the nifty testing sandboxes that the cool kids have. So again, limited in what I am able to do. So do it all! But we won't give you the tools or time to do it. oh well decisions decisions. Maybe I'll use the thinking time and strengthen my coding.
Logged
Certs: GCWN
(@)Dewser
Pages: [
1
]
Go Up
Print
« previous
next »
Jump to:
Please select a destination:
-----------------------------
EH-Net
-----------------------------
=> Calendar Of Events
===> ChicagoCon 2007
===> ChicagoCon 2008s
===> ChicagoCon 2008f
===> ChicagoCon 2009s
=> Ethical Hacktivism
=> News Items and General Discussion About EH-Net
===> Greetings
=> Special Events
-----------------------------
Ethical Hacking Discussions and Related Certifications
-----------------------------
=> General Certification
===> Networking
===> OS
===> Security
=> Compliance, Regulations & Standards
=> Control Systems
=> Cyber Warfare
=> Forensics
===> CCE / MCCE - (Master) Certified Computer Examiner
===> CHFI - Computer Hacking Forensic Investigator
===> EnCE - EnCase® Certified Examiner
===> GCFA - GIAC Certified Forensics Analyst
=> Hardware
=> Incident Response
===> CSIH - Computer Security Incident Handler
===> GCIH - GIAC Certified Incident Handler
=> Malware
===> Advisories
=> Mobile
=> Network Pen Testing
===> CEH - Certified Ethical Hacker
===> CPTC - Certified Penetration Testing Consultant
===> CPTE - Certified Penetration Testing Engineer
===> CSTA - Certified Security Testing Associate
===> eCPPT - eLearnSecurity Certified Professional Penetration Tester
===> ECSA - EC-Council Certified Security Analyst
===> GPEN - GIAC Certified Penetration Tester
===> OSCP - Offensive Security Certified Professional
=> Physical Security
=> Programming
=> Social Engineering
=> Web Applications
=> Wireless
===> CWNP Certs
===> GAWN - GIAC Assessing Wireless Networks
===> OSWP - Offensive Security Wireless Professional
=> Other
-----------------------------
Columns
-----------------------------
=> Editor-In-Chief
=> Andress
=> Gates
=> Haddix
=> Hadnagy
=> Heffner
=> Hoffman
=> Linn
=> RichM
=> Murray
=> J. Peltier
=> Weidman
=> Wilson
-----------------------------
Features
-----------------------------
=> /root
=> Book Reviews
=> Opinions
=> Skillz
===> Examples
===> May 06 - Star Hacks, Episode V: The Empire Hacks Back
===> July 06 - Hack Bill!
===> Sept 06 - Netcat in the Hat
===> Nov 06 - Hitch-Hackers Guide to the Galaxy
===> Dec 06 - A Christmas (Hacking) Story
===> Feb 07 - Charlottes Web Site
===> April 07 - Microsoft Office Space
===> June 07 - Serenity Hack
===> Oct 07 - Worst. Ethical. Hacker. Challenge. Ever.
===> Dec 07 - Frosty the Snow Crash
===> March 2008 - It Happened One Friday
===> Oct 2008 - Scooby Doo and the Crypto Caper
===> Dec 08 - Santa Claus Is Hacking to Town
===> Feb 2009 - Brady Bunch Boondoggle
===> July 2009 - Prison Break
===> October 2009 - SSHliders
===> December 2009 - Miracle on Thirty-Hack Street
===> December 2010 - The Nightmare Before Charlie Browns Christmas
-----------------------------
Resources
-----------------------------
=> Career Central
===> Looking For Work
===> Looking To Hire
=> Links to cool sites.
=> Mass Media
=> News from the Outside World
=> Tools
=> Tutorials
===> Tutorial Requests
Loading...
Exclusive Deal
SANSFIRE 2013
June 15 - 22
5% Off
w/ Code
:
EHN_5
SANS Deals 4 EH-Netters
5% OFF
Any
SANS Course
in Any Format!
Coupon Code:
EHN_5
Including
SANS Rocky Mountain 2013
&
SANS Boston 2013
Polls
Compared to this year, 2013 will be:
Great!
Better.
About the same.
Little worse.
FUBAR!
Recent Forum Topics
Greetings
: Hi from the UK
(0) by
C_B
Network Pen Testing
: AIX Vulnerability Assessments
(2) by
ras76
Tutorials
: Need guidance
(9) by
hanyhasan
Programming
: Finished Python Course in Codecademy now what?
(15) by
hanyhasan
Network Pen Testing
: Ruby on Rails Vulnerabilities / Attacks in BackTrack 5 r3
(0) by
SUdoctstudent
Network Pen Testing
: De-ICE 1.140 released!
(2) by
superkojiman
General Certification
: CPT Practical Submission
(1) by
UNIX
OSCP - Offensive Security Certified Professional
: Failed my first attempt at the OSCP exam
(94) by
azmatt
Tools
: Social-Engineer Toolkit (SET) Version 5.0 “The Wild West” Released
(2) by
m0wgli
Malware
: EICAR?
(3) by
UKSecurityGuy
Advisories
: HTB23154: Multiple Vulnerabilities in Exponent CMS
(0) by
AndyP
Advisories
: HTB23153: Multiple Vulnerabilities in Jojo CMS
(0) by
AndyP
Advisories
: HTB23151: Cross-Site Request Forgery (CSRF) in UMI.CMS
(0) by
AndyP
OSCP - Offensive Security Certified Professional
: Class Scheduled 6/8 - Linux n00b
(7) by
Taemyks
OSCP - Offensive Security Certified Professional
: OSCP exam scheduled
(6) by
gbhat
Incident Response
: LinkedIn Forensics
(0) by
AFENTIS_Forensics
General Certification
: Red Team/Blue Team
(1) by
ajohnson
Career Central
: Starter cert?
(3) by
Grendel
Network Pen Testing
: Beginner Ethical Hacker
(1) by
m0wgli
Web Applications
: Nessus and Nikto
(4) by
Seen
Network Pen Testing
: Cracking salted MD5 hash
(4) by
n37sh@rk
CEH - Certified Ethical Hacker
: Passed my C|EH
(3) by
n37sh@rk
Mass Media
: EC-council hacked, irony at his best?
(0) by
j0rDy
Web Applications
: SQL Injection into an INSERT statement.
(6) by
eyenit0
Network Pen Testing
: Solution for sipXtapi INVITE Message CSeq Field Header Remote Overflow
(1) by
m0wgli
Web Applications
: dns
(2) by
H1t M0nk3y
EH-Net News Feeds
Latest Additions
Privacy Notice
for TDCC & All Properties
© 2013 The Ethical Hacker Network
Joomla!
is Free Software released under the GNU/GPL License.