Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am now concentrating on my startup which is basically a one-man show.

At the same time, i just received an email from SANS Technology Institute’s (STI) about their exciting new accelerated option called “STI Cohort 2013.” which promises me that I would get a Masters of Science.

The following information about my situation and my considerations:

1) I earned a GSEC cert that is due to expire in 30 days. This cert costs me roughly $3000 USD I think. Which got me nowhere near a security job in Singapore or any other job. The MCSD .NET certificate was far more useful than the GSEC.

2) I am interested in IT security, but I want to get my startup to succeed more. My mind is thinking that I need to arm myself with IT knowledge since ecommerce requires my startup to prioritize.

I am just not sure if this is rational reasoning OR rationalizing my fear of failure in my startup hence very subtly sabotaging my chances of startup success by tempting myself towards this Masters of Science.

3) The Masters of Science in 2 years sound tempting, but I am very unsure how useful it is for me in my startup or, taking a longer view, my career.

4) I have no intention to travel to US to complete the Masters. I have every intention to stay in Singapore or within Asia for the next few years.

Here are my follow up questions if you say either YES or NO to my question of going for the Masters.

If your final recommendation to me is YES, then I would like to ask The application apparently requires me to produce evidence that i work in organization with security as part of my working experience. Does working in my startup count?

If your final recommendation to me is NO, then I would like to ask should I let my GSEC cert expire?

Thank you.



1) get a job with IT security related experience

2) then consider getting certifications after 2 years.

3) for web application security, consider reading

the following:

       a) Hacker Techniques Tools and Incident Handling, 

       b) 7 Most Deadliest Web Application Attacks, 

       c) Web Application Obfuscation, 

       d) Security Strategies in Web Applications and Social Networking, 

       e) Fundamentals of Information Systems Security
share|improve this question

2 Answers 2

Not sure why I cant comment, but here is an addition to the ans above: I too have looked @ your previous questions and tbh they dont look legit for a security professional... if you choose to get a piece of paper that says MSc on it, it wont make you anything better and most likely be a waste of your time, IF you dont already know the basics. By work experience I would imagine, the requirements are asking if you had any previous pen-testing / intrusion detection / prevention experience, forensic computing, cryptology and more (according to the course description it does quite a bit of it). I would personally suggest doing some self-education first on the topics mentioned in the course description and see how you get on with that.

The course description suggests that you will have 20(!!??) different subjects over 2 years... this means that you WILL NOT go in-depth into any of them or/and they will be of an advanced or professional level...

Just to conclude, the answer can be as simple as the answer to this simple question: can you tell the difference between the stack and the heap without looking it up on the net?

EDIT: above question is NOT for web-app sec. A web-app sec question would be: anyExploitName = Choose one of the top 10 from OWASP project and ask: What is the potential impact to servers and clients if this "anyExploitName" exists in your system?

share|improve this answer
@Sigtran that is a very good litmus test question! And you are right, i cannot tell the difference between stack and heap without looking it up on the net. –  Kim Stacks Mar 3 '11 at 5:27
@Sigtran Wait hang on a sec. That is a litmus test question to show whether I have fundamentals of IT security? or to show what? –  Kim Stacks Mar 3 '11 at 5:28
This is a question to see if youll be able to handle secure programming module, as it usually consists of buffer overflows / arc injections / integer vulnerabilities /etc. You will need to know quite a bit about C & ASM in there... else, once again it will be a waste of time. There is more to come in cryptology classes & Forensics.. can give examples as well if u need, but u can just google it. –  Sigtran Mar 3 '11 at 9:37
Okie thank you Sigtran. What if I want to focus on web application security? What would be good litmus test questions for that area of IT security? –  Kim Stacks Mar 3 '11 at 10:26
If you only want to concentrate on web-app security then you need to know how servers work and their config files... examples of questions would be: How can you perform a file/url include / sql injections, differences between XSS & CSRF... not sure what to recommend you here (course wise)... but you can have a look @ backtrack pen testing courses and if you can get a code from here (just get the code, dont bother registering): fc4.me I'd say you can make it through. –  Sigtran Mar 3 '11 at 10:56

There are better certs than gsec (CCIE, CCSP, CISSP to name a few), if you really want a useful cert I would explore those. Posting a question and asking for more responses to your previous question (see: spamming) is not a good way to endear yourself to knowledgeable experts on this site. You might want to think about not asking 5 part questions as well, your initial title is referencing pursuing your Masters but you also ask about certs.

I don't think your own startup should count as sec experience, and if you're thinking about getting a Masters you might want to start by doing a lot more research in the security field first. That program is for experienced professionals, and from the questions you asked in your prior question it seems as if you don't possess any knowledge beyond the most basic of security principles. There is a reason they have the work qualification, because if you don't have experience you will probably be over your head. If you're truly interested in security, I would recommend thinking about not how you can get around the admission requirements and obtain some "degree", but how you can actually improve and broaden your security related knowledge.

share|improve this answer
@mrnap I have edited the question based on your observations. Thank you. ".. but how you can actually improve and broaden your security related knowledge..." Any recommendations? –  Kim Stacks Mar 2 '11 at 4:12
@keisimone Improving and broadening security related knowledge is generally done by getting a job doing such things. Usually grunt work...you know...the usual way everyone gets experience. Start at the bottom and work up. IT Security Intern is a great position for that. –  Steve Mar 2 '11 at 16:20
@keisimone Agreed with SteveS....the other recommendation I would have for you is to start reading textbooks ASAP. All my free time I have I spend reading texts on the various sec related subjects, and when I understand them I read reliable industry blogs to get up to speed on the cutting edge of exploits (exploit-db.com is a solid sight to explore once you've read some texts). Safari Tech Books Online is a good site, as well as Books 24x7 for large repositories of online tech book collections. If you want, I can recommend some individual titles. –  mrnap Mar 3 '11 at 5:20
@keismone, One cert is better than the other only in different contexts. I dont think anybody would argue that the CISSP is a good practical cert, whereas the GSEC (most GIAC certs for that matter) are. You are not going to just learn about what cryptography is, but you are going to get a practical understanding of the difference between symmetrical & asymmetrical, and what that means in a real-world environment. On the other hand, the CISSP is still what most HR dept are looking for, rather than any GIAC certs. – Josh Brower 2 hours ago –  Josh Brower Mar 3 '11 at 15:35
@keisimone Hacker Techniques Tools and Incident Handling, 7 Most Deadliest Web Application Attacks, Web Application Obfuscation, Security Strategies in Web Applications and Social Networking, and Fundamentals of Information Systems Security are all good titles to start with. The Web App Obfuscation details some very recent vulnerabilities and new exploits, it's what I'm currently reading myself. –  mrnap Mar 4 '11 at 4:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.