Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both courses are just barely in my price range, so I need to be sure that I get my moneys worth. My question is: Are either of these certifications recognizable and accredited? Will I be able to put these certificates on my resume? Will either of these look good to an employer?

share|improve this question
1  
OSCP is one of the toughest and most practical courses and exams you can take, they proof you are capable of pentesting. Be warned, it's not for the faint harted :) – Lucas Kauffman Feb 16 at 18:10
Certificates are a waste of time because they don't prove that you know how to hack. – Rook Feb 28 at 18:35

4 Answers

up vote 2 down vote

The answer to this question largely depends on the country you're in and the companies that you apply to and the roles that you're looking at.

The eCPPT looks to be more focused on web app. testing, I've not specifically heard of the cert. before, but elearnsecurity have some good training materials.

The OSCP looks to be a decent cert for the exploitation/infrastructure testing side of things, so if that's the type of role that you're looking at then I'd expect that it could be a factor.

If you're just going in to college and won't be looking at getting a job for a while, I'd be inclined to hold of on professional certs if I was you as the field may well have changed in a couple of years.

share|improve this answer
up vote 0 down vote

Security+ -> CEH -> whatever you want.

That is the path to follow. The first one is the basic one for have a job in IT security. The second for improve knowledge about offensive security. Third, fourth.. I wouldn't get any other related with attacking, if you want more certs look in other more useful like CISSP, CISA, CISM, Cisco security certifications, etc.

However as Rory McCune said, if I were you I would focus in the college only. In four years this may (it will) change a lot.

share|improve this answer
up vote -2 down vote

Since you're getting into college would be nice picking up some scripting skills like python and bash,assembly language... etc , first and then take security courses while at college. Certification is never a means to an end. It's and end to a means. Having it, is just for paper work. not bragging rights

share|improve this answer
up vote -5 down vote

As a penetration tester i can tell you that no certification can prove that you can break software. If you are interested in joining the industry, go out and break open source projects. Contact Mitre and obtain a CVE numbers for your accomplishments.

If you can't obtain a simple CVE number then you are worthless penetration tester, and employers will know this.

share|improve this answer
Rook, this is entirely unconstructive. We all know what certs do and don't give. Most penetration testers have no need for any CVEs, and most employers don't care about CVEs as they aren't even relevant for 95% of the tests companies require. They are a good indication that you may be useful in research. For the global pen test companies I have hired people for a CVE would be of interest but not even vaguely on my list of important things to have on a CV. – Rory Alsop♦ Feb 17 at 21:36
Of much greater importance: identifying business implications of a vulnerability, consistency in working practices, prioritisation of results, ability to articulate remediation activities and ability to use methods developed by other team members. – Rory Alsop♦ Feb 17 at 21:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.