Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both courses are just barely in my price range, so I need to be sure that I get my moneys worth. My question is: Are either of these certifications recognizable and accredited? Will I be able to put these certificates on my resume? Will either of these look good to an employer?

share|improve this question
2  
OSCP is one of the toughest and most practical courses and exams you can take, they proof you are capable of pentesting. Be warned, it's not for the faint harted :) –  Lucas Kauffman Feb 16 '13 at 18:10
1  
Certificates are a waste of time because they don't prove that you know how to hack. –  Rook Feb 28 '13 at 18:35

6 Answers 6

The answer to this question largely depends on the country you're in and the companies that you apply to and the roles that you're looking at.

The eCPPT looks to be more focused on web app. testing, I've not specifically heard of the cert. before, but elearnsecurity have some good training materials.

The OSCP looks to be a decent cert for the exploitation/infrastructure testing side of things, so if that's the type of role that you're looking at then I'd expect that it could be a factor.

If you're just going in to college and won't be looking at getting a job for a while, I'd be inclined to hold of on professional certs if I was you as the field may well have changed in a couple of years.

share|improve this answer

Security+ -> CEH -> whatever you want.

That is the path to follow. The first one is the basic one for have a job in IT security. The second for improve knowledge about offensive security. Third, fourth.. I wouldn't get any other related with attacking, if you want more certs look in other more useful like CISSP, CISA, CISM, Cisco security certifications, etc.

However as Rory McCune said, if I were you I would focus in the college only. In four years this may (it will) change a lot.

share|improve this answer
    
CISSP has good resume appeal. CISSP, CISA, CISM are more management/audit focused. If the focus is pentesting, they need more technical and less management/audit. Cisco will dig into technical more. –  Paraplastic2 Oct 7 at 17:07

I started with OSCP first, and got lost and didn’t have any relative foundation in identifying and such. It seems that the eCPPT Is more of a foundation, but a very good one IMHO.. im doing it first then redoing the OSCP. Also I don’t think a CVE is that important and it would seem to me obtaining those comes with experience. For a Junior pen-testing job or a security analyst job I'm doing ECPPT then OSCP.

share|improve this answer

I have an OSCP and I’ve looked at eCPPT. At a student level, I would recommend eCPPT. Elearn has some great material, that’s really well explained and is more geared towards learning with just enough practice to drive the points and learning home. The material is pretty well guided and solutions are available if you get stuck, in addition to their support. They have labs so you practice as you learn but they aren’t very deep. Following up with a exam where you have hack enough of their labs to pass and write a passable report. I think their material is great and you’ll learn a lot. They are not as well known as OSCP which won’t have the same resume appeal. However, good hiring managers will look up certs they don’t know and realize the value of the cert.

OSCP is geared towards people who have developed pentesting skills and want a challenge that’s more than open source challenges. Their materials are great but not complete. The learning material they provide will not be enough alone to allow you to pass the exam. Solutions are not available if you get stuck. They have support but they aren’t there to help you with the basics. Unlike elearn they don’t hold your hand; you’re on your own. They generally help with more advanced issues. When you’re able to get 90% to taking over the box but need help with the last 10% they will generally help. If you need help getting started they’re probably going to tell you to try harder. OSCP has networks worth of labs for you to mess around in, it’s awesome and deep. That’s the real appeal here, you learn by doing. The materials walk you through the basics and then they tell you to go do it. Exam is similar but I assume harder, than elearn’s exam. You’ll need more time to get through the course. As you get deeper into the network the computers are better defended. Getting through everything is a pleasurable torment.

I would recommend OSCP after you know what you’re doing and you want a challenge that’s more then what can be found in the various vulnerable open source distros. I learned a lot with the OSCP but I wouldn’t recommend it for someone getting started.

share|improve this answer

Since you're getting into college would be nice picking up some scripting skills like python and bash,assembly language... etc , first and then take security courses while at college. Certification is never a means to an end. It's and end to a means. Having it, is just for paper work. not bragging rights

share|improve this answer

As a penetration tester i can tell you that no certification can prove that you can break software. If you are interested in joining the industry, go out and break open source projects. Contact Mitre and obtain a CVE numbers for your accomplishments.

If you can't obtain a simple CVE number then you are worthless penetration tester, and employers will know this.

share|improve this answer
3  
Rook, this is entirely unconstructive. We all know what certs do and don't give. Most penetration testers have no need for any CVEs, and most employers don't care about CVEs as they aren't even relevant for 95% of the tests companies require. They are a good indication that you may be useful in research. For the global pen test companies I have hired people for a CVE would be of interest but not even vaguely on my list of important things to have on a CV. –  Rory Alsop Feb 17 '13 at 21:36
3  
Of much greater importance: identifying business implications of a vulnerability, consistency in working practices, prioritisation of results, ability to articulate remediation activities and ability to use methods developed by other team members. –  Rory Alsop Feb 17 '13 at 21:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.