Web Security Certifications

Question

I'm looking for a certification for Web Application Security and Web Pen Testing. Via Google I found the following two:

• Certified Web Application Tester
• GIAC Web Application Penetration Tester

How well is there reputation? Are there other ones? How difficult are they? What is needed for preparation?

Answer 1

You might want to see the following questions on this site: Professional certifications for IT Security and International pentester certification. They give some partial information about various certifications, even if it is not necessarily everything you are looking for.

Answer 2

There aren't a huge number of certs around, especially if you are looking internationally.

First off, have a look at the International link in D.W's answer.

Personally, I think the two you have found have the highest reputation in the UK, but you could also look at the Tiger Scheme for another perspective. Like CREST it holds CHECK equivalency from CESG, the National Technical Authority for Information Assurance in the UK.

Answer 3

I've not done the GIAC one, but I have got the CREST Web Application Tester certification, so I can comment on that.

• I'd say it's pretty well regarded, specifically in the UK penetration testing/ethical hacking industry. The CESG equivalency that @RoryAlsop mentioned is important for government work in the UK and it's also regarded as a good indication of a candidates skill match for UK testing companies (as several of the larger ones helped to design it).

• As I mentioned on another question recently, I reckon that the CREST exam is the hardest professional exam I've taken. To put that in context I've done ~30 professional exams across IT and security over the last 15 years. It's got a tight time constraint and requires practical knowledge as well as theoretical knowledge to pass.

• Preparing for it can be tricky as (as far as I know) there's no specific training course you can take. Personally I wouldn't recommend trying it unless you're an active web app. tester. If you are going to take it then review the syllabus that's available on their site and make sure you're comfortable with all the areas it mentions. Also I'd recommend reviewing the Web App Hackers Handbook, and ensuring you're comfortable with the various areas that it describes.

Answer 4

and you can wait for the this one offsec web expert