Tag Info

Hot answers tagged

22

You could check out www.cccure.org - it was always the one I recommended folks go to when I used to teach CISSP. I have just checked it out and it has even more material than it did 5 years ago. It requires free registration, but then you have access to documentation and practice tests. (and good luck!)


21

None. Generally speaking, certifications in the security field, much like most other tech areas, are required only for entry-level positions (when you have no experience to speak of), senior positions (when you need the long signature), and government jobs (when you need to answer an RFP to work there). By themselves, none of these are a replacement for good ...


13

The CISSP certification is intended to demonstrate two things: Knowledge of the material in the ISC2 CBK, and Significant real-world experience in the field To an employer, a CISSP on a resume is supposed to mean that the application knows what s/he is doing and has demonstrated it with years of experience. Note that an employer looking for a CISSP for ...


11

The Offensive Security course is exactly that, training one to become a penetration tester. I found the class to be very informative, and a lot of fun. The PWB course states that a basic understanding of Linux command line is a plus, but not required. While it's true that the first few videos do a good job of making that statement true, having an ...


10

Before you jump into a course and commit to anything, try to get a taste for some security stuff using web "hackme" courses, such as webgoat (owasp) , hackmebank (foundstone), etc. As you are a web programmer, this might also ease your introduction to the field. Use google to look for reviews for both courses, and try to see what other say. Irrelevant of ...


8

I'll agree with @AviD there aren't really any must have certifications in Security. That said CISSP/CISM can be very useful in the hiring process for getting past Agency/HR screening. A couple of additional ones that I've not seen mentioned so far for the penetration testing side of things OSCP - I've not taken it but from what I've read it seems quite ...


8

Much like recursion, to properly understand audits we must first understand the scope and usage of audits. Audits are used to determine compliance against a benchmark. Without said benchmark, then the auditor has nothing to measure against. In some cases your benchmark may be a deeply technical document describing programming practices or operating system ...


8

Though not practice exams, I found the mind maps offered @ mindcert.com to be a great set of notes to use in keeping things together. They have published maps of 7 domain areas for the CISSP and a few for the CEH. Additionally, you can always make your own. http://www.mindcert.com/resources/ Hope this helps, and good luck to you!


8

From the perspective of an employer I would say yes - in terms of giving instructions to recruitment agencies, having a CISSP tick box can help to narrow down the number of applicants significantly. Later on in your career it may not count for so much, but as an indicator that someone has a reasonable grasp of the basics, in some IT and some procedural ...


7

cccure is a great resource. I also paid for study questions when i was studying and the cccure were harder, and more accurate to the test. Actually a lot of the cccure questions were harder than the actual test questions. Testing youself against a test bank is a good practice but I didn't really find it super helpful. It is a good activity if you are tired ...


7

Use DVWA or Mutillidae, get them to fix the code, then demonstrate pre/post fix behavior? Perhaps a little more complex than you were thinking, but it would also prove their coding ability. Or, if this is too much, get them to go through DVWA at lowest security settings, looking for certain data? (get usernames, login without creds, etc.) You could even ...


7

Common Criteria is a checkbox on DoD and other government department procurement processes. As you are probably aware, CC evolved from TCSEC in the states and combined ITSEC (Europe) and CTCPEC (Canada). So there are those that argue that Common Criteria sets down a standard model of security awareness for any product that goes through its process. With ...


7

I'm the Lead author of eLearnSecurity courses. In the attempt to shed some light and avoiding any (biased) comparison between these two great courses, I will just tell you what I think we do best. We give great attention to the why/how of each technique/vulnerability. We want the reader to deeply understand every topic in our course before introducing tools ...


7

As others have said, the CISSP is perhaps the most well-known and recognized IT Security certification out there. If you need to start more entry-level, CompTIA's Security+ is a good start, and actually can be used to take a year off of the work experience requirements of the CISSP. After the basics are out of the way, the question you really need to ask ...


6

For an experienced information security professional, the overarching credential in the UK is Full Membership of the Institute of Information Security Professionals - this is in a slightly different space to the ones listed above, as it is not based on a particular specialisation exam like CISSP or CISM, instead it is based on competencies across the whole ...


6

First, GIAC isn't a certification; it's a certification body tied closely to SANS. GIAC produces dozens of different certs, and are generally well-regarded. Second, it depends on what you're looking for. For example, if you're looking for general info, the CISSP is regarded as the standard, though the certification itself doesn't go far to validate actual ...


6

The consideration of your peers !


6

Your lack of a master's degree won't make any difference, but your lack of any relevant work experience will kill you (unless you've got a few years working in IT security that you've not mentioned). Before you can work as a consultant in any field, you need to be able to demonstrate a track record of proven achievement, not just academic study.


6

My employer required CompTIA's Security+ certification for entry-level positions. It will give you the basics. Despite criticism for its form (multiple-choice answers), by actually doing the course and studying on areas where you lack knowledge, you will get a decent start about security. After that it may become a matter of choosing where you want to go ...


6

According to the GIAC website: GIAC exams are open-book/open-notes, therefore you are allowed to bring any non-electronic resources you may need during your test (this includes a notepad for writing). You are allowed to bring as many of the chosen materials as you are able to fit in a standard-size bookbag (roughly). ...


6

I do not know you level/background but OSCP is kind of a hardcore course for penetration testers. It is not a security course for web developers/web administrators. You will be doing a lot of metasploit, nmap, etc. and searching for vulnerabilities in existing software using fuzzing techniques, debugging in ollydbg and developing exploits. They do cover ...


6

My big question is - why penetration testing? I see that you want: An online course An online exam A reasonable cost Is getting certification a a bonus or a requirement? Usually my personal strategy is to start with something I know and move into something tangential to it. Or I keep working to get to the bigger picture. So as someone who started in ...


6

I think one of the most hands on security certifications out there is Offensive Security Certified Professional/Expert. The exam involves executing a penetration test and delivering a report on which you will get quoted. Now this certificate is aimed at attack and penetration testers, if your job is to administer Cisco equipment you should look into CCNAS or ...


5

General mutterings in the chat room seem to indicate that certs are primarily for entry level positions. My personal opinion is that certs are for HR. HR will either require, give some preference, or completely ignore certs. The cert will only appear on the resume and maybe a good line or two on a cover letter. If a cert is required for a position you will ...


5

Audits are typically used for detection: detecting problems. Controls typically provide prevention: preventing intrusions. However, you can use audits for more than just detecting intrusions. You can also use auditing to detect problems or shortcomings in your controls (e.g., compliance audits, network configuration audits), and/or to detect ...


5

My subjective opinion is that these particular courses are not worth it for you. These courses are expensive at $4,000+ per course. They are highly structured and compacted into a short time period. These courses are perfect for someone who needs to learn a lot quickly and will do well in a structured intense formal environment. Based on the assesment ...


5

For CISSP, I highly suggests Shon Harris's book. It's the single best book to cover CISSP I've read.


4

Here's some: http://www.myappsecurity.com/threat-modeling/secure-coding-quiz/ http://www.myappsecurity.com/threat-modeling/owasp-top-ten-quiz/ http://www.myappsecurity.com/threat-modeling/application-security-crossword/ http://myappsecurity.com/encryption-quiz/ http://myappsecurity.com/threat-modeling-quiz/ Microsoft also seems to have a Threat Modeling ...


4

Having taken the C|EH fairly recently, I'd reccomend following their guidelines in knowing the command line parameters and expected output of the most common tools. I think it is 10% of the exam according to their materials and since they don't offer any man pages you can just write off that part if you aren't at all familiar with the basics (nmap, netstat, ...


4

In the comments and on chat I ran across some great underlying career advice and I just want to be sure it gets at least "answer" status (if Avid or Rakkhi want to expand on them, I'd be happy to delete this answer) There is an important career-planning aspect to your question, and deciding what direction you really want to head in is the first, most ...



Only top voted, non community-wiki answers of a minimum length are eligible