Hacking Course Value (Soft) [closed]

Question

The college that I'm currently attending (masters) offers a ethical hacking course, which I am currently enrolled in. I have been seriously considering dropping the course for several reasons.

1) The course until now has dealt with fluffier topics such as how to think like a hacker etc. and frameworks and specifications for the hacking process. It seems like it will get a little more hands on later on.

2) I feel like I can get equally good training (in this particular area) from an offensive-security type program rather than one from my university. It would also be cheaper to go that route.

I was hoping to get rigorous, hands on experience in the field and am assuming that this would be more beneficial than what I am currently getting. Instead of this course I would probably take a cryptology course a different semester. My main concentration is going to be Artificial Intelligence and this seems like it would be related. To be clear, my issue is not learning theoretical information, it's learning theoretical information in a course that I'm assuming is supposed to be hands on.

I guess my questions are:

1) How beneficial is it to know the fluffier aspects of hacking relative to the hands on aspects? Is this how the course should be structured?

2) How does it look in the field to get a "hacking" certificate from offensive-security (or something similar) as opposed to a real course in a legitimate university?

3) What areas should I be focusing on in my cybersecurity courses? Is cryptology useful in the field? Should I be trying to obtain practical skills or theoretical knowledge (rigorous or otherwise)?

If you have any other thoughts on the situation please let me know.

Answer 1

"Ethical Hacking" is in itself a wide topic, and not always practical in nature. Depending on the focus of the course, it is valid to cover Ethical Hacking from different angles:

1. managing a Red Team
2. developing policy
3. understanding threats in order to devise defences
4. methodologies and frameworks

Your Questions:

1) As a former educator myself, I can understand the validity of focusing on the above topics instead of practical hacking because the technical skills can be quickly outdated, irrelevant in certain environments, and easily taught and practiced depending on the student's needs. The "fluffier" aspects are what I would expect someone to know when coming out of a Master's program.

2) I don't think a University degree that includes hacking will be any more respected than any other education. What will matter is your demonstrated skill, not your training. On an interview for a web app hacking job, I'd be asking you questions about how you handled Damn Vulnerable Web App, and not what your GPA was.

3) When it comes down to discovering your own personal curriculum for practical Ethical Hacking, you need to ask yourself what you want to learn: web applications, network, operating systems, social engineering, etc. These are all huge topics and you might need to dip into each before you can come to your own conclusions.

Answer 2

David,

A warm welcome to you to the exciting world of Information Security. I am really happy that you have got the right questions. Let me share you my thoughts

1. "Hands-on aspects" & "Certification" Theoretical concepts you learn in Academics and the hands on experience by practice will complement each other. They are like two sides of a coin. Understand the concepts in classroom and start practicing step by step. Setup a mini practice setup in your own machine using Virtual machines. There are lot of Security Distros available like Kali Linux. Also some vulnerable Distros for your practice like Metasploitable. Identify your Distros, install in your machine and start practicing. Once you are comfortable and gained some experience identify your certification and prepare step by step. There are a lot of sites which will provide you training videos free of cost. You can do a research in Youtube, Securitytube.net and related sites

2. Areas in Security Cyber security is a field with lots of diverse areas. Some of the areas include but not limited to a. Penetration testing b. Secure Development c. Network Monitoring d. Digital Forensics e. Incident Handling and Response f. Testing and Certification Identify your area of interest and start working towards your goal

3. Knowledge on standards: A high level knowledge in various security standards will definitely an added value to your Resume. You can research portals like NIST, US-CERT to get more information.

Finally one fact remains unchanged "Practice makes a man perfect". This holds good for Information Security. Practice well the tools and techniques so that your skills will be enhanced. All the very best for a successful career in Information Security.