I have been interested in Information Security and Forensics for a really long time and was the reason I decided to pursue a degree in CSE (Bachelors acquired), however, I am having a difficult time figuring out the best way to get involved while staying out of the blackhat side (as much fun as it could be), avoiding breaking the law, or, dishing out 10s of thousands of dollars that I don't have.

I have started looking in to the SANS institutes MSISE, but that is extremely expensive and my current employer will absolutely not pay for it as I'm a developer, and an MSISE has no clout in this side of things.

First, let me lay out what I am interested in (in order of most to least interesting), and then, what I have looked in to.

What I'm interested in:

  1. Penetration Testing Everything listed here, with Adv. network pen testing as final course
  2. Data Forensics - Recovering deleted or destroyed data for evidence gathering to prosecute the really bad bad guys (think pedophiles and the like)
  3. Incident Response
  4. Reverse Engineering - Is this a career or just a sub-domain of a discipline?

What I have looked in to (not in any particular order):

  1. Coursera.org's Cyber Security courses
  2. SANS MSISE (or various courses and certifications from this program)
  3. CEH certification
  4. CISSP (Lot's of learning before I get to this one)
  5. Offensive Security training

What have I done to prepare myself? I have a bit of experience in Kali and recently configured a set of VMs for a virtual home lab running Linux Mint 18, Kali, and Windows 7 and I can operate all three at the same time to work in multiple environments. I am familiar with the concepts of NMAP, Aircrack-ng, MITM tools, Metasploit, OllyDbg, and WireShark. I have programming experience in C/C++, C#, ASP.NET, ASM, JS, SQL, PHP, Python and some others.

My biggest questions

  1. If I obtain a GWAPT, GPEN, GXPN, and CEH, will these allow me to get a foot in the door?
  2. What if I just obtain a GPEN, GXPN, and CEH
  3. Are Offensive Security certifications or SANS certifications more highly regarded?
  4. Is there a particular order that certifications should be obtained?
  5. Do I need certifications, or am I just going to blow my money?

I know this is a lot to read and is a lot to ask, but I am extremely interested in the field and I haven't found much guidance or information on what a decent approach would be (I know, it's subjective). Basically, what I am attempting to do, is learn the skills I need to get in the door without A) breaking the law, B) breaking the law, and C) breaking the law. Books can only impart so much knowledge before you have to actually get in and do the work to solidify the information and understand what it is really trying to get across. You can read 100 programming books on 100 different languages and in the end, you will still know 0 languages. I'm trying to get some real world experience without going in to the wild to get it, if that makes sense.

Where would I like to be in 5-10 years? I would really like to become a member of SANS Cyber Guardian Red team. How neat would that be?

Sorry if this is an incorrect location for such a question. I am fairly confident this isn't a duplicate; I looked at the ones that may be similar and nothing really stood out. Thank you for taking the time to read this and for your insights.

closed as primarily opinion-based by techraf, Xander, Anders, Stephane, S.L. Barth Aug 30 '16 at 6:47

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • If you want to know what a hiring manager values, you need to talk to hiring managers. This is an international site with professionals from every possible industry; we are not going to be able to tell you what you need to know to get hired, but an informational interview with just one hiring manager will. That's why the other questions on this site don't "stand out". Aside from that, welcome to InfoSec! – schroeder Aug 29 '16 at 21:11
  • I'm not really looking for what a hiring manager values, but more of what the community values; to me this is more important than a hiring managers view; and what they may look at as far as certifications and say, "Yeah, seems this individual actually cares about what he/she is doing." Thanks for the welcome, I hope to one day provide answers, and not just questions. :) – Ingenioushax Aug 29 '16 at 21:33
  • 3
    But our opinion won't get you a job, which is central to your "biggest questions". If you want respect, do stuff, show skill, get good at something, anything. If you want a job, you need to meet the expectations of the hiring manager. Never confuse the two. Too many new people in a field do. As asked, this is an entirely opinion-based question, which is not a great fit for StackExchange. – schroeder Aug 29 '16 at 21:43

Any of the SANS certs are a great option and will get a hiring manager's attention. Practicing on vulnerable VMs in your lab will give you experience with the tools and techniques. There's no need to break the law with so many VM's available. (Check out vulnhub.com if you already haven't.) Ethicalhacker.net's forum has a lot of posts about people trying to break into the infosec field, you may find some good advice there.

  • I have not yet heard of vulnhub.com or Ethicalhackers.net and I will have to check this stuff out. Thanks for the info! – Ingenioushax Aug 29 '16 at 21:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.