I have been interested in Information Security and Forensics for a really long time and was the reason I decided to pursue a degree in CSE (Bachelors acquired), however, I am having a difficult time figuring out the best way to get involved while staying out of the blackhat side (as much fun as it could be), avoiding breaking the law, or, dishing out 10s of thousands of dollars that I don't have.
I have started looking in to the SANS institutes MSISE, but that is extremely expensive and my current employer will absolutely not pay for it as I'm a developer, and an MSISE has no clout in this side of things.
First, let me lay out what I am interested in (in order of most to least interesting), and then, what I have looked in to.
What I'm interested in:
- Penetration Testing Everything listed here, with Adv. network pen testing as final course
- Data Forensics - Recovering deleted or destroyed data for evidence gathering to prosecute the really bad bad guys (think pedophiles and the like)
- Incident Response
- Reverse Engineering - Is this a career or just a sub-domain of a discipline?
What I have looked in to (not in any particular order):
- Coursera.org's Cyber Security courses
- SANS MSISE (or various courses and certifications from this program)
- CEH certification
- CISSP (Lot's of learning before I get to this one)
- Offensive Security training
What have I done to prepare myself? I have a bit of experience in Kali and recently configured a set of VMs for a virtual home lab running Linux Mint 18, Kali, and Windows 7 and I can operate all three at the same time to work in multiple environments. I am familiar with the concepts of NMAP, Aircrack-ng, MITM tools, Metasploit, OllyDbg, and WireShark. I have programming experience in C/C++, C#, ASP.NET, ASM, JS, SQL, PHP, Python and some others.
My biggest questions
- If I obtain a GWAPT, GPEN, GXPN, and CEH, will these allow me to get a foot in the door?
- What if I just obtain a GPEN, GXPN, and CEH
- Are Offensive Security certifications or SANS certifications more highly regarded?
- Is there a particular order that certifications should be obtained?
- Do I need certifications, or am I just going to blow my money?
I know this is a lot to read and is a lot to ask, but I am extremely interested in the field and I haven't found much guidance or information on what a decent approach would be (I know, it's subjective). Basically, what I am attempting to do, is learn the skills I need to get in the door without A) breaking the law, B) breaking the law, and C) breaking the law. Books can only impart so much knowledge before you have to actually get in and do the work to solidify the information and understand what it is really trying to get across. You can read 100 programming books on 100 different languages and in the end, you will still know 0 languages. I'm trying to get some real world experience without going in to the wild to get it, if that makes sense.
Where would I like to be in 5-10 years? I would really like to become a member of SANS Cyber Guardian Red team. How neat would that be?
Sorry if this is an incorrect location for such a question. I am fairly confident this isn't a duplicate; I looked at the ones that may be similar and nothing really stood out. Thank you for taking the time to read this and for your insights.