I am now concentrating on my startup which is basically a one-man show.

At the same time, i just received an email from SANS Technology Institute’s (STI) about their exciting new accelerated option called “STI Cohort 2013.” which promises me that I would get a Masters of Science.

The following information about my situation and my considerations:

1) I earned a GSEC cert that is due to expire in 30 days. This cert costs me roughly $3000 USD I think. Which got me nowhere near a security job in Singapore or any other job. The MCSD .NET certificate was far more useful than the GSEC.

2) I am interested in IT security, but I want to get my startup to succeed more. My mind is thinking that I need to arm myself with IT knowledge since ecommerce requires my startup to prioritize.

I am just not sure if this is rational reasoning OR rationalizing my fear of failure in my startup hence very subtly sabotaging my chances of startup success by tempting myself towards this Masters of Science.

3) The Masters of Science in 2 years sound tempting, but I am very unsure how useful it is for me in my startup or, taking a longer view, my career.

4) I have no intention to travel to US to complete the Masters. I have every intention to stay in Singapore or within Asia for the next few years.

Here are my follow up questions if you say either YES or NO to my question of going for the Masters.

If your final recommendation to me is YES, then I would like to ask The application apparently requires me to produce evidence that i work in organization with security as part of my working experience. Does working in my startup count?

If your final recommendation to me is NO, then I would like to ask should I let my GSEC cert expire?

Thank you.



1) get a job with IT security related experience

2) then consider getting certifications after 2 years.

3) for web application security, consider reading

the following:

       a) Hacker Techniques Tools and Incident Handling, 

       b) 7 Most Deadliest Web Application Attacks, 

       c) Web Application Obfuscation, 

       d) Security Strategies in Web Applications and Social Networking, 

       e) Fundamentals of Information Systems Security

1 Answer 1


There are better certs than gsec (CCIE, CCSP, CISSP to name a few), if you really want a useful cert I would explore those. Posting a question and asking for more responses to your previous question (see: spamming) is not a good way to endear yourself to knowledgeable experts on this site. You might want to think about not asking 5 part questions as well, your initial title is referencing pursuing your Masters but you also ask about certs.

I don't think your own startup should count as sec experience, and if you're thinking about getting a Masters you might want to start by doing a lot more research in the security field first. That program is for experienced professionals, and from the questions you asked in your prior question it seems as if you don't possess any knowledge beyond the most basic of security principles. There is a reason they have the work qualification, because if you don't have experience you will probably be over your head. If you're truly interested in security, I would recommend thinking about not how you can get around the admission requirements and obtain some "degree", but how you can actually improve and broaden your security related knowledge.

  • @mrnap I have edited the question based on your observations. Thank you. ".. but how you can actually improve and broaden your security related knowledge..." Any recommendations?
    – Kim Stacks
    Mar 2, 2011 at 4:12
  • @keisimone Improving and broadening security related knowledge is generally done by getting a job doing such things. Usually grunt work...you know...the usual way everyone gets experience. Start at the bottom and work up. IT Security Intern is a great position for that.
    – Steve
    Mar 2, 2011 at 16:20
  • @keisimone Agreed with SteveS....the other recommendation I would have for you is to start reading textbooks ASAP. All my free time I have I spend reading texts on the various sec related subjects, and when I understand them I read reliable industry blogs to get up to speed on the cutting edge of exploits (exploit-db.com is a solid sight to explore once you've read some texts). Safari Tech Books Online is a good site, as well as Books 24x7 for large repositories of online tech book collections. If you want, I can recommend some individual titles.
    – mrnap
    Mar 3, 2011 at 5:20
  • 1
    @keismone, One cert is better than the other only in different contexts. I dont think anybody would argue that the CISSP is a good practical cert, whereas the GSEC (most GIAC certs for that matter) are. You are not going to just learn about what cryptography is, but you are going to get a practical understanding of the difference between symmetrical & asymmetrical, and what that means in a real-world environment. On the other hand, the CISSP is still what most HR dept are looking for, rather than any GIAC certs. – Josh Brower 2 hours ago Mar 3, 2011 at 15:35
  • 1
    @keisimone Hacker Techniques Tools and Incident Handling, 7 Most Deadliest Web Application Attacks, Web Application Obfuscation, Security Strategies in Web Applications and Social Networking, and Fundamentals of Information Systems Security are all good titles to start with. The Web App Obfuscation details some very recent vulnerabilities and new exploits, it's what I'm currently reading myself.
    – mrnap
    Mar 4, 2011 at 4:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .