Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
After a lot of googling and searches on forums, it was apparent that certificates like CEH and CISSP incorporated a lot of theory in them and were useful as an added for a job.
Are there any certificates that give real-time practice with the system during training or a learning process that includes practical working (certificates that will give working knowledge)?
What about Red Hat certs or Cisco certs?
I think one of the most hands on security certifications out there is Offensive Security Certified Professional/Expert. The exam involves executing a penetration test and delivering a report on which you will get quoted. Now this certificate is aimed at attack and penetration testers, if your job is to administer Cisco equipment you should look into CCNAS or CCNPS.
There is also SANS but to be honest they are a bit expensive. The trainings are good though.
Have you tried Matasano Crypto Challenges? Here's a good review from the PinBoard Blog:
I mentioned earlier that I thought every web programmer should try their hand at these. It is very illuminating to look at your own web app from the vantage point of an attacker actually writing code. At the very least, you will never be confused about cipher block modes again, or have to worry that someone will ask you to explain how a public key works in an interview. And there is a whole slew of dumb mistakes you will now avoid (replacing them with smarter mistakes that will become the subject matter of challenges 48-96).
Also, Cody Brocious from Accuvan LABS AppSec Team is running the Breaker 101 course:
The majority of the coursework will be styled as a CTF (capture the flag). In essence, you will be breaking from day one and putting these attacks in practice. The exceptions are some of the crypto and the secure architecture/threat modeling portions of the course. These will be graded for your benefit but do not count towards your score.
Exams are largely practical as well, but will be more open-ended, as you will see in real-world security testing.
If you're looking for a hands-on Penetration Testing certification, there is really no better alternative than the OSCP. (Perhaps some of the SANs classess are strong as well, but I can't speak to those from experience). Although once you have an OCSP you can not call yourself a Pen-Testing expert, it will definitely help you start down that route.
Nowadays certifications such as CEH Practical are really a great start for beginners. It does not carry the burden of OSCP, nor does it come with the excessive theory of its older sibling the CEH(ANSI). It is cheaper than both the OSCP and CEH(ANSI) but sits somewhere in the middle. For hands-on experience and practice for the CEH Practical, please check EC-Council's iLabs platform.
CISSP is good if you have worked for a while and are looking to clinch a managerial role, then you could consider that.
