what are the best security certifications for beginners with no experience in IT [closed]

Question

I want to make a career change from administration to IT but I have absolutely no experience and no certifications in IT. I am interested in information security and networking. So what certifications do I need to begin with?

Answer 1

A+ Build your own machines. Seriously. Do it so you can do the next step.

Network+ Build your own subnetted home network with a domain controller and a two-way transitive trust between your home and your friend's home. That'll get you started.

Security+ Harden the expletive out of what you just built in the last step and then break it yourself! =D

In all seriousness though, you really do have a lot of things to learn and to accomplish. I too am relatively new to IT Security, and I have a long journey ahead of me. You'll want to learn how to use some variant of Linux if you haven't already, and a few programming/scripting languages, like java, php, ruby, C++ etc. It's a huge body of knowledge, and eventually you'll find where you want to settle.

Answer 2

Security+ covers the basics pretty well and as long as the positions you are looking at aren't heavy duty and you have other skills that the employer would be interested in should be enough for at least an interview. Make sure you can speak to the security questions given in the interview clearly and concisely or this, or any other, certification won't help though.

Answer 3

Any of my friends who ask this question, I strongly advise them to not turn their back on their former occupation. People with dual-disciplines are valuable and rare. "Administration" is very broad, but you're probably aware of aspects of the field which need improvement and are directly applicable to IT.

Consider what skills you have which may already be useful. If you're doing analytical work, applying your skills to security analyst roles could help you get your foot in the door and use your existing skills. You might not be the super-tech, but your ability to speak with senior management may be above the rest of your team.

If you're doing administration policy work and understand how to navigate a business, can speak and write effectively and manage timelines and projects, then moving towards audit work could be a good direction.

The CISSP is a mostly non-technical certification which is still respected and broad. It can give you a very good understanding of the different aspects of IT security and could be vital as a credential whether you go tech-heavy or policy heavy in infosec.

The cert takes 5 years experience, but you can get their "associate" level without it, then convert it to a full cert within 6 years.

But if you go in cold and compete head-to-head with kids on technical work, you're wasting your skills and putting yourself at a disadvantage for no good reason. The jobs follow the passion in this area. Few people get into it without being passionate, and some who are passionate don't make the cut.

I should add... speak to your company's IT department and your manager, if you're at a large organization, they may have projects to do user acceptance testing on rollouts. This can be a very gentle way to get a sense as to how some aspects of IT operate, and if you get the ear of people who deploy systems relevant for your job, if you shine in the testing process and make lots of contacts with outside consulting companies, you might find an angle towards a future role which will use your skills and experience. If it's a security related rollout (e.g., proxy servers, access control systems) , it might even count as years of experience for your CISSP.