Questions tagged [certification]

We use the certification tag for questions about programs designed to vouch for an individual's competence in security-related work. Use the "compliance" tag for programs like PCI-DSS that assess the security of a server.

Filter by
Sorted by
Tagged with
0 votes
0 answers
29 views

Why does certification for datacenter equipment test for TEMPEST?

I wonder why certification (common criteria and stuff like that) of security critical hardware that is meant to be used in datacenters (e.g. link encryptors) includes some tests related to TEMPEST ...
user avatar
0 votes
1 answer
126 views

How to become a cybersecurity engineer [closed]

I want to become a cybersecurity engineer. Currently, I have a good knowledge of pentesting, programming(python, c++, bash, batch, powershell), networking, firewalls but something come to my mind. ...
user avatar
0 votes
0 answers
105 views

How to implement internal certification mechanism for my web applications?

Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
user avatar
1 vote
2 answers
799 views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
user avatar
  • 131
1 vote
0 answers
78 views

Get original text of Common Criteria protection profile [closed]

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...
user avatar
1 vote
1 answer
149 views

What are the (two?) definitions of SOC?

On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in ...
user avatar
0 votes
1 answer
121 views

Can CRL and CA Issuers urls contain spaces? [closed]

I am using OpenSSL For example, I have a CRL/CA Issuers URL that is like this: http://pki.example.com/Example Intermediate Certificate Authority.crl #CA Issuers caIssuers;URI.0 = http://pki.example....
user avatar
0 votes
1 answer
107 views

Is reading ISO 27000 official publication sufficient to prepare for exam? [closed]

I was at the ISO/IEC 27001 official web page. I saw a the publication for the norm. It's about 23 pages. So I was wondering if studying those 23 pages would prepare me enough, lets say at 80%, to ...
user avatar
0 votes
1 answer
664 views

Trusting CA Certificates by Thumbprint

Id like to create an application which trusts certificates issued from specific CAs. My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
user avatar
4 votes
1 answer
148 views

Practice question for Security+ that I think is wrong. Integrity vs availability

There is the following question on a practice test: Which service are you addressing by installing a RAID array and load balancer? A. Confidentiality B. Availability C. ...
user avatar
  • 212
0 votes
2 answers
343 views

CEH & Comptia Pentest+

I'm currently studying for the Comptia Security+ exam In few months from now, I will have the opportunity to attend a 4 months preparation course for CEH without paying! But I will not try to get the ...
user avatar
2 votes
4 answers
248 views

Why is the public key in a certificate not signed?

I have a naive question about certificates. I know the hash of the public key is signed with the CA's private key. I have an alternative design. Because the public key is being transmitted anyway, so ...
user avatar
0 votes
1 answer
154 views

Is Certification path construction algorithm needed for SSL/TLS?

In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party. However, I have also ...
user avatar
  • 15
0 votes
1 answer
1k views

Earning CPE for SANS/GIAC certification renewal through online courses [closed]

I am currently a holder of GIAC Security Essentials certificate (GSEC) that expires soon, so I'm looking for a way to renew this certificate in the most efficient way. GIAC Certification Renewal page ...
user avatar
2 votes
1 answer
316 views

Why is scanning considered a pre-attack and not reconnaissance?

I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading. In the CEH book, it states that: We can scan for a target using network tools (e.g. tarcert, ...
user avatar
0 votes
1 answer
104 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
user avatar
  • 101
1 vote
0 answers
80 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
user avatar
0 votes
2 answers
125 views

Certificates with no sysadmin skills?

I am coming from a web application developer career, so no sysadmin skills. But I also like security topics. I was wondering if after getting a certification such as GIAC, GPEN or EC Council CEH, or ...
user avatar
  • 1
1 vote
1 answer
119 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
user avatar
6 votes
1 answer
179 views

What Certification(s) to look for in Hard Drive destruction?

Many vendors exist to pick up old (enterprise) Hardware for recycling and offer services including sanitization and destruction (shredding). The concern is that media could potentially still ...
user avatar
  • 205
3 votes
2 answers
835 views

AppSec Developer Certifications

I've noticed that certifications seem to be a big part of the IT Security Professional (non-development), but have not seen the same attention being given/required of the software development engineer ...
user avatar
4 votes
2 answers
1k views

Can a security job be cracked without OSCP?

I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any ...
user avatar
  • 43
4 votes
1 answer
641 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
user avatar
2 votes
2 answers
189 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
user avatar
1 vote
0 answers
71 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
user avatar
1 vote
0 answers
104 views

Changing Horses Mid-Stream: A New Career in Technology [closed]

So, after a few years in the professional world of sales, I have finally stumbled onto something that I actually enjoy doing and being around: the wonderful world of IT. Perhaps I am crazy? Anyways, ...
user avatar
  • 11
25 votes
6 answers
4k views

How to start with an Information Security Program?

I am a software tester, InfoSec is mostly tangential to my job, and people only ask me questions about InfoSec because I am not afraid to use Google or Stack Exchange when I don't know something. (...
user avatar
1 vote
3 answers
283 views

Is there any Online Certification that is worthy enough to get a Job as a Security Professional? [closed]

I am highly interested in Network and Information Security and already a good understanding of Linux. I am also good at WiFi Penetration Testing and practice a lot of that. I am wondering that is ...
user avatar
  • 121
1 vote
1 answer
149 views

Industry Certification Question [duplicate]

I have been researching cybersecurity industry certifications for some time now and I am looking for some guidance/input on what combination of education, experience, and certification is best suited ...
user avatar
0 votes
2 answers
377 views

Will GCIH help me in my career path? [closed]

I am into non-functional (performance) testing for 12 years. I am planning to move to pen testing with GCIH certification. Can I get a fresh start in pen testing after this?
user avatar
1 vote
1 answer
2k views

Certification or Course equivalent to OSWE? [closed]

Is there any certification which focuses specifically on web application penetration, CWE issues and code analysis like Offensive Security Web Expert (OSWE) does? OSWE is not available online and it ...
user avatar
  • 93
3 votes
2 answers
172 views

Certification 27001 Issue

My department already got certification for ISO 27001:2013 last year (2016). But for a particular reason, my department should move to new building. How would be the status for my ISO 27001:2013 ...
user avatar
1 vote
0 answers
88 views

Does the value of security certifications for hiring/being hired decrease for more experienced positions? [closed]

In an industry where there are a dizzying array of security certifications to be had, many of them are either entry-level certifications, or are based around a particular area of specialization (...
user avatar
  • 71
2 votes
2 answers
188 views

How to ensure that a program is implemented as per your recommendation?

I have an security protocol whose implementation will be done by many third parties developers (lets call them as 'manufacturers') which in turn will be programmed in the embedded hardware designed by ...
user avatar
  • 21
0 votes
1 answer
131 views

Advice on career switch [closed]

I'm an IT technical writer with 6 years of experience looking to transition to a career in information security. I have good knowledge of software, databases, and cloud computing with a year or so of ...
user avatar
  • 1
-3 votes
1 answer
103 views

Secuirty related certification/training for .NET Developers [closed]

I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up, So that we can write secure code and also ...
user avatar
6 votes
2 answers
893 views

ISO 27001:2013 certification questions

Advice/opinion appreciated. Ultimately, our company would like to achieve ISO27001:2013 certification, but that is some way off. In the interim, we want to be able to get to the point whereby we can &...
user avatar
0 votes
1 answer
503 views

What kind of ISO 27k certifications can an individual get?

I heard that there are ISO 27K certifications. E.G. Info Security foundation based on ISO/IEC 27002. I am interested how it is possible to get a higher level, what kind of options there are to get iso ...
user avatar
3 votes
1 answer
4k views

ISSA vs ISACA vs (ISC)2 [closed]

I am an aspiring information security professional. I have asked various professionals in the community for advice and one common theme in responses to my inquiries is "Get to know the community!" ...
user avatar
  • 325
1 vote
1 answer
200 views

Why is my answer to this security exam prep question incorrect?

I'm studying for a security exam and am confused by one of the chapter review questions in the book I'm using. It reads: When scanning a network via a hardline connection to a wired-switch NIC ...
user avatar
  • 3,306
2 votes
0 answers
157 views

HIPAA/FISMA certification for IT audits [closed]

I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
user avatar
  • 330
6 votes
1 answer
403 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
user avatar
  • 1,089
2 votes
2 answers
5k views

What certifications do I need to become a Malware Analyst? [closed]

I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me on my resume and which one(s) should I get? ...
user avatar
0 votes
1 answer
175 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
user avatar
  • 9,490
-2 votes
2 answers
192 views

Which is first job or certificates [closed]

Here goes a question I have in my mind after I finish my study and start looking for a job. I have visited many recruiting websites and also clicked on many career tabs on companies websites. There ...
user avatar
2 votes
1 answer
241 views

help developer choose correct path to go down for security certifications [duplicate]

Sorry if this is a duplicate however I felt it was a little more unique than the answers I found. Basically I am a software developer and I have moved recently into an architecture role. Throughout my ...
user avatar
  • 445
8 votes
3 answers
9k views

Is industry experience the only way to a CREST certification?

I hope this question is direct enough for the stackexchange format, my apologies if it is not, please feel free to downvote to close. I'm interested in pursuing a CREST certification, however it ...
user avatar
  • 371
1 vote
1 answer
165 views

Security certification of software products: what about libraries or third-party services?

How the security certification works if the software uses third party libraries or services? E.g., if someone would like to certify a software product following Common Criteria standard (let's say, ...
user avatar
0 votes
3 answers
9k views

what are the best security certifications for beginners with no experience in IT [closed]

I want to make a career change from administration to IT but I have absolutely no experience and no certifications in IT. I am interested in information security and networking. So what certifications ...
user avatar
-1 votes
2 answers
290 views

Advice - When just starting your career, what are the best certifications to eyeball? [closed]

Im just starting out in school to study Network and Info Security. I know this is the field I want to invest my time and study into. Well over 200k security jobs went unfulfilled last year. My ...
user avatar