Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [certification]

We use the certification tag for questions about programs designed to vouch for an individual's competence in security-related work. Use the "compliance" tag for programs like PCI-DSS that assess the security of a server.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

Making a safe certifcates system for an actions API [duplicate]

I have been working on a certificate system for use (as a means of authentication) with my accounts system APIs. I am still thinking out the details, I have only watched a few videos on asymmetric ...
0xENDER's user avatar
1 vote
1 answer
175 views

Is Google Drive compliant with control A.8.15 in ISO 27001:2022? [closed]

Is Google Drive compliant with control A.8.15 in ISO 27001:2022? As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
Jonathan Gagne's user avatar
0 votes
2 answers
3k views

What is the difference between a signed CSR and a leaf certificate?

When creating certificates with the step CLI I have the option to create a leaf certificate for a certain subject or sign a certificate signing request (CSR). I could not really determine a difference ...
Paul K's user avatar
  • 175
2 votes
1 answer
367 views

ISO 27001 and Subsidaries

I'm trying to write and implement an ISO 27001 compliant information security management system (ISMS) for the company I work for. Currently we have our HQ the UK (2 office locations plus a test site) ...
user282603's user avatar
0 votes
0 answers
100 views

Why does certification for datacenter equipment test for TEMPEST?

I wonder why certification (common criteria and stuff like that) of security critical hardware that is meant to be used in datacenters (e.g. link encryptors) includes some tests related to TEMPEST ...
Adomas Baliuka's user avatar
0 votes
1 answer
171 views

How to become a cybersecurity engineer [closed]

I want to become a cybersecurity engineer. Currently, I have a good knowledge of pentesting, programming(python, c++, bash, batch, powershell), networking, firewalls but something come to my mind. ...
Rui Barbosa's user avatar
0 votes
0 answers
137 views

How to implement internal certification mechanism for my web applications?

Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
Saeed MH's user avatar
1 vote
2 answers
4k views

Does certutil -delkey actually delete the certificate and private key?

I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
lee23's user avatar
  • 131
1 vote
0 answers
120 views

Get original text of Common Criteria protection profile [closed]

In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like "TOE security ...
Displayname's user avatar
1 vote
1 answer
189 views

What are the (two?) definitions of SOC?

On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in ...
PlasticCasio's user avatar
0 votes
1 answer
153 views

Is reading ISO 27000 official publication sufficient to prepare for exam? [closed]

I was at the ISO/IEC 27001 official web page. I saw a the publication for the norm. It's about 23 pages. So I was wondering if studying those 23 pages would prepare me enough, lets say at 80%, to ...
steven miller's user avatar
0 votes
1 answer
1k views

Trusting CA Certificates by Thumbprint

Id like to create an application which trusts certificates issued from specific CAs. My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
houtanf's user avatar
4 votes
1 answer
183 views

Practice question for Security+ that I think is wrong. Integrity vs availability

There is the following question on a practice test: Which service are you addressing by installing a RAID array and load balancer? A. Confidentiality B. Availability C. ...
IT_User's user avatar
  • 212
0 votes
2 answers
441 views

CEH & Comptia Pentest+

I'm currently studying for the Comptia Security+ exam In few months from now, I will have the opportunity to attend a 4 months preparation course for CEH without paying! But I will not try to get the ...
source_port's user avatar
2 votes
4 answers
465 views

Why is the public key in a certificate not signed?

I have a naive question about certificates. I know the hash of the public key is signed with the CA's private key. I have an alternative design. Because the public key is being transmitted anyway, so ...
user231806's user avatar
0 votes
1 answer
249 views

Is Certification path construction algorithm needed for SSL/TLS?

In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party. However, I have also ...
Ceesz's user avatar
  • 15
0 votes
1 answer
2k views

Earning CPE for SANS/GIAC certification renewal through online courses [closed]

I am currently a holder of GIAC Security Essentials certificate (GSEC) that expires soon, so I'm looking for a way to renew this certificate in the most efficient way. GIAC Certification Renewal page ...
Vlad Nikiforov's user avatar
2 votes
1 answer
374 views

Why is scanning considered a pre-attack and not reconnaissance?

I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading. In the CEH book, it states that: We can scan for a target using network tools (e.g. tarcert, ...
Sherlocker's user avatar
0 votes
1 answer
139 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
DDS's user avatar
  • 101
1 vote
0 answers
110 views

Certification courses from a novice to professional [closed]

I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
user3843150's user avatar
0 votes
2 answers
152 views

Certificates with no sysadmin skills?

I am coming from a web application developer career, so no sysadmin skills. But I also like security topics. I was wondering if after getting a certification such as GIAC, GPEN or EC Council CEH, or ...
steve's user avatar
  • 1
1 vote
1 answer
144 views

Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS

Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
Kevin Kammer's user avatar
6 votes
1 answer
227 views

What Certification(s) to look for in Hard Drive destruction?

Many vendors exist to pick up old (enterprise) Hardware for recycling and offer services including sanitization and destruction (shredding). The concern is that media could potentially still ...
bfloriang's user avatar
  • 205
3 votes
2 answers
909 views

AppSec Developer Certifications

I've noticed that certifications seem to be a big part of the IT Security Professional (non-development), but have not seen the same attention being given/required of the software development engineer ...
danutz_plusplus's user avatar
4 votes
2 answers
1k views

Can a security job be cracked without OSCP?

I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any ...
lakshmi's user avatar
  • 43
4 votes
1 answer
868 views

What are vendor affirmed algorithms in FIPS 140-2

FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
Shashank V's user avatar
2 votes
2 answers
226 views

Conflicting requirements in FIPS 140-2 regarding manual key entry

Requirement 1 All output data exiting the cryptographic module via the "data output" interface shall only pass through the output data path. The output data path shall be logically disconnected ...
Shashank V's user avatar
1 vote
0 answers
97 views

Are protocol implementations also tested as part of FIPS certification?

I just went to CMVP website and opened a random FIPS certificate. https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898 In the FIPS certificate, FIPS algorithms ...
Shashank V's user avatar
1 vote
0 answers
127 views

Changing Horses Mid-Stream: A New Career in Technology [closed]

So, after a few years in the professional world of sales, I have finally stumbled onto something that I actually enjoy doing and being around: the wonderful world of IT. Perhaps I am crazy? Anyways, ...
Oberon's user avatar
  • 11
25 votes
6 answers
5k views

How to start with an Information Security Program?

I am a software tester, InfoSec is mostly tangential to my job, and people only ask me questions about InfoSec because I am not afraid to use Google or Stack Exchange when I don't know something. (...
Amedee Van Gasse's user avatar
1 vote
3 answers
316 views

Is there any Online Certification that is worthy enough to get a Job as a Security Professional? [closed]

I am highly interested in Network and Information Security and already a good understanding of Linux. I am also good at WiFi Penetration Testing and practice a lot of that. I am wondering that is ...
Ateeb's user avatar
  • 121
1 vote
1 answer
178 views

Industry Certification Question [duplicate]

I have been researching cybersecurity industry certifications for some time now and I am looking for some guidance/input on what combination of education, experience, and certification is best suited ...
BoogieMan2718's user avatar
0 votes
2 answers
476 views

Will GCIH help me in my career path? [closed]

I am into non-functional (performance) testing for 12 years. I am planning to move to pen testing with GCIH certification. Can I get a fresh start in pen testing after this?
PrashantMP's user avatar
1 vote
1 answer
2k views

Certification or Course equivalent to OSWE? [closed]

Is there any certification which focuses specifically on web application penetration, CWE issues and code analysis like Offensive Security Web Expert (OSWE) does? OSWE is not available online and it ...
Sum's user avatar
  • 113
4 votes
2 answers
202 views

Certification 27001 Issue

My department already got certification for ISO 27001:2013 last year (2016). But for a particular reason, my department should move to new building. How would be the status for my ISO 27001:2013 ...
user155860's user avatar
1 vote
0 answers
114 views

Does the value of security certifications for hiring/being hired decrease for more experienced positions? [closed]

In an industry where there are a dizzying array of security certifications to be had, many of them are either entry-level certifications, or are based around a particular area of specialization (...
Jason's user avatar
  • 101
2 votes
2 answers
216 views

How to ensure that a program is implemented as per your recommendation?

I have an security protocol whose implementation will be done by many third parties developers (lets call them as 'manufacturers') which in turn will be programmed in the embedded hardware designed by ...
mk09's user avatar
  • 121
0 votes
1 answer
157 views

Advice on career switch [closed]

I'm an IT technical writer with 6 years of experience looking to transition to a career in information security. I have good knowledge of software, databases, and cloud computing with a year or so of ...
JN1212's user avatar
  • 1
-3 votes
1 answer
131 views

Secuirty related certification/training for .NET Developers [closed]

I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up, So that we can write secure code and also ...
Guru Kara's user avatar
6 votes
2 answers
922 views

ISO 27001:2013 certification questions

Advice/opinion appreciated. Ultimately, our company would like to achieve ISO27001:2013 certification, but that is some way off. In the interim, we want to be able to get to the point whereby we can &...
Garreth McDaid's user avatar
0 votes
1 answer
538 views

What kind of ISO 27k certifications can an individual get?

I heard that there are ISO 27K certifications. E.G. Info Security foundation based on ISO/IEC 27002. I am interested how it is possible to get a higher level, what kind of options there are to get iso ...
CsabaHegedus's user avatar
3 votes
1 answer
5k views

ISSA vs ISACA vs (ISC)2 [closed]

I am an aspiring information security professional. I have asked various professionals in the community for advice and one common theme in responses to my inquiries is "Get to know the community!" ...
ma77c's user avatar
  • 345
1 vote
1 answer
240 views

Why is my answer to this security exam prep question incorrect?

I'm studying for a security exam and am confused by one of the chapter review questions in the book I'm using. It reads: When scanning a network via a hardline connection to a wired-switch NIC ...
Mike B's user avatar
  • 3,458
2 votes
0 answers
179 views

HIPAA/FISMA certification for IT audits [closed]

I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
POSH Geek's user avatar
  • 320
6 votes
1 answer
478 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
user1563721's user avatar
  • 1,119
2 votes
2 answers
5k views

What certifications do I need to become a Malware Analyst? [closed]

I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started. How much do certifications help me on my resume and which one(s) should I get? ...
Nick Williams's user avatar
0 votes
1 answer
202 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
SEJPM's user avatar
  • 9,780
-1 votes
2 answers
215 views

Which is first job or certificates [closed]

Here goes a question I have in my mind after I finish my study and start looking for a job. I have visited many recruiting websites and also clicked on many career tabs on companies websites. There ...
user1794499's user avatar
2 votes
1 answer
263 views

help developer choose correct path to go down for security certifications [duplicate]

Sorry if this is a duplicate however I felt it was a little more unique than the answers I found. Basically I am a software developer and I have moved recently into an architecture role. Throughout my ...
OliverBS's user avatar
  • 435
8 votes
3 answers
9k views

Is industry experience the only way to a CREST certification?

I hope this question is direct enough for the stackexchange format, my apologies if it is not, please feel free to downvote to close. I'm interested in pursuing a CREST certification, however it ...
AlexH's user avatar
  • 371