Questions tagged [certification]
We use the certification tag for questions about programs designed to vouch for an individual's competence in security-related work. Use the "compliance" tag for programs like PCI-DSS that assess the security of a server.
95
questions
1
vote
1
answer
93
views
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
Is Google Drive compliant with control A.8.15 in ISO 27001:2022?
As ISO 27001 requirements for logging and monitoring, are Event logging, Log storage, Protection of logs, and Analysis of logs, could I ...
- 111
0
votes
2
answers
1k
views
What is the difference between a signed CSR and a leaf certificate?
When creating certificates with the step CLI I have the option to create a leaf certificate for a certain subject or sign a certificate signing request (CSR). I could not really determine a difference ...
- 175
2
votes
1
answer
234
views
ISO 27001 and Subsidaries
I'm trying to write and implement an ISO 27001 compliant information security management system (ISMS) for the company I work for. Currently we have our HQ the UK (2 office locations plus a test site) ...
- 21
0
votes
0
answers
58
views
Why does certification for datacenter equipment test for TEMPEST?
I wonder why certification (common criteria and stuff like that) of security critical hardware that is meant to be used in datacenters (e.g. link encryptors) includes some tests related to TEMPEST ...
- 109
0
votes
1
answer
139
views
How to become a cybersecurity engineer [closed]
I want to become a cybersecurity engineer. Currently, I have a good knowledge of pentesting, programming(python, c++, bash, batch, powershell), networking, firewalls but something come to my mind. ...
0
votes
0
answers
113
views
How to implement internal certification mechanism for my web applications?
Our company develops web applications and uses them on the internal network. We need to set up a mechanism to control and monitor internal network traffic so that only approved applications on the ...
- 1
1
vote
2
answers
3k
views
Does certutil -delkey actually delete the certificate and private key?
I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command ...
- 131
1
vote
0
answers
95
views
Get original text of Common Criteria protection profile [closed]
In translated from an English profile, combined from a couple of profiles (I found that one is Protection Profile for Application Software v1.2 of NIAP) I have something like
"TOE security ...
- 11
1
vote
1
answer
163
views
What are the (two?) definitions of SOC?
On one hand "Security Operations Centre", but SOC is seemingly used in the reporting and certification domain, where does this come from? Is there another (or more) definitions of SOC in ...
- 93
0
votes
1
answer
125
views
Is reading ISO 27000 official publication sufficient to prepare for exam? [closed]
I was at the ISO/IEC 27001 official web page. I saw a the publication for the norm. It's about 23 pages. So I was wondering if studying those 23 pages would prepare me enough, lets say at 80%, to ...
0
votes
1
answer
1k
views
Trusting CA Certificates by Thumbprint
Id like to create an application which trusts certificates issued from specific CAs.
My ideas is to have a list of thumbprints for CA certificates I trust. Then whenever my app receives a certificate ...
- 3
4
votes
1
answer
160
views
Practice question for Security+ that I think is wrong. Integrity vs availability
There is the following question on a practice test:
Which service are you addressing by installing a RAID array and load
balancer?
A. Confidentiality
B. Availability
C. ...
- 212
0
votes
2
answers
383
views
CEH & Comptia Pentest+
I'm currently studying for the Comptia Security+ exam
In few months from now, I will have the opportunity to attend a 4 months preparation course for CEH without paying! But I will not try to get the ...
2
votes
4
answers
402
views
Why is the public key in a certificate not signed?
I have a naive question about certificates. I know the hash of the public key is signed with the CA's private key. I have an alternative design. Because the public key is being transmitted anyway, so ...
- 21
0
votes
1
answer
212
views
Is Certification path construction algorithm needed for SSL/TLS?
In the TLS Handshake a Certificate message is sent. This message contains the (chain of) certificates needed to validate the provided certificate of the communicating party.
However, I have also ...
- 15
0
votes
1
answer
2k
views
Earning CPE for SANS/GIAC certification renewal through online courses [closed]
I am currently a holder of GIAC Security Essentials certificate (GSEC) that expires soon, so I'm looking for a way to renew this certificate in the most efficient way.
GIAC Certification Renewal page ...
- 2,023
2
votes
1
answer
346
views
Why is scanning considered a pre-attack and not reconnaissance?
I am studying for a CEH certificate. I have a question about a simple quiz and a book that I am reading.
In the CEH book, it states that:
We can scan for a target using network tools (e.g. tarcert, ...
- 113
0
votes
1
answer
117
views
Guidelines to make Windows Server 2008 Common Criteria Installation
I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment.
What are / where can I find a guide to WS2008 CC-...
- 101
1
vote
0
answers
86
views
Certification courses from a novice to professional [closed]
I would like to know the list of certification courses that I can start as a beginner and become proficient in the field of network security and from which website or institution can I take the ...
- 11
0
votes
2
answers
131
views
Certificates with no sysadmin skills?
I am coming from a web application developer career, so no sysadmin skills. But I also like security topics.
I was wondering if after getting a certification such as GIAC, GPEN or EC Council CEH, or ...
- 1
1
vote
1
answer
124
views
Is a bank's affiliate that provides services to the bank issuer required to show compliance or certification to PCI DSS
Is a bank's affiliate that provides services to the bank issuer required to demonstrate compliance or certification to PCI DSS? If so, how is this typically done?
- 11
6
votes
1
answer
196
views
What Certification(s) to look for in Hard Drive destruction?
Many vendors exist to pick up old (enterprise) Hardware for recycling and offer services including sanitization and destruction (shredding).
The concern is that media could potentially still ...
- 205
3
votes
2
answers
886
views
AppSec Developer Certifications
I've noticed that certifications seem to be a big part of the IT Security Professional (non-development), but have not seen the same attention being given/required of the software development engineer ...
4
votes
2
answers
1k
views
Can a security job be cracked without OSCP?
I have my B.Tech in Information Technology with CEHv8 certification. I have 2 years of vulnerability assessment experience and 1.5 years of python automation experience. I am not able to crack any ...
- 43
4
votes
1
answer
804
views
What are vendor affirmed algorithms in FIPS 140-2
FIPS 140-2 allows FIPS approved algorithms to be either tested by CAVP or to be vendor affirmed. What does "vendor affirmed" imply here? Can I say my AES implementation as vendor affirmed and get it ...
- 183
2
votes
2
answers
199
views
Conflicting requirements in FIPS 140-2 regarding manual key entry
Requirement 1
All output data exiting the cryptographic module via the "data output"
interface shall only pass through the output data path. The output data path shall be logically disconnected
...
- 183
1
vote
0
answers
76
views
Are protocol implementations also tested as part of FIPS certification?
I just went to CMVP website and opened a random FIPS certificate.
https://csrc.nist.gov/Projects/Cryptographic-Module-Validation-Program/Certificate/2898
In the FIPS certificate, FIPS algorithms ...
- 183
1
vote
0
answers
108
views
Changing Horses Mid-Stream: A New Career in Technology [closed]
So, after a few years in the professional world of sales, I have finally stumbled onto something that I actually enjoy doing and being around: the wonderful world of IT. Perhaps I am crazy? Anyways, ...
- 11
25
votes
6
answers
5k
views
How to start with an Information Security Program?
I am a software tester, InfoSec is mostly tangential to my job, and people only ask me questions about InfoSec because I am not afraid to use Google or Stack Exchange when I don't know something. (...
- 369
1
vote
3
answers
291
views
Is there any Online Certification that is worthy enough to get a Job as a Security Professional? [closed]
I am highly interested in Network and Information Security and already a good understanding of Linux. I am also good at WiFi Penetration Testing and practice a lot of that.
I am wondering that is ...
- 121
1
vote
1
answer
157
views
Industry Certification Question [duplicate]
I have been researching cybersecurity industry certifications for some time now and I am looking for some guidance/input on what combination of education, experience, and certification is best suited ...
0
votes
2
answers
431
views
Will GCIH help me in my career path? [closed]
I am into non-functional (performance) testing for 12 years. I am planning to move to pen testing with GCIH certification. Can I get a fresh start in pen testing after this?
1
vote
1
answer
2k
views
Certification or Course equivalent to OSWE? [closed]
Is there any certification which focuses specifically on web application penetration, CWE issues and code analysis like Offensive Security Web Expert (OSWE) does? OSWE is not available online and it ...
- 113
3
votes
2
answers
180
views
Certification 27001 Issue
My department already got certification for ISO 27001:2013 last year (2016). But for a particular reason, my department should move to new building. How would be the status for my ISO 27001:2013 ...
- 31
1
vote
0
answers
93
views
Does the value of security certifications for hiring/being hired decrease for more experienced positions? [closed]
In an industry where there are a dizzying array of security certifications to be had, many of them are either entry-level certifications, or are based around a particular area of specialization (...
- 81
2
votes
2
answers
195
views
How to ensure that a program is implemented as per your recommendation?
I have an security protocol whose implementation will be done by many third parties developers (lets call them as 'manufacturers') which in turn will be programmed in the embedded hardware designed by ...
- 121
0
votes
1
answer
139
views
Advice on career switch [closed]
I'm an IT technical writer with 6 years of experience looking to transition to a career in information security. I have good knowledge of software, databases, and cloud computing with a year or so of ...
- 1
-3
votes
1
answer
113
views
Secuirty related certification/training for .NET Developers [closed]
I would like to know if there are any Free certifications related to writing secure code that myself and our team of .NET/AngularJS web-developers take up,
So that we can write secure code and also ...
- 95
6
votes
2
answers
906
views
ISO 27001:2013 certification questions
Advice/opinion appreciated.
Ultimately, our company would like to achieve ISO27001:2013 certification, but that is some way off. In the interim, we want to be able to get to the point whereby we can &...
- 161
0
votes
1
answer
514
views
What kind of ISO 27k certifications can an individual get?
I heard that there are ISO 27K certifications. E.G. Info Security foundation based on ISO/IEC 27002. I am interested how it is possible to get a higher level, what kind of options there are to get iso ...
3
votes
1
answer
5k
views
ISSA vs ISACA vs (ISC)2 [closed]
I am an aspiring information security professional. I have asked various professionals in the community for advice and one common theme in responses to my inquiries is "Get to know the community!" ...
- 345
1
vote
1
answer
215
views
Why is my answer to this security exam prep question incorrect?
I'm studying for a security exam and am confused by one of the chapter review questions in the book I'm using. It reads:
When scanning a network via a hardline connection to a wired-switch
NIC ...
- 3,448
2
votes
0
answers
161
views
HIPAA/FISMA certification for IT audits [closed]
I currently work for an IT security company that is looking to expand our services offered to clients. Two avenues we are looking at is reviewing FISMA and HIPAA compliance for our clients. I have ...
- 330
6
votes
1
answer
452
views
Who can certify RNG according NIST SP800-22?
I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite.
Now I would like to get a certification to have a formal proof that my C library generates ...
- 1,119
2
votes
2
answers
5k
views
What certifications do I need to become a Malware Analyst? [closed]
I've previously posted here on how to get started as a malware analyst, and wanted to say thanks on getting me started.
How much do certifications help me on my resume and which one(s) should I get? ...
0
votes
1
answer
184
views
FIPS 201(-2): Central requirements for PIV?
I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed.
I understand that FIPS ...
- 9,720
-1
votes
2
answers
199
views
Which is first job or certificates [closed]
Here goes a question I have in my mind after I finish my study and start looking for a job.
I have visited many recruiting websites and also clicked on many career tabs on companies websites.
There ...
- 31
2
votes
1
answer
248
views
help developer choose correct path to go down for security certifications [duplicate]
Sorry if this is a duplicate however I felt it was a little more unique than the answers I found. Basically I am a software developer and I have moved recently into an architecture role. Throughout my ...
- 435
8
votes
3
answers
9k
views
Is industry experience the only way to a CREST certification?
I hope this question is direct enough for the stackexchange format, my apologies if it is not, please feel free to downvote to close.
I'm interested in pursuing a CREST certification, however it ...
- 371
1
vote
1
answer
175
views
Security certification of software products: what about libraries or third-party services?
How the security certification works if the software uses third party libraries or services?
E.g., if someone would like to certify a software product following Common Criteria standard (let's say, ...
- 260