Slashdot Mirror
Ask Slashdot: Worthwhile Security Training Courses?
ageoffri writes: I'm going to be able to take one, or maybe two, training courses next year and starting to figure out what would be a good course to take. While I'm not 100% sold on the concept of certs as the be-all and end-all of demonstrating knowledge and more importantly application of that knowledge, if someone else is going to pay for them I figure, Why not? Right now I'm leaning towards classes that have certs associated with them since HR drones look for letters. I also wouldn't mind a class that is just fun and interesting even if it isn't directly applicable to what I do currently. My short list is: CCSP by Training Camp (SEC503); Intrusion Detection In-Depth by SANS (GPPA cert); SEC504: Hacker Tools, Techniques, Exploits and Incident Handling (GCIH cert); and SEC550: Active Defense, Offensive Countermeasures and Cyber Deception (no cert). The first two directly apply to my day to day job. The third one just looks like fun, while the last one is also fun sounding, but I doubt I'd have much opportunity to put the skills to use. I'm curious what others here are thinking about for future training and other options to consider. I already have my CISSP, along with an MS in Information Assurance, so the two obvious choices are finished.
Get the OSCP.
Support my political activism on Patreon.
DO NOT USE THAT ONE!!!!!
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
You have a masters... will work pay for you to keep taking courses to get a PhD ?
Don't blame me, I voted for Kodos
Since no private sector job does training. You're welcome.
Also an option for fun/value
Offensive Security
https://www.offensive-security...
and a masters in CS
"I don't pitch OpenSUSE Linux to my friends, i let Microsoft do it for me
http://www.aspectsecurity.com/...
I've taken this class. Can't recommend it strongly enough.
Generalized security is mostly bullshit. It's all an inch deep over a broad area. For it to be worth a shit you need to be a specialist who understands a particular area and knows enough about it to understand how to secure it.
But as far as what bullshit security certification generates the most cash in your pocket? I'd guess CISSP.
I heard it's a great time to get in to security research
It's called hacking, once you get a few hundred under your belt, then you can call yourself a security professional.
The real answer is that it "depends". Like "What should I get my degree in if I want to head to Law School?" Well, are you going into criminal law, tax law, constitutional law? Theoretically it should not matter, but in practice a History major makes a better Constitutional lawyer where a Business/Accounting major will do much better in Tax law. So what do you plan to get out of the certification or class?
CEH is one of my favorites because it covers lots of the legal aspects of white hat hacking, while teaching you how to hack. The first is more in depth for the CISSP so should be the easy part. OSCP is similar to CEH in that it focuses on the hacking aspects (pen testing). If you are looking to be more independent you may wish to forgo additional "Security" related certifications and get a RHCE/RHCA to provide some clout in that direction. Then as you note there are numerous non certified training camps which are very good to have if you just want to learn. If you plan on Law enforcement you could focus on forensics, cryptography for intelligence, low level network monitoring (in depth Ethernet, TCP/IP inspection), etc.. etc...
Then there is the DOD/GOV side which has different rules and certifications. You can start by looking up DISA, JAFAN, NISPOM (should most get you to .mil sites).
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I took the SANS Intrusion Detection and Hacker Exploits courses 10+ years ago and they were very good. It was a long time ago, though, and I don't know what the courses are like now.
Vivek probably has more practical security knowledge than any other person on Earth and his courses are easy to follow, even for advanced concepts.
Did this in 2012. BRILLIANT. I'm not affiliated with Trustwave in any way and get nothing from saying this.
https://www.owasp.org/images/a/ac/Training_-_Hack_your_own_code.pdf
I've taken the intrusion detection and incident handling courses, with certs in both (still have the latter). When considering them, try to align with what you figure you'll be doing job-wise, if you know. The intrusion detection stuff was great for grubbing through packets to figure out what's going on, where the hacker tools and incident handling gives you some hands-on playing and knowledge you'll want for incident response. I wasn't doing any network monitoring in my role though, so didn't keep up the intrusion analyst cert, but I did love the course.
OST doesn't cater to all topics (yet), because it's volunteer driven. Its primary volunteers thus far have come from a deep system security background. Its assembly, OS/BIOS internals, exploits, and malware curriculum tracks are the most developed, and far deeper than anything you'll (ever) find at SANS, since OST is not commercial and therefore doesn't have to pander to popularity and buzzwords and try to deal with the never-ending churn of trying to put butts in seats.
OpenSecurityTraining.info/Training.html
Follow the new mil security and gov educational funding over the past decade. A lot of fancy public/private sector entry level university academic offerings quickly divert cyber or security course selection into only what the US gov or mil needs. The talking to good people with years of broad math, science, engineering skills and offering them the option to enter gov/mil contracts seems to have been replaced.
Pack entry level classes with students interested in security and pick the best in the open seems to be the new gov method.
The ability to pass background investigations, understand databases that connect public private partnerships and not talk about work will be the new 'security' skills.
A generation later and it will be a huge rush to create general broad academic skills again. As far as learning any one US branded OS or database, recall the free changes over the decade. The ability and background to learn and understand any new computer related idea vs a deep understanding of one traditional brands pay per seat, core expected market share.
Domestic spying is now "Benign Information Gathering"
https://community.spiceworks.com/topic/1245304-training-for-next-year
Take one good course and then take it again, but use the time as a vacation!
I just spoke to a recruiter in my company's MSSP division. Recommendations:
CISSP (you're all set)
OSCP
CEH
Tack on some SIEM certs or experience for good measure.
-- Stu
/. ID under 2,000. I feel old now.
I've been working as a security researcher for a large corp for 7 years now.
The only certificate I respect is NOP by immunity. All the rest are good to impress HR\management type of people.
The technical guys don't give a shit about CISSP and the rest of that BS certificates.