Cyber Security Certification & Courses

[Kung Fu Porkchop]

For the cyber security guys and people who know about this:

If I were looking at heading into cyber security as a profession, which certification and courses would you suggest I go for? What would be the best direction to head into?

 

[PPLdude]

Basic Linux knowledge already?

If yes, don't procrastinate with certs like eJPT. Get straight into OSCP.

 

[syntax]

For the cyber security guys and people who know about this:

If I were looking at heading into cyber security as a profession, which certification and courses would you suggest I go for? What would be the best direction to head into?

Which part of cybersecurity. There are a lot of different aspects each with their own knowledge and skills requirements
Also, not sure how much exposure you have had, but what the jobs are and what people think they are is very very different

 

[Kung Fu Porkchop]

Basic Linux knowledge already?

If yes, don't procrastinate with certs like eJPT. Get straight into OSCP.

I haven't worked on Linux in quite some time, so I'll have to get back into that

Which part of cybersecurity. There are a lot of different aspects each with their own knowledge and skills requirements
Also, not sure how much exposure you have had, but what the jobs are and what people think they are is very very different

Engineering and architecture, I think. I've thought about the whitehat hacking and pen-test thing too.

 

[syntax]

I haven't worked on Linux in quite some time, so I'll have to get back into that

Engineering and architecture, I think. I've thought about the whitehat hacking and pen-test thing too.

So like security solutions architecture?

Ive done a fair bit of that, its quite broad and depends where you will be working.
In some companies this has a wide net where you play a consultative role, do a strategic engagement on what they have, where they want to be, and then marry that to business requirements.
Finally you give a roadmap and then a design which turns into product and PS.

You would need to build up a skill set of things like CISSP, some cloud architecture certs and then knowledge of vendors, their pricing, their integration into other products etc. You need some netsec and appsec experience as well.

Offensive security you are likely to be pushed into something like OSCP. Valuable pen testing isnt just about testing apps and systems, but helping the customer do something useful with the info. Ive seen a lot of pen test reports where it shows how good the tester is and how they have broken through the security, and the remediation is quite specific on single focus areas. Whilst this helps, it is like discovering a wound and then recommending a band aid. A better approach is to determine why the wound occured, what can be done about it and fixing the decisions and processes that caused it.