certifications for ethical hacking
p-coder
Member Posts: 21 ■■■□□□□□□□
Hi everyone,
I am currently doing a course in full-stack Ruby on Rails software development, but lately I have started to become interested in ethical hacking. Since I do not have much background in IT, would it be a good idea for me to start with certifications like the CompTIA A+, Network+, and Security+? What other certifications should I get for ethical hacking?
At what point would I be able to find entry-level positions in the security field?
I am currently doing a course in full-stack Ruby on Rails software development, but lately I have started to become interested in ethical hacking. Since I do not have much background in IT, would it be a good idea for me to start with certifications like the CompTIA A+, Network+, and Security+? What other certifications should I get for ethical hacking?
At what point would I be able to find entry-level positions in the security field?
Comments
-
UnixGuy
Mod Posts: 4,570 Mod
Search the forums, they're full of similar threads.
eLearnSecurity, OSCP, GPEN -
iBrokeIT
Member Posts: 1,318 ■■■■■■■■■□
I suggest that you start visiting the job boards so you can actually see for yourself what skills, certs and other demands employers have for candidates...2019: GPEN | GCFE | GXPN | GICSP | CySA+
2020: GCIP | GCIA
2021: GRID | GDSA | Pentest+
2022: GMON | GDAT
2023: GREM | GSE | GCFA
WGU BS IT-NA | SANS Grad Cert: PT&EH | SANS Grad Cert: ICS Security | SANS Grad Cert: Cyber Defense Ops | SANS Grad Cert: Incident Response -
E Double U
Member Posts: 2,233 ■■■■■■■■■■
Nobody gonna mention EC-Council Certified Ethical Hacker?
I'm going to report this post as abuse.Alphabet soup from (ISC)2, ISACA, GIAC, EC-Council, Microsoft, ITIL, Cisco, Scrum, CompTIA, AWS -
JDMurray
Admin Posts: 13,091 Admin
Awwwww...hey, I'm teaching a CEHv9 course in a couple of months. There's a lot of good information in there. It's just the pricing that's hard to swallow. -
NetworkNewb
Member Posts: 3,298 ■■■■■■■■■□
Not only price, I think the requirements to take this exam is ridiculous too. They could get so many more people if they removed those and just sold the course for it separately. I have very hard time believing they are making as much as they could from this cert. -
Chinook
Member Posts: 206
Awwwww...hey, I'm teaching a CEHv9 course in a couple of months. There's a lot of good information in there. It's just the pricing that's hard to swallow.
I agree. This forum often maligns the C|EH, but I think it's a good introductory ethical hacker course. The content isn't the problem; the cost is. Nearly 2 grand in training for a basic understanding of the tool set, social engineer, etc isn't worth it. You'd be better spending the money taking online learning courses & actually doing. -
JDMurray
Admin Posts: 13,091 Admin
NetworkNewb wrote: »Not only price, I think the requirements to take this exam is ridiculous too. They could get so many more people if they removed those and just sold the course for it separately. I have very hard time believing they are making as much as they could from this cert.
Remember that the target market for the CEH are organizations who will pay to train and certify their people in cybersecurity. There is more money in certifying people en masse from organizational budgets than from the individuals that randomly wander in from the street. The non-training requirements (i.e., $600 and two years of information security experience) is used to keep up the perceived value of the cert (e.g., the training appears to be worthy of two years of InfoSec experience, and the CEH must be worth something if it's that costly to obtain). -
BuzzSaw
Member Posts: 259 ■■■□□□□□□□
is used to keep up the perceived value of the cert (e.g., the training appears to be worthy of two years of InfoSec experience, and the CEH must be worth something if it's that costly to obtain).
I agree with this. Coming from a person who did "wander in from the street" so to speak, I can say one of the appeals is that not everyone is going to achieve this. Granted, that could have more to do with the barrier to admittance more than the "difficulty" of the exam. However, the fact still stands that, by and large, the CEH is a rarity and can be a big plus on a resume.
I took the test without official training, and having to prove my experience, pay additional fees, and jump through all the hoops. Personally, I sort of liked the vetting process, even if it was A LOT of money, and a major PITA. However, as you said, I think the "perceived" value is still something that is "worth" buying into. (I say "perceived" for a reason) - I think something like the OSCP is probably much more valuable as a whole, but the perceived value isn't there yet.
Curious, ISC has a pretty tight vetting process, along with membership dues, endorsement process, etc ... Most people don't scrutinize them as much as ECCouncil.I agree. This forum often maligns the C|EH, but I think it's a good introductory ethical hacker course. The content isn't the problem; the cost is. Nearly 2 grand in training for a basic understanding of the tool set, social engineer, etc isn't worth it. You'd be better spending the money taking online learning courses & actually doing.
Agreed. 2 grand for training that would equal the CEH would be a bit much. But I do think the vetting process to sit for the exam without the training makes it obtainable at a somewhat reasonable rate (100.00 + 600.00 I believe). I also think it gives you a nice little edge in the fact that you have the chops without a specific course. -
BuzzSaw
Member Posts: 259 ■■■□□□□□□□
Back to the topic at hand:Hi everyone,
I am currently doing a course in full-stack Ruby on Rails software development, but lately I have started to become interested in ethical hacking. Since I do not have much background in IT, would it be a good idea for me to start with certifications like the CompTIA A+, Network+, and Security+? What other certifications should I get for ethical hacking?
At what point would I be able to find entry-level positions in the security field?
I think its going to depend greatly on if you want to go into pentesting, or security in general. I think starting with something like Security+ and SSCP would be a great starting point. It's also going to force you into learning alot of the basics that the CEH builds on. From there, if you REALLY want to get into pentesting, CEH would be a good intro (assuming your okay with the price point). Other great options from there would be: GPEN, and once you have some experience OSCP.
Overall, I think you would probably have better luck (and immediate success) with some of the more entry level certs like Security+ and SSCP. Sometimes quick wins can help win the long term battle. -
chrisone
Member Posts: 2,278 ■■■■■■■■■□
Awwwww...hey, I'm teaching a CEHv9 course in a couple of months. There's a lot of good information in there. It's just the pricing that's hard to swallow.
Its a pretty good entry level exam , knowledge wise. Price wise? ughhhh......Certs: CISSP, EnCE, OSCP, CRTP, eCTHPv2, eCPPT, eCIR, LFCS, CEH, SPLK-1002, SC-200, SC-300, AZ-900, AZ-500, VHL:Advanced+
2023 Cert Goals: SC-100, eCPTX -
UnixGuy
Mod Posts: 4,570 Mod
I will always recommend eLearnSecurity eJPT over CEH. Much MUCH cheaper, and fully practical - nothing beats hands on learning
-
varelg
Banned Posts: 790
CEH's website was hacked recently, if I'm not mistaken. And it wasn't ethical at all. -
devilbones
Member Posts: 318 ■■■■□□□□□□
They encourage you to hack their website.CEH's website was hacked recently, if I'm not mistaken. And it wasn't ethical at all. -
Chinook
Member Posts: 206
I will always recommend eLearnSecurity eJPT over CEH. Much MUCH cheaper, and fully practical - nothing beats hands on learning
I completely agree. I'd also add in Offensive Security's offerings as a way of getting practical experience in pen testing. Toss in learning Wireshark as well. -
p-coder
Member Posts: 21 ■■■□□□□□□□
Thank you all for the helpful comments and not banning our moderator.
Overall, I think you would probably have better luck (and immediate success) with some of the more entry level certs like Security+ and SSCP. Sometimes quick wins can help win the long term battle.
I agree that getting some quick wins would be helpful to get started. As for certifications like A+ and Network+, I get the impression that they are not specifically needed for ethical hacking, although it might not be a bad idea to study them for general knowledge without actually taking the exams.
At any rate, I will look into some of the cheaper certifications like eLearnSecurity eJPT and Offensive Security's offerings for hands on learning. -
BuzzSaw
Member Posts: 259 ■■■□□□□□□□
Thank you all for the helpful comments and not banning our moderator.
I agree that getting some quick wins would be helpful to get started. As for certifications like A+ and Network+, I get the impression that they are not specifically needed for ethical hacking, although it might not be a bad idea to study them for general knowledge without actually taking the exams.
At any rate, I will look into some of the cheaper certifications like eLearnSecurity eJPT and Offensive Security's offerings for hands on learning.
I agree. I think A+ is probably one you could pass over
Network + isnt needed, but it would sure help in understanding the basics of why certain attacks work as well as they do! -
TechGromit
Member Posts: 2,156 ■■■■■■■■■□
Awwwww...hey, I'm teaching a CEHv9 course in a couple of months. There's a lot of good information in there. It's just the pricing that's hard to swallow.
Even free is too much.
Still searching for the corner in a round room.
