Certification path advice - CISSP to C|EH / OCSP

SecurecallSecurecall Junior MemberRegistered Users Posts: 1 ■□□□□□□□□□
in Other Security Certifications
I've recently got back on the certification track after taking and passing my CISSP yesterday, and am keen to keep the momentum as far as keeping learning and working on my certifications (getting back to the technical ones), and am looking for some advice on where to go next, ideally from the people who have both a C|EH and OSCP.

I've worked as a Firewall and Network administrator now for 10+ years and would like to learn some skills from the other side of firewall, and I have my eye on the OSCP, a cert that seems to carry a bit of respect, and offers a learning track thats really going to give you some real world skills. Ive started to take some small steps (very small steps, Cybrary course) into learning to code in Python, with an eye on the long term.

The question I have, is it worth me studying for and taking the C|EH to get the basic knowledge, or is this just a waste of time and effort because the OSCP will teach me everything I will learn in the C|EH and more? Appreciate there is the HR department being the 1st line of defence angle as far as the C|EH is concerned, so I'm guessing it should be on the list. But for now, I am keen on personal development. Any advice on this path would be appreciated.

Cheers
· Share on FacebookShare on Twitter

Comments

  • UnixGuyUnixGuy Are we having fun yet? Mod Posts: 4,503 Mod
    Skip CEH and anything EC-Council. Try eLearnSecurity and SANS (if your employer pays for it)
    Certs: GSTRT, GPEN, GCFA, CISM, CRISC, RHCE

    Check out my YouTube Channel!

    · Share on FacebookShare on Twitter
  • shoeyshoey Senior Member Member Posts: 111 ■■■□□□□□□□
    I agree with UnixGuy. You will be kicking yourself when you get to the OSCP and realize what the C|EH didn't do for you...

    If you search through the OSCP threads on here you'll find plenty of free resources to study that will better prepare you then speding time/money on the C|EH...
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
    · Share on FacebookShare on Twitter
  • HCPS123HCPS123 Member Member Posts: 54 ■■■□□□□□□□
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.
    · Share on FacebookShare on Twitter
  • ZzBloopzZZzBloopzZ Senior Member Member Posts: 192
    HCPS123 wrote: »
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.

    If OP does not plan to work for US Gov't then no point at all to do CEH since he already has CISSP. I also suggest what UnixGuy advices. ELearnSecurity such as eJPT or eCPPT.
    · Share on FacebookShare on Twitter
  • Info_Sec_WannabeInfo_Sec_Wannabe Senior Member Member Posts: 428 ■■■■□□□□□□
    Congrats to you sir! icon_thumright.gif

    Once I pass the CISSP (on or before 12/31/18 ), I wish to learn pentesting as well. Will the eLearnSecurity course(s) be helpful for a total newbie like me?
    X year plan: (20XX) OSCP [ ], CCSP [ ]
    · Share on FacebookShare on Twitter
  • vynxvynx Senior Member Member Posts: 153 ■■□□□□□□□□
    taking CISSP for me is not newbie :)

    for pentest i think you can take a look ejpt first
    Info_Sec_Wannabe wrote: »
    Congrats to you sir! icon_thumright.gif

    Once I pass the CISSP (on or before 12/31/18 ), I wish to learn pentesting as well. Will the eLearnSecurity course(s) be helpful for a total newbie like me?
    · Share on FacebookShare on Twitter
  • E Double UE Double U Senior Member Member Posts: 2,182 ■■■■■■■■■■
    I would take advantage of whatever my employer pays for. If you can get into a SANS course I would say take SEC560/GPEN before going for OSCP. But if that route is too pricey then CEH before OSCP wouldn't hurt if you want to learn basics (and I do mean basics). Regardless of how lots of us feel about CEH, it is a nice to have when employers are scanning resumes.
    Alphabet soup from (ISC)2, ISACA, GIAC, EC-Council, Microsoft, ITIL, Cisco, Scrum, CompTIA, AWS2022 goal(s): CRISC, AWS Certified Cloud Practitioner"You tried your best and you failed miserably. The lesson is, never try." - Homer Simpson
    · Share on FacebookShare on Twitter
  • shoeyshoey Senior Member Member Posts: 111 ■■■□□□□□□□
    HCPS123 wrote: »
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.

    Not true... A couple of years back several of my compliance buddies switched back to the technical side (i.e. PenTesting), and the companies now mandate you get your OSCP within the first six months. Sure HR still looks for C|EH, but many of those jobs (where I live) also list OSCP... Additionally, any real PenTesting company is very aware of the OSCP (as well as how little the C|EH actually teaches).

    I definitely agree with E Double U that if a cert is free, might as well knock it out...
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
    · Share on FacebookShare on Twitter
  • Info_Sec_WannabeInfo_Sec_Wannabe Senior Member Member Posts: 428 ■■■■□□□□□□
    vynx wrote: »
    taking CISSP for me is not newbie :)

    Hmm... I'm looking at it from this perspective, CISSP will allow me to understand about how a bunch of stuff works although it is not enough for me to really know the nitty gritty (e.g., what command to use, how to interpret stuff like logs, etc.) or getting my hands dirty so to speak.
    E Double U wrote: »
    I would take advantage of whatever my employer pays for. If you can get into a SANS course I would say take SEC560/GPEN before going for OSCP. But if that route is too pricey then CEH before OSCP wouldn't hurt if you want to learn basics (and I do mean basics). Regardless of how lots of us feel about CEH, it is a nice to have when employers are scanning resumes.

    I would like to go for that route as well, but unfortunately, the SANS courses are only limited for the Red Team peeps (I'm currently in our GRC block).
    X year plan: (20XX) OSCP [ ], CCSP [ ]
    · Share on FacebookShare on Twitter
  • MooseboostMooseboost Senior Member Member Posts: 778 ■■■■□□□□□□
    I agree with what a lot of others have said regarding bypassing the CEH. I think the value point is what you are looking to do with the certification. If you are just using the CEH to prepare for the OSCP you are much better off just going for the OSCP and saving the money the CEH would have costed for extra lab time if you felt you needed more preparation.

    The only way I could justify the CEH would be if you are looking to go into DoD/Gov contract work. Mind you, that is not for a pentesting company like Rapid7 doing DoD work but for a company that deals with the DoD and is wanting someone for a security position (Analyst @ Cisco in CNS for example). Outside of that, the OSCP is going to be your bread and butter for getting a position with a pentest firm.

    TLDR; Go for OSCP.
    · Share on FacebookShare on Twitter
  • SteveLavoieSteveLavoie Senior Member Member Posts: 1,114 ■■■■■■■■■□
    CEH is too expensive to be considered like a preparation tool for other certs... it is more expensive than CISSP. At 200-300$, I would consider it, not at almost 800-900$ like I have seen.
    · Share on FacebookShare on Twitter
  • albarnetalbarnet Junior Member Registered Users Posts: 3 ■□□□□□□□□□
    Newby on the block, I've been working a network engineer for 10 plus years, I want to start studying for my CISSP what material should I get and any recommendation on how to prepare would be greatly appreciated.
    · Share on FacebookShare on Twitter
  • shoeyshoey Senior Member Member Posts: 111 ■■■□□□□□□□
    albarnet wrote: »
    Newby on the block, I've been working a network engineer for 10 plus years, I want to start studying for my CISSP what material should I get and any recommendation on how to prepare would be greatly appreciated.

    I'd suggest searching the (ISC)2 section for "CISSP PASSED" threads. Many people list their study plans and what they found beneficial. Best of luck!
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
    · Share on FacebookShare on Twitter
Sign In or Register to comment.