CCNA or CEH?

p0et

Hey Guys,

I'm wondering what to get for my next cert. I'm ultimately wanting a job
in network security/pen-testing, but it looks like I may need to get a
network admin type job first. I see that most people who go for their
CCNA already have a year or more of hands-on work experience with the
routers. I don't have any experience with Cisco at all. I have my
college diploma in Networking and that's about it.

As for the CCNA study materials, I have the following:

- Boson NetSim
- CCNA TestOut
- Sybex CCNA Study Guide - 5th ed
- Sybex CCNA Fast Pass
- A couple CiscoPress books

Would it be reasonable to study on my own for this cert or should I wait
until I (hopefully) get a networking job, then go for the CCNA later? If
so, I'd probably start on my CEH now.

Thanks!

sthomas

Do you have any experience in IT? If not then you will probably want to get an entry level job first before worrying aobut getting anymore certifications. After all it is difficult to secure a Network if you have never administered a Network. If you do have some IT experience then I would go for CCNA first then look into CEH but that is just my opinion. I wish you good luck in whatever you decide to do.

p0et

Thanks for the reply. Yes, I have about 4 years experience in IT. 1 year supporting HP systems, 1 year supporting Dell systems and 1 which included a few months assisting the Network Admin for a few hundred systems, a few months building and imaging PCs and 1 year doing PC repair in a retail store.

Slowhand

Just like the Security+, CE|H builds on a lot of other "general" knowledge. If you don't have CCNA-level experience, I'd say go for the CCNA first. You'll learn a lot of networking concepts that will help you on your security path. If you really want a plan to follow, I'd say get yourself some experience in the "big three" areas: Unix/Linux, Windows, and network administration. A recommendation would be:

CCNA, at least. Preferably CCNP (Networking)
MCSA/MCSE (Windows Systems Administration)
LPI, RHCE, SCSA (Unix/Linux Systems Administration)

Each of the certs I've mentioned have security specialities or supplimental security training. For Cisco, it's CCSP. For Microsoft, it's MCSE: Security. LPI, Red Hat, and Sun all have security-speciality tests in regards to their certifications. That might be a place to start, then go for the in-depth security certs like CE|H, or even SSCP and CISSP. And, of course, you absolutely have to be working while you're studying for these things. Experience counts for a lot, and you need to have a lot of hands-on experience with just about everything; especially if you're looking to be a security specialist.

p0et

I'm already MCP, but not MCSE yet. I do have a more advanced level security cert already with SANS called GCIH (Incident Handling & Hacker Exploits).

Do you guys think I'd need to go back down to the Net+ and Linux+ before proceeding? I may study CCNA and C|EH while I'm trying to find a more hands-on job at this time. Currently, I'm just doing 2nd leve tech support at Dell, so no real hands-on with networking or security right now.

mikej412

I'd say go for the CCNA to break into the networking side of IT.... then start on the Security.

Slowhand nailed it with the MCSE (Security) and Linux (since lots of good security tools are Linux Based) -- so work the Security+ and CEH in after the CCNA and getting that first real networking job. Then build a solid base of knowledge with the Linux/MS certs -- while keeping an eye on your long term Security goal.

You could try something like the Cisco CCSP (after the CCNA) to hit the network security side sooner.... but we've already filled up your year with stuff to study for.... so a decision on the CCSP can wait.

p0et

Thanks for all the great advice guys.

I do also have my Security+ already. I've been doing ethical hacking, many contests online and in person for years now and am getting more comfortable with Linux too.

At home I run Gentoo Linux and VMWare with several other O/S'.

Most of the networking jobs and security jobs I've found do not list any Linux certs as an asset or a requirement. The same goes for MCSE. I've seen a few say MCP, but that's about it.

The jobs that I've seen have been looking for A+, Security+, MCP, CCNA and a SANS Cert for the requirements. Do you guys think it's really necessary in getting the full MCSE instead of the MCP and an actual Linux cert? If so, which Linux cert would you recommend over the few I see are available?

wmackey

Linux (and PERL scripting) are a plus for security because many tools and scripts are available for the platform. In some cases, Linux is the only choice. Most of the Pen Testing I have been involved with over the past two years has used Linux tools.

Wade Mackey