Next Step after MCSE and Security+??

Devilsbane

I'm working on finishing the MCSE right now, and then I'm going to upgrade it to MCSE:S via the 70-299 (and because I already have Security+ down).

I would like to get into the security world, but don't really know where to start. I have heard good things about the CISA and CISM, but they both have work experience requirements that I don't have yet.

There is also the SSCP, but I don't know that I can get past the 1 year requirement for that either unless I can get them to agree that resetting and managing passwords falls under the Access Controls domain.

Then there is the CEH, which I think I could probably do. But like the SSCP it comes with a heafty recertification plan that I don't know if I'm ready to take on yet. (Right now I would like to gain more experience and more certifications without worrying about relearning things).

I've heard some good things about the GSEC, but don't know much about them.

My other concern is that I'm not sure how these tests are given. Are they similar to a Microsoft test where I can register with Prometric and can go take them virtually anywhere?

Devilsbane

What about CCSA and CCSE? There isn't much on the web about them.


EDIT:
Found some information on them, but I don't think they are for me. Not yet at least. It doesn't seem like a great idea to get certified in a vendor specific product that I have never used and I'm not sure if my company even uses them.

kriscamaro68

From what I know the SSCP is a scantron test that is given in a setting more like a classroom where you will be sitting with multiple people including people taking tests for the CISSP. It's a lot of questions and they give you a bit of time. Check this out: The SSCP Certification Experience | TechExams.net Blogs

As for the Gsec. Well get ready to spend a boat load of money for training and $900 if you just want to challenge it without training. You can buy practice tests from sans for the gsec but really the only place to get training for the gsec is sans itself which is expensive. Check out this if you want to get some insight on topics that will be on the gsec: Amazon.com: Network Security Bible (9780470502495): Eric Cole: Books

That book is written by Eric Cole who works with sans.

Also there are other security certs out there that are not as well known: Security Certified Program - SCNP but is still on the dod 8570 list.

There is also certs by offensive security: http://www.offensive-security.com/information-security-certifications/

Also if your not already become a member of ethicalhacker.net and start posting. Those guys over there are pretty cool and focus on everything security.

Hope this info is useful.

Devilsbane

kriscamaro68 wrote: »

Hope this info is useful.

It is very useful, thanks for the information and the links! +rep for you.

Do you think these are obtainable with the background that I have?

Psoasman

You will also need the 298 for the MCSE:Security. the MS press book is good for both.

Chris:/*

kriscamaro68 wrote: »

As for the Gsec. Well get ready to spend a boat load of money for training and $900 if you just want to challenge it without training. You can buy practice tests from sans for the gsec but really the only place to get training for the gsec is sans itself which is expensive. Check out this if you want to get some insight on topics that will be on the gsec: Amazon.com: Network Security Bible (9780470502495): Eric Cole: Books

That book is written by Eric Cole who works with sans.

The GSEC is expensive but very technical and well worth it in my opinion. I was trained by Eric Cole for my GSEC and I learned a lot with real world examples from his experience.

Devilsbane

Psoasman wrote: »

You will also need the 298 for the MCSE:Security. the MS press book is good for both.

Yep, that will be my design elective for the MCSE. I already have the books for the 298 and 299, I intend to read the 299 first because I have been told it is better, then skim the 298 and go take both tests in a couple week period.

kriscamaro68

Devilsbane wrote: »

It is very useful, thanks for the information and the links! +rep for you.

Do you think these are obtainable with the background that I have?

I would say that the Gsec and SCNP are the most obtainable if you have the money to do them as they have no experience requirements. They both will deal with linux and windows and lots of other random security areas. Much more so then the security+. It may not be a bad idea to get the MCSE Sec before jumping into these as a good background in PKI, kerberos, ldap, and all the other good stuff will only help later. The SSCP will require the 1 year requirement but even if you don't have the 1 year you still get an associate of isc2 and can get the 1 year as time goes by. As for the Offensive security stuff... Well those require lots of hands on knowledge of pen testing and linux itself, since all the testing is done with backtrack 4 which is a linux distro configured by them with pen testing tools on it. (not sure how familiar you are with backtrack) If you haven't already download backtrack and start playing with it.

Devilsbane

kriscamaro68 wrote: »

It may not be a bad idea to get the MCSE Sec before jumping into these as a good background in PKI, kerberos, ldap, and all the other good stuff will only help later. The SSCP will require the 1 year requirement but even if you don't have the 1 year you still get an associate of isc2 and can get the 1 year as time goes by. As for the Offensive security stuff... Well those require lots of hands on knowledge of pen testing and linux itself, since all the testing is done with backtrack 4 which is a linux distro configured by them with pen testing tools on it. (not sure how familiar you are with backtrack) If you haven't already download backtrack and start playing with it.

MCSE:S is the plan.

As I was driving to work today, I was thinking about this. For a year I was the computer forensics department admin at my college. Which meant that I basically maintained a classroom of desktops and servers. Implenting patches, creating user accounts, managing file permissions. Do you think that could satisfy as the 1 year security requirement?

I downloaded backtrack3 and played with it a little bit. I think I have 4 too but never had time to use it. My linux isn't the best to say it nicely, but I can manage my way through it. One of the things I have been considering is the new Linux+ cert to help with that, but idk yet.

ssampier

I couldn't postrep you, so I decided to post. Very timely and interesting discussion. I was wondering the same thing. I have a keen interest in security, too. I have attended a security summit several years in a row. The summit was excellent stuff but I was always felt out-of-place since I have never hacked into anything.

From the discussions I have read here it seems security is a huge field, whether you want to go the management route or the hands-on route. I can only guess what you'd be interested in but most of us here are more interested in getting our hands dirty (with bits and bytes).

Pen testing seems to be an interesting field. From what I can gather it is more of a consultant role since pen testers aren't needed on a regular basis.

Vulnerability testing is similar to pen testing, but less invasive, and usually involves people running Nessus--or similar software--scans. Nessus gives false positives, so you can't rely on it or any vulnerability software exclusively.

Whether to go to CEH or a network path for firewalls/IDP, I haven't decided yet. In the end I probably should do both (until I can find a sugarmama to fund SANS training, that is).

kriscamaro68

Devilsbane wrote: »

MCSE:S is the plan.

As I was driving to work today, I was thinking about this. For a year I was the computer forensics department admin at my college. Which meant that I basically maintained a classroom of desktops and servers. Implenting patches, creating user accounts, managing file permissions. Do you think that could satisfy as the 1 year security requirement?

I downloaded backtrack3 and played with it a little bit. I think I have 4 too but never had time to use it. My linux isn't the best to say it nicely, but I can manage my way through it. One of the things I have been considering is the new Linux+ cert to help with that, but idk yet.

If the experience isn't recent then I don't know if it will count. A lot of what we do on a daily basis could be considered experience under the domains for the SSCP. I would just contact isc2 and ask them directly. That will be your best bet.

As for Backtrack they just came out within the past month I think with bt4r1 which is an updated release of 4 that has updated tools, drivers, and I could be wrong but kernel to. So I would give that a shot.

Also I forgot to mention a new to the block company and cert: http://www.elearnsecurity.com/ they are suppose to have some of the best pen test style training around. They are pretty cheap to for what you get and have payment plan options. If you join ethicalhacker.net you get a 5% discount I think and they also send e-mails every now and then offering deals on their training. You may want to take a crack at this when you get through some of your other certs.

Their cert: http://www.elearnsecurity.com/course/penetration_testing/eCPPT.pdf

Either way good luck on your adventures in security it is fun stuff.

willhi1979

kriscamaro68 wrote: »

If the experience isn't recent then I don't know if it will count. A lot of what we do on a daily basis could be considered experience under the domains for the SSCP. I would just contact isc2 and ask them directly. That will be your best bet.

As for Backtrack they just came out within the past month I think with bt4r1 which is an updated release of 4 that has updated tools, drivers, and I could be wrong but kernel to. So I would give that a shot.

Also I forgot to mention a new to the block company and cert: eLearnSecurity : Penetration testing and IT Security courses they are suppose to have some of the best pen test style training around. They are pretty cheap to for what you get and have payment plan options. If you join ethicalhacker.net you get a 5% discount I think and they also send e-mails every now and then offering deals on their training. You may want to take a crack at this when you get through some of your other certs.

Their cert: http://www.elearnsecurity.com/course/penetration_testing/eCPPT.pdf

Either way good luck on your adventures in security it is fun stuff.

I'm looking at taking it next year. I did ask ISC2 about the experience requirement, but they will not answer any questions on it until the endorsement process after you take the exam and pass.

Devilsbane

willhi1979 wrote: »

I'm looking at taking it next year. I did ask ISC2 about the experience requirement, but they will answer any questions on it until the endorsement process after you take the exam and pass.

lol, figures

Devilsbane

Does anyone else have any advice about where to go from here?

[Deleted User]

I know personally, I'm going to look into the GCWN after I finish up all of my certification requirements for my job. I think it will be fun to do a GIAC cert and this one sounded pretty appealing to me.

rwmidl

xmalachi wrote: »

I know personally, I'm going to look into the GCWN after I finish up all of my certification requirements for my job. I think it will be fun to do a GIAC cert and this one sounded pretty appealing to me.

A coworker just got back from SANS Network Security 2010 in Las Vegas. He took the GCWN course and he said it was awesome and he learned alot. I'm hoping to take it next year (aiming to go to Security West)

rwmidl

Devilsbane wrote: »

Does anyone else have any advice about where to go from here?

If you can do it, I'd say aim for the GSEC.

Devilsbane

rwmidl wrote: »

If you can do it, I'd say aim for the GSEC.

Is that an online test?

[Deleted User]

Devilsbane wrote: »

Is that an online test?

GIAC Security Essentials Certification (GSEC)

rwmidl

Devilsbane wrote: »

Is that an online test?

Yes. You log in to your SANS portal account and take the test.

Devilsbane

rwmidl wrote: »

Yes. You log in to your SANS portal account and take the test.

And that doesn't take away credibility?

So the GSEC is $899. Is that just the test, or does that include training?

Bl8ckr0uter

Devilsbane wrote: »

And that doesn't take away credibility?

So the GSEC is $899. Is that just the test, or does that include training?

That is to challenge the test. The test is open book but you basically would have to make your own study material (I am doing this as we speak).

rwmidl

Devilsbane wrote: »

And that doesn't take away credibility?

So the GSEC is $899. Is that just the test, or does that include training?

You will have to take the test at an authorized testing center. Only Kryterion is authorized to administer GIAC tests. My understanding this has to do with the format of the test being "live on the internet" and it being open book - VUE and Prometric really aren't set up and designed for this format. You can read more about it here.

The $899 is to take the test. If you want to take the bootcamp which will include all the books the exam is $499, but will still have to shell out a couple of grand for the course.

Devilsbane

rwmidl wrote: »

The $899 is to take the test. If you want to take the bootcamp which will include all the books the exam is $499, but will still have to shell out a couple of grand for the course.

Looks like about $4,000 for 6 days of training 8 hours each day (Thats $83/hr). But then you can save $400 off the test. What a deal

Chris:/*

It really is not a bootcamp because it does not teach you the test. The classes themselves from SANS are outstanding I recommend them!

rwmidl

Chris:/* wrote: »

It really is not a bootcamp because it does not teach you the test. The classes themselves from SANS are outstanding I recommend them!

Chris is correct. It is not a bootcamp. I also agree that the courses are worth it. Out of all the IT courses I've taken, I've gotten the most out of the SANS courses.

Bl8ckr0uter

If you are not at a shop that will pay it, 4k is way, way out of most peoples budget lol.

Chris:/*

Bl8ckr0uter wrote: »

If you are not at a shop that will pay it, 4k is way, way out of most peoples budget lol.

True True but you gotta pay to play !

You are right though $4K is a lot of money to spend without a kiss.

Bl8ckr0uter

Chris:/* wrote: »

True True but you gotta pay to play !

You are right though $4K is a lot of money to spend without a kiss.

If you are paying 4k for anything it better be a lot more than a kiss lol

Chris:/*

Dang I knew I was getting jipped!

powerfool

SANS does now offer a masters degree using their certifications as the building blocks, and I believe you have to write a thesis. From what I remember, the total cost would be about $30k, which would include going to their authorized training (which is required for all but two of the tests, you choose which two).