Certification path advice - CISSP to C|EH / OCSP

SecurecallSecurecall Registered Users Posts: 1 ■□□□□□□□□□
I've recently got back on the certification track after taking and passing my CISSP yesterday, and am keen to keep the momentum as far as keeping learning and working on my certifications (getting back to the technical ones), and am looking for some advice on where to go next, ideally from the people who have both a C|EH and OSCP.

I've worked as a Firewall and Network administrator now for 10+ years and would like to learn some skills from the other side of firewall, and I have my eye on the OSCP, a cert that seems to carry a bit of respect, and offers a learning track thats really going to give you some real world skills. Ive started to take some small steps (very small steps, Cybrary course) into learning to code in Python, with an eye on the long term.

The question I have, is it worth me studying for and taking the C|EH to get the basic knowledge, or is this just a waste of time and effort because the OSCP will teach me everything I will learn in the C|EH and more? Appreciate there is the HR department being the 1st line of defence angle as far as the C|EH is concerned, so I'm guessing it should be on the list. But for now, I am keen on personal development. Any advice on this path would be appreciated.

Cheers

Comments

  • UnixGuyUnixGuy Mod Posts: 4,564 Mod
    Skip CEH and anything EC-Council. Try eLearnSecurity and SANS (if your employer pays for it)
    Certs: GSTRT, GPEN, GCFA, CISM, CRISC, RHCE

    Check out my YouTube channel: https://youtu.be/DRJic8vCodE 


  • shoeyshoey Member Posts: 111 ■■■□□□□□□□
    I agree with UnixGuy. You will be kicking yourself when you get to the OSCP and realize what the C|EH didn't do for you...

    If you search through the OSCP threads on here you'll find plenty of free resources to study that will better prepare you then speding time/money on the C|EH...
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
  • HCPS123HCPS123 Member Posts: 54 ■■■□□□□□□□
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.
  • ZzBloopzZZzBloopzZ Member Posts: 192
    HCPS123 wrote: »
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.

    If OP does not plan to work for US Gov't then no point at all to do CEH since he already has CISSP. I also suggest what UnixGuy advices. ELearnSecurity such as eJPT or eCPPT.
  • Info_Sec_WannabeInfo_Sec_Wannabe Member Posts: 428 ■■■■□□□□□□
    Congrats to you sir! icon_thumright.gif

    Once I pass the CISSP (on or before 12/31/18 ), I wish to learn pentesting as well. Will the eLearnSecurity course(s) be helpful for a total newbie like me?
    X year plan: (20XX) OSCP [ ], CCSP [ ]
  • vynxvynx Member Posts: 153 ■■□□□□□□□□
    taking CISSP for me is not newbie :)

    for pentest i think you can take a look ejpt first
    Congrats to you sir! icon_thumright.gif

    Once I pass the CISSP (on or before 12/31/18 ), I wish to learn pentesting as well. Will the eLearnSecurity course(s) be helpful for a total newbie like me?
  • E Double UE Double U Member Posts: 2,228 ■■■■■■■■■■
    I would take advantage of whatever my employer pays for. If you can get into a SANS course I would say take SEC560/GPEN before going for OSCP. But if that route is too pricey then CEH before OSCP wouldn't hurt if you want to learn basics (and I do mean basics). Regardless of how lots of us feel about CEH, it is a nice to have when employers are scanning resumes.
    Alphabet soup from (ISC)2, ISACA, GIAC, EC-Council, Microsoft, ITIL, Cisco, Scrum, CompTIA, AWS
  • shoeyshoey Member Posts: 111 ■■■□□□□□□□
    HCPS123 wrote: »
    CEH is definitely better for you HR wise. I would have actually recommended you get it before CISSP since I heard CEH can help prepare you for some of the PENtester material on CISSP but since you've already gotten CISSP CEH doesn't really do much for you outside of HR. I agree with the rest, go for an ELearn cert first to prep for OSCP if you're just interested in the skill.

    Not true... A couple of years back several of my compliance buddies switched back to the technical side (i.e. PenTesting), and the companies now mandate you get your OSCP within the first six months. Sure HR still looks for C|EH, but many of those jobs (where I live) also list OSCP... Additionally, any real PenTesting company is very aware of the OSCP (as well as how little the C|EH actually teaches).

    I definitely agree with E Double U that if a cert is free, might as well knock it out...
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
  • Info_Sec_WannabeInfo_Sec_Wannabe Member Posts: 428 ■■■■□□□□□□
    vynx wrote: »
    taking CISSP for me is not newbie :)

    Hmm... I'm looking at it from this perspective, CISSP will allow me to understand about how a bunch of stuff works although it is not enough for me to really know the nitty gritty (e.g., what command to use, how to interpret stuff like logs, etc.) or getting my hands dirty so to speak.
    E Double U wrote: »
    I would take advantage of whatever my employer pays for. If you can get into a SANS course I would say take SEC560/GPEN before going for OSCP. But if that route is too pricey then CEH before OSCP wouldn't hurt if you want to learn basics (and I do mean basics). Regardless of how lots of us feel about CEH, it is a nice to have when employers are scanning resumes.

    I would like to go for that route as well, but unfortunately, the SANS courses are only limited for the Red Team peeps (I'm currently in our GRC block).
    X year plan: (20XX) OSCP [ ], CCSP [ ]
  • MooseboostMooseboost Member Posts: 778 ■■■■□□□□□□
    I agree with what a lot of others have said regarding bypassing the CEH. I think the value point is what you are looking to do with the certification. If you are just using the CEH to prepare for the OSCP you are much better off just going for the OSCP and saving the money the CEH would have costed for extra lab time if you felt you needed more preparation.

    The only way I could justify the CEH would be if you are looking to go into DoD/Gov contract work. Mind you, that is not for a pentesting company like Rapid7 doing DoD work but for a company that deals with the DoD and is wanting someone for a security position (Analyst @ Cisco in CNS for example). Outside of that, the OSCP is going to be your bread and butter for getting a position with a pentest firm.

    TLDR; Go for OSCP.
  • SteveLavoieSteveLavoie Member Posts: 1,133 ■■■■■■■■■□
    CEH is too expensive to be considered like a preparation tool for other certs... it is more expensive than CISSP. At 200-300$, I would consider it, not at almost 800-900$ like I have seen.
  • albarnetalbarnet Registered Users Posts: 3 ■□□□□□□□□□
    Newby on the block, I've been working a network engineer for 10 plus years, I want to start studying for my CISSP what material should I get and any recommendation on how to prepare would be greatly appreciated.
  • shoeyshoey Member Posts: 111 ■■■□□□□□□□
    albarnet wrote: »
    Newby on the block, I've been working a network engineer for 10 plus years, I want to start studying for my CISSP what material should I get and any recommendation on how to prepare would be greatly appreciated.

    I'd suggest searching the (ISC)2 section for "CISSP PASSED" threads. Many people list their study plans and what they found beneficial. Best of luck!
    "I have missed more than 9,000 shots in my career. I have lost almost 300 games. 26 times, I've been trusted to take the game winning shot and missed. I've failed over and over and over again in my life. And that is why I succeed." - Michael Jordan
Sign In or Register to comment.