Advice request on getting into InfoSec Pen Testing..

Comments

• veritas_libertas Member Posts: 5,746 ■■■■■■■■■■

  September 2009

  
  
  Security Certifications - TechExams.net IT Certification Forums
  
  Your question has been most likely asked or answered on that area of the forums.

  0 · Share on FacebookShare on Twitter
• dynamik Banned Posts: 12,312 ■■■■■■■■■□

  September 2009

  I think you're on the right track. If I were you, I'd focus on getting the CCNA, CCNA:S, and Security+, and then try to land a gig where you make use of that knowledge. The NOC knowledge certainly isn't going to hurt you. The more you know about TCP/IP, the better, IMO. I'm actually reading Routing TCP/IP Vol 1 and TCP/IP Illustrated Vol 1 at the moment because I'm not comfortable with my current level of knowledge in that area.
  
  You're going to absolutely want to be able to be functional from a Linux command-line. Whether you go after certs is up to you. Aside from the RCHE, the other Linux certs don't carry the same weight as comparable Microsoft, Cisco, etc. certs. I'm not saying don't do them; they do demonstrate that you have a certain level of Linux knowledge. Just don't expect a lot of people to stumble across your resume while searching for the Linux+.
  
  You're also going to want to start thinking about where you want to specialize. Are you going to be more of a general pen tester that does a little bit of everything? You're going want to add some Microsoft, SQL, etc. knowledge into the mix as well. Are you going to just focus on firewalls? Hell, you could just do social engineering and not even focus on the technical aspect of the job.
  
  SSCP is a good general security cert, but it doesn't have the recognition that the CISSP does, and you'll need a year of full-time security experience to drop the Associate designation. I think they give you a couple years to meet that requirement, but you might want to wait until you're actually doing security work.
  
  The CEH and OSCP are known in much smaller circles, although, those will likely be the circles you're interested in. I'm not saying don't do them, but don't make the mistake of thinking they'll be an easy ticket to a new job either. I'm going to do both, but mostly just to validate my knowledge. I'm more interested in the OSCP for the journey, not the actual title. The SANS GPEN seems to be the most well-respected pen testing cert out there. It'll set you back $3500, but there's only 618 of them in the world.
  
  For the time being, I'd just focus on the CCNA, CCNA:S, and Security+. Land a related position with those, and then reevaluate how you want to progress. Also, I wouldn't put a gap in your Cisco studies. Do the Security+ concurrently if you want to mix up your Cisco studies a bit, but don't take a few months off. Use it or lose it; it's frustrating getting back into it.
  
  Oh, and welcome to the forums!

  0 · Share on FacebookShare on Twitter
• Nullify Member Posts: 4 ■□□□□□□□□□

  September 2009

  Thank you both!
  
  Veritas,
  I will go through the security forums in more depth. My search-fu is very weak on forums, however I may have just thought of a way around that.
  
  Dynamik,
  Great information. I will definately look at CCNA: Security. On the Linux front, I am actually on a copy of Eeebuntu right now. I am impressed with how easy some of the distrobutions of Linux are to use now. Linux has come a long way from Slackware and the first days of windowsX years ago. OSCP sounds like ALOT of fun to obtain. Don't get me wrong it sounds like alot of work as well, but I am looking forward to being ready to tackle that beast!
  
  Once again, thank you both for the advice.

  WIP:
  ICND1 Prep 90%
  ICND2 Prep 0%

  0 · Share on FacebookShare on Twitter