so welcome to the talk before lunch this
is about security certifications so come
on in and sit down I know we just barely
got done with the other one but we have
some time to talk about security
certifications and I was talking to one
of the attendees here at st. Cohn and
they were saying well I can see you
already got have certification so I know
what your talk is gonna be about I said
well there's more to that actually I can
partly blame my first search security
certification my cissp on pizza because
when I work for Symantec we would get
together for study groups and we would
prepare for the CISSP so we would order
pizza and that was part of my motivation
for going there but once I had my sort
of security certification and I moved to
HP they kept giving me more security
work because I had the security
certification even though I wasn't
originally doing security work so let
that be a lesson to you if you want to
get into security get a certain
certification and then security things
will come your way so we're going to
talk about the benefits of a security
certification we're going to talk about
your career path a little bit because
everybody has a little bit different
career path I started out as a developer
and and I got into security when I
worked for Symantec and now I do 100%
security so there you go
community so the saint's con is a
community that you guys have chosen to
come and participate in great community
network security and security in general
there are other communities as you work
on certifications we'll will talk about
that because that's a really important
part of it passing the exam I'll let you
know some of the tips and tricks that I
had for passing the exams that I've
taken and then continuing education so
if you want to continue insecurity and
stay up with with the the things then
you want to do that okay so what's
talk about the benefits of a security
certification first of all you're making
a commitment to the security field so
this sends a signal out to those who
know you at work generally other people
too but you've made a commitment to say
yes I believe in security and I'm in it
for the long haul career security so not
only will you have job security which
means you can keep your current job but
if you need to move or evolve your
career you'll be able to move to other
places that will help you to learn the
things that you want to in your career
specialization if you want to stand out
to people in the from the other
candidates that are interviewing your
security certification can do that okay
someone put it back team validation so
sometimes I take a dribble occations
from my team and that's just part of the
thing but it's also it does validate you
and then peer networking like
conferences like this you can meet
like-minded people and learn things that
will be useful and share your
experiences so I've told you a little
bit about my career path what is your
career path it may or may not include
getting a certification it may be just
coming to st. Conn once a year and
getting the badge to work you know it's
just kind of violent fun to do but if
you want to really kind of manage your
own career then you want having a
certification and will help you to meet
your goals what kind of community are
you joining so before you get a
certification you need to do your
homework on you know what is this
organization that provides to this
certification because when you work to
get your certification you become joined
with this community and so it's
important for you to see what kind of
benefits you get from that Association
and also when you report
if you do continuing education and you
report it back to this community you're
interacting with that community and so
this certificate providers become part
of your community now I am currently
work
I have several certifications so I'm
associated with this certification
providers but I also part of a wasp so
that's a open web application of
security projects and so it's another
security area that I'm that I've
participate in and then what is your
passion well this may be a little bit
overused you know what's your passion
you know but really it takes some effort
and commitment to be able to stay with
the program to study for a certification
review the things that you've studied
and be able to pass the exam
it takes some real commitment some time
it takes some resources it's at the cost
of a lot of these certification tests
are are high so it's good if your
employer you can get your employer to do
to sponsor you but you've got to have
the passion to kind of follow through
and and move forward in your career so
I'm gonna talk about a few career paths
that you can take and a few
specializations here and this is not
meant to be you know all-encompassing
we're just talking about pen testing
certs if you want to be a white hat
hacker security architect so more or you
could say security manager in some of
the cases but if you're designing
products and you want security in there
then there's certain certifications that
will help you do that and then there's
specializations such as the cloud who
hasn't heard of the cloud you know
everybody interacts with a cloud but if
you deploy your applications in the
cloud then knowing everything knowing
how to make do it securely will help you
stand out and then privacy has been big
of not just with you know individual
privacy but the gdpr
looms large in in the industry that I
work in and so that's been
some of the areas where you can you can
specialize there's also some very
specific technical Circe that I've
talked with some people about the Cisco
the Microsoft certs that you work on and
and they can have their place as well
especially if you're in IT and you're
trying to specialize in those areas but
I'm going to kind of deal with a little
more general certifications so we're
gonna we're going to talk about the
pentesting search first the one that so
I work with a pen testing group and
they're one of those that are a little
bit skeptical until I lead pen tester to
go get his OSC P so that's offered by
offensive security the makers of Kali
Linux so they provide the training and
then they give you 48 hours to basically
hack all the systems own the systems and
then report on it so that offensive
security does take some those carry some
weight in the pen testing community
there's a certified ethical hacker the
ones on top are kind of the ones that
you want to have and the ones on the
bottom or more once you're kind of
working out toward certified ethical
hacker is done by the EC Council and
it's it basically teaches you some of
the tools and tricks and how to how to
do ethical hacking so it if you're
looking like a job security than the
osep and the ceh are probably more
prevalent the g-pen there this is one of
the G axor to vacations probably better
known to the SANS community so sans
provides a lot of training in security
and they provide the penetration tester
the GX certified penetration tester so
everything that starts with a G has a
certification on it is probably
associated with sans the CompTIA also
has the pen test plus which just came
out in July
of this year so that's new CompTIA is is
more on the IT admin side and your I've
talked with some people who have they're
like like security plus and we'll talk
about that in a bit but so those are
some of the pen testing certs and let's
talk about the organization's compte
I've already talked about it's more IT
certifications the EC Council provides
the certified ethical hacker one thing
to note there and we talked about that a
little later is you can get your
certified ethical hacker and they also
have a practical exam now that you can
you can do so they've seen that you know
some of these others have a practical
exam so they wanted you want they have
that as well
sans is a sysadmin audit network and
security the sans training they provide
all the general information assurance
certifications security certifications
so it gets a little redundant but sans
does does really good training in
different areas and it's expensive
training but they're they're generally
complete and what they do then they do a
lot of research and have the internet
storm center and so offensive security
like I say they do the Kali Linux so
it's good to know you know who you're
joining when you when you go get your
certifications so now we come back to
the passion and to the you know
interests why would I be interested in
getting an osep well you do the you have
the skills and you prove it
the ceh ethical hacker so they have a
version 10 now so they cover kind of the
same topics maybe a little bit less the
g-pen i've already talked about the g
whapped that's the web application so so
there's a there's like general
certifications like for penetration
testers but like if you want to
specialize in web application then
that's kind of the sans specialization
for web applications the certification I
have is the incident handler
certification so that kind of covers
some basic hacking and then what to do
in case the worst half
Bunz because more more often than not it
does and then I've talked about the pent
f+ so we're gonna switch a little bit
here and talk about security
architecture security management the
CISSP this is the first certification
that I got that's you know took some
some really some real effort to to
prepare for and take and the way they
look at certified information security
information systems security
professional is that you you basically
the material is a mile wide and an inch
deep so you know a little bit about a
lot of things so you can talk about a
lot of things in information security so
it's just kind of a general security
certification but it takes a long time
to get experience in those different
different areas so the digi sack again
that's just security essentials and
that's the Sands training that backs
that up and so it it lets you know that
you've you know about security some of
the tools that they use and so forth
I want the sisa system auditor
certification is from Asaka and we'll
talk about that in a second but they do
auditing so if you're really if you
really like telling people what they
have wrong and that they have to fix it
then that's probably the you know the
career path that you should take the CIA
the the sisa or the CISM CompTIA has a
couple of security plus so if you're
just starting with a security
architecture and so forth and your
interest in this area security plus is
probably a good one to to start with and
then the CISSP for example takes five
years of experience to get it although
you can get a sort of certificate and be
an associate until you get your five
years and then you're a CIS SP and then
the cyber security analysts kaunteya has
that as well so
make it big
there we go so we talked about compte
and sans IFC squared is the one who
provides the gold standard for
information security the CISSP and they
also provide other certifications and I
and it's general information security so
that that shows if you want to be in
management you want to do architecture
that's kind of the one for you
again that Asaka is the one for auditors
okay
so the type of topics that you cover
with information security is risk
management government's operations
development again the basing based on
the number of years of experience you
have that can kind of help you guide
yourself on on which certification to
look at next
because really it's a it it's basically
a journey and not a destination in a lot
of cases you're learning things as you
work and as you communicate different
things so in my case I earn the CISSP
and then I got the cloud certification
and then privacy ones came kind of came
at the end all right so so those are if
you're if these are your interests and
topics and that's what you have a
passion for then you should probably
look at those certifications okay so now
we got to the cloud and privacy
certifications so cloud is still new to
the certification realm IFC squared has
created one called the certified cloud
security professional and this one
basically it's cloud for the CIS SPS
again it takes doesn't it's not as much
information there is they have an
information security but it's still
quite it still kind of stands on its own
so ccs k was probably the first cloud
certification that was was offered and
it was it's basically kind of it's by
the
si si cloud security alliance and so
they started putting their best
practices together for the cloud and
came up with this 30 certification CCS k
then is c-squared came and talked with
them and said hey we want to do a cloud
certification so they took some of that
material added some of their own and
that's where you have those CCSP the
cloud plus is the CompTIA certification
for the cloud so again from your IT
administration point of view and then
the CI PP this is the security privacy
privacy certifications that is done by
AI IPP and with gtp are coming down the
line basically my manager and I needed
to be educated on what this actually
meant for us and for our systems and so
that's why I pursue the the CI PP
certification so we talked about CompTIA
and we've talked about ok so CSA is
cloud security alliance ok
ia PP is the world's largest information
privacy organization they actually
provide more than one sir so they have a
CI PP for the EU which is a lot of
people that's very popular now
understanding GD P R and they have CI PP
for the US and then is e squared that's
the CCS P alright so we've kind of gone
through and here's the cloud privacy
topics again the CCS P is going to be
you're going to be talking about a lot
about the infrastructure as a service
and software as a service and those
areas and then as far as governance and
then the cloud plus is more general
cloud and then the CI PPS is privacy so
what does it take to pass the
certification exam ok for those of you
who are preparing for cissp or CH or
some of these
what does it really take to do it you
got to know the material so there's
there's a lot of books out there there's
a lot of reference materials there's
training but what I found from my
experience is knowing the material and
being able to review the material so in
a lot of cases you're going through a
lot of material and so when I went
through the material I would create
questions and so forth so that's just
the way that I learned and I can make
some of those available for those of you
who are looking at like the CCSP but you
have to be able to review it and have it
in your mind when you're doing the exam
and that and it's it's it helps to
having made that commitment to the
security community and to this area to
be able to want to retain the
information if you just want to get the
information and then just forget it all
it's harder to remember so you can take
the security training but review the
material before you go through the
training I had one case where I went to
the training and they offered the exam
at the end and I was sure glad I had
gone over the material before because
even though they reviewed everything I
wouldn't have been able to do it without
that initial knowledge take practice
tests if they have them if they don't
then then you can kind of set up your
own and here's my multiple-choice exam
tip for those who are doing multiple
choice exams read the question twice you
know you want to understand what they're
actually asking because you have a lot
better chance to to pick the right
answers if you do that and then go
through every answer and and this is
part of the thing if you my my tip is if
you go from the bottom up your mind will
just want you to go through every answer
right if you go from top down sometimes
you see the right answer you think is
the right answer and then there's a
better answer further down so you want
to you want to basically understand how
you're going to approach that exam and
then you can go back and review the ones
that are there there so certification
exam this is an eye chart but it's
basically based on Myra Myra
search for these security certifications
and and basically the number of
questions you have the time you have the
pass rate and there's the cost right so
you're gonna have different varying
things but it's not cheap in a lot of
cases that the CISSP is now five hundred
ninety nine dollars to take the test to
sit for the exam and a lot of the SANS
ones that they do you know know they're
expensive and the training is expensive
the probably that if you're if you're
looking to it to do yourself I probably
look at the CompTIA once because they're
more affordable for you but get your if
you can get your employer to play pay
for singing for the exam that would be
the way to go
okay after you got the exam after you've
passed that and you've made the
commitment to this community what more
is required of you well if you want to
maintain your certification you get to
do more security training so basically
you can come to places like st. Con or
Def Con or derbycon
and get credit for your certification
and you can actually justify it to your
manager and say look I've got to
maintain my certification so and keep me
up to date so send me to the conference
so that's you do have any membership
fees and then you have the continuing
professional education which is
generally self-reported and the kind of
requirements you have if that's not for
you then there's only two of these
certifications that have exams only but
most of them require you know twenty-two
looks like nine to forty hours of some
training during the year so there's
there's the cost to maintain those
certifications but there's also
continuing education and you generally
report that yourself or in some cases
it's reported for you especially the
trainings done by the organization that
you're way
so security training you can take that
the online training or sit for classes
there are some free training out there
that you can take one of my favorites is
the cyber re training when I was doing
the CCSP and I needed to review some
topics before I went to the training I
got on there got the free training and
then went into the training there's also
some things on lynda.com the kind of
ghosts over all of these so if you have
questions about that so I we have time
for a couple questions or you can just
talk to me afterwards and my information
is right here my LinkedIn email
CCSP okay so the question was are there
any prerequisites for a CISSP or CCS B I
think basically you're required to have
five years of industry experience so
that's the only prerequisite if you're
looking at a security certification to
get before that before the CISSP or
before the CISSP I would recommend the
security plus before the CCSP I would
recommend the CISSP so that's just my my
take on it
any other questions okay
well feel free to come by and ask me
questions if you're studying for
particular exams you know I may be able
to help you out or or at least get you
on the right track and you know let's go
own it and that you come to st. Conn
means you know you have made a
commitment to the security community now
it's the question of whether it's going
to affect you personally so thank you
you