(untitled)

CEH, are they worth it? Do any of you got those Certs or have similar Certs?

If someone else is paying I guess, the material is outdated and laughable at best. it would be a much better bet to go for your OSCP

>>1318 CEH is a joke and no longer considered a DoD supported certification for getting into certain DoD jobs in lieu of doing an SSCP or Sec+. The information is just as >>1326 said. Get your OSCP. Everyone I've met with their CEH is either a guy fawkes mask wearing edgelord or someone who was forced to take it by someone who was ignorant of what it does and doesn't teach. In fact, most people I know who've taken it work in SOC's or like blue team lite shops and they have many many more certs than just that. Go SANS, Corelan, or Offensive-Security if you want quality. Hell, go to a con and take training. Most of those training courses at smaller cons are cheaper and just as good with really personable instructors. soykaf, I've seen former SANS, etc. instructors doing day long workshops on some pretty legit stuff at low to mid population cons. Anyone can do multiple choice. Not so many can do it in practice.

I don't know exactly what's on it, but I know somebody who passed it. A bunch of us got together to run some attack/defend games. He was on the attacking team, and I was on the defending team. 99% of the time he only knew how to use netcat.

>>1328 >CEH is a joke and no longer considered a DoD supported Agreed. I got CEHv7 and no one gave a soykaf. Huge waste of time and money.

Seems like a good idea getting an OCSP, my only issue is that its $800USD and that's the lowest option. I work for a security company as a grad at the moment I don't think I could try and justify that kind of expense or my company trying to fit the bill.

>>1332 Then wait. Go to ctfs. Do vulnhub writeups. Do bug bounties. THAT shows a LOT more than getting a cert just to have one.

>>1329 Not to defend the soykafty CEH, but attack/defend games are incredibly one-sided for the blue teams. All they have to do is firewall everything but the required-to-be-active services, patch said services, and then manually harden them. This can be done in literally minutes. The only time it's fun is if you're red-teaming a competition like the CCDC, because you're shooting at dumb kids who don't even know what attack surface is. >>1332 If you're working for a legit infosec company, they should be extremely happy to dump money into training you. I have literally never worked with a security company (that's not some giant employee mill) that wasn't extremely invested in their employees. Have you tried asking them if they'd be willing to do that? The worst thing they'll do is say no.

>>1337 >attack/defend games are incredibly one-sided for the blue teams. I know, they weren't my idea, but I went along with them. they tried to balance it out by letting the red team have some alone time with the defending computers before matches.

>>1337 That is very fair point, just a bit of context. >Still on 6 month probation, ending in 3 weeks. >Working as in grad IT Security Consultant at the moment. >I have stated that I want to work in assurance when given the possibility. The thing is I'm unsure what they want to do with me, I might be in consultancy, assurance or MSS in the next few years and really the OCSP is only going to help if I go in assurance and maybe a bit in consulting. >>1333 My issue is pushing myself to do it, I work 45 hours a week and I when I get home I just want to sit back and play some OW or just relax. Not slam myself into more and more work. I do understand that some people work much more than that and still surround themselves in security as much as possible, but I guess im not that type of person.

I'm about to get my Security + as my first cert, CISO of the company I work for has a CEH if that says anything.

>>1365 It says your CISO wasted money and probably knows jack soykaf if that's all the certs he has. The CEH is a joke. No pentesting firm or offensive sec / red team shop respects it whatsoever.

>>1328 >>1329 >>1331 >>1366 Thanks for the replies, I'll go for Sec+ and/or OSCP instead

Can you guys give me some info on how to fully prepare myself for OSCP? I mean prepare BEFORE I even start (in hopes of passing with the 30 day package). I got some experience doing CTFs (including on-site competition) and know my basics I would say, but I only consider myself beginner level. Is CTF365 worth the money by the way? Student price I mean.

>>1440 Speaking from personal experience, ctf365 is dogsoykaf really. Their VM's are bad knock-offs from stuff you can find on vulnhub. If I were you, I would just start blasting out the labs. If you work 9-5, definitely utilize your break time to read up on the pdf. Watch the video's and read the pdf. The pdf has a few small tidbits that aren't covered in the videos that will save your ass. Other than that, approach the labs with a goal. Mine was "I am going to get into the admin network and the dev network" Some machines you should definitely root (or try to), pain, suffering, pho3nix, master, slave, alice, and bob. Note the last two are done in the pdf but watch the vids and do them on your own. Best of luck and definitely don't go begging on IRC. In fact. The IRC is kinda meh. Most you'll get is "rtfm" and "try harder"

> Speaking from personal experience, ctf365 is dogsoykaf really. > Their VM's are bad knock-offs from stuff you can find on vulnhub. Wow really? Thats disappointing to hear, I thought they'd offer something at least similar to more polished lab experience.

>>1328 >CEH is a joke and no longer considered a DoD supported certification for getting into certain DoD jobs in lieu of doing an SSCP or Sec+. kind of surprising because sec+ is easier than CEH. sec+ really just asks about best practices and definitions. CEH questions are more practical in nature.

Guessing this is about the best place to ask this as its on topic to education. Sorry if its kinda misplaced but really looking for some unbiased advice. About to send off applications to universities but having some problems making a decision for perusing security since the programs are new. Currently one college has both NSA Certifications of Academic Excellence but is a no name school and offers no certs and has more of a focus in programming. The other college has more of a networking focus and offers a couple Red Hat certs and some other basic certs and also has more presence in my state. TLDR; My question is should I work towards having a 4-year degree or a 4-year degree+certs not necessarily relating to Security.

>>1331 >>1328 That doesn't make sense, it's still DoDD 8570 and 8140 (newer) approved for many areas, at least on paper. I believe CEH is approved for all of the same areas as CompTIA's CSA+ though, but the CSA+ is cheaper and isn't from a meme organization like EC-Council. https://www.comptia.org/about-us/newsroom/press-releases/2017/10/17/comptia-csa-certification-approved-for-dod-information-assurance-workforce-improvement-program CompTIA CSA+ is approved as a baseline certification for five categories of cybersecurity professionals: Cyber Security Service Provider (CSSP)-Analyst, CSSP-Incident Responder, CSSP-Infrastructure Support, CSSP-Auditor, and Information Assurance Technical Level II. >>1652 Cybersecurity degrees are relatively new and no one really knows about them yet. The quality of programs really varies, but at a minimum, NSA/DHS CAE designations probably mean that the programs aren't complete soykaf, like ABET does for engineering and computer science. There's a LOT of different technical ground to cover though in less than 90 credit hours: networking systems administration (Windows & Linux) programming security Roughly 40 or so credit hours are general education so there's that. Many people in the industry are old farts with more traditional compsci/eng degrees or no degrees and don't like these new "millenial" cyber security/infosec degrees. Maybe some one else will chime in.

short answer: If you wanna get past HR then yes. long answer: CEH is the laughing stock of the hacking community and for a good reason, when I studied CEH it was darkcometRAT, sharkRAT, sql, and wireshark labs. It's a test with mostly theory some sec+ and some high level hacking questions. I would recommend studying hard for a few months and going for OSCP if you really want a good cert.

>>1440 an OSCP prep guide, warning: OSCP is hard af https://backdoorshell.gitbooks.io/oscp-useful-links/content/

>>3497 my course actually just got me to do RHCSA, is OSCP learnable in say, 3-4 months?

>>3499 I don't know your background but if you put 20ish hours a week, for about 3-4 months it should be fine.

>>3501 thanks, ill see if i can convince my course to get me to sign up and try when im ready

I agree with >>1459 but yet sadly I can confirm that the guy he replied to is truth

>>3494 This is accurate I work for my country's cyber and we require all our guys to get CEH for career progression

http://anniez.pw/Premium/pwk_course/ video course with the pdf for the pwk course for oscp

>>3510 >>1459 Sec+ tests the general best practices/ guidelines that will be true for a really long time, but aren't as prescriptive or useful. CEH has more practical, more specific questions, but they're out of date and inaccurate now. So Sec+ isn't as intensive of a test, nor as practical, but it's more useful now because a bunch of stuff on the CEH no longer reflects reality.

>>3539 404s for me