- [Instructor] There are several security certifications
related to pen testing in the industry.
Now this course helps you to get fundamentals
to prepare for some of them,
however, each certification has its own requirement.
So let's actually review some of these certifications.
The first set of certifications that I'm gonna cover
are actually from Offensive Security,
and they have different certifications
related to pen testing and also exploitation.
Now the first one is the Offensive Security
Certified Professional or OSCP.
It goes over the principles of pen testing,
and the exam is a 24 hour exam that includes the requirement
for you to actually write a penetration testing report.
So that's actually something that some of the other
certifications actually do not present into the fact
that you not only use the 24 hour exam
but you actually have to write a penetration testing report.
Now they also have a certification that concentrates
on wireless security pen testing called the
Offensive Security Wireless Professional or OSWP.
They also have three different expert level certifications.
The first one is Offensive Security Certified Expert,
or OSCE, the Offensive Security Exploitation Expert, OSEE,
and the Offensive Security Web Expert, or OSWE.
I'm including the link to their website here
for your reference in case you actually want
to read more about them.
Now there's also an organization called the EC-Council
and they have two certifications,
the Certified Ethical Hacker
and the Certified Network Defender certifications.
You can obtain more information about them
in the link that I'm sharing in this screen.
Now another organization that has multiple courses
and also certifications is SANS,
and actually SANS in combination with G-I-A-C or GIAC.
Now some of them are related to pen testing,
some of them are not.
Like for example, they have courses and certifications
related to forensics, instant response,
and also related to pen testing.
Now there are many other cyber security certifications
out there, so even if you want to get certified
in things like network security or cyber security operations
there are a few additional choices for you.
For example, Cisco, where I work, they actually have
two tracks for cyber security certifications,
the traditional network security, so CCNA Security,
CCNP Security, and CCIE Security,
and then they also have a new certification
that will help you prepare to be a cyber security analyst
in the security operations center known as SOC
or be part of a computer security
instant response team or a CSIRT.
Now that's the Cyper Ops certification though
so the CCNA Cyber Ops.
I actually author the books and the video courses
for both the CCNA Security
and the CCNA Cyber Ops certifications.
I'm including a link to the Cisco Certification website
for your reference.
(ISC)2 is another organization that has
several cyber security certifications.
They range from the Certified Information System
Security Professional or CISSP,
which is actually one of the most known
security certifications in the market.
And it actually provides you a common understanding
of the different domains in information security.
Then you have more specialized certifications like this
Certified Cloud Security Professional,
the Certified Authorization Professional,
and of course, others like the
Certified Secure Software Lifecycle Professional
in case you actually are concentrating in an SDL program.
They also have certifications related
to health care information security.
The HealthCare Information Security and Privacy Practitioner
or HCISPP, and the
Certified Cyber Forensics Professional.
ISACA is another organization that has a cyber security
certification that is fairly popular
among security managers and auditors.
It is called the Certified Information
Systems Auditor or CISA.
I'm including the link to their websites
for their reference.
One of the questions that I often get is what recommendation
do you have to actually get a certification
like an OACP or CEH or a CCNA Cyber Ops?
Or should I get a four year degree instead
or even a Master's degree in cyber security?
Well, as you can expect, my answer is it all depends.
So for instance, for being an expert in cyber security,
you need to have a really good understanding
on how systems operate.
You also need the fundamentals
of networking and programming.
How can you hack a system, if you actually don't know
what that system is actually doing
or how it actually runs under the hood?
So yes, you can launch a tool and try to be lucky,
but I actually don't classify that as a security expert,
right, actually not even security amateur
to be honest with you.
So there are several universities that actually have
excellent programs for cyber security
including undergraduate, Master's, and PhD level degrees.
Now when it comes to pen testing, there are not a lot
of university programs out there for pen testing.
In many cases for pen testing,
a certification may be better.
Now it all depends on what your employer,
of course, will require.
And if your don't have actually pen testing
or a security assessment review for a client,
that may actually dictate what type of certifications
you may actually have or what type of degrees
you may actually have.
Now regardless, what I do recommend is actually to have
a good roadmap for your career
so that you can actually plan ahead.
For example, you may want to eventually be a CISO,
or Chief Information Security Officer, of a big company,
so in that case actually you have to develop your roadmap
a little bit different than if you wanted to be
just say a security researcher or somebody focusing
on reverse engineering or exploit development.
So depending on your career goals, you have to analyze
and become familiar with all the options out there
and then create somewhat of a roadmap.
Now of course, this roadmap will actually change
as you advance your career.
For instance, I actually started in cyber security
whenever I used to work for the US Department of Defense
back in 1994 through 1999.
And then since 1999 actually I have been at Cisco.
I have served within several roles within Cisco
and these roles actually included from network security,
supporting actually Cisco security products,
also pen testing, instant response,
and the security research and operations team
that I actually serve right now.
So my roadmap, as you can see, has changed over the years.
What is actually important is that you stay relevant
and you're committed, that you actually concentrate
and develop that roadmap and then actually
commit to your goal.
Now cyber security is actually changing every minute,
every single day, and you must study and become familiar
with the new concepts every single day.
So stay relevant, be committed, develop that roadmap,
and that's actually my humble advice.