Security Certifications Presentatie SecCert 101 Jordy Kersten MSc., ISC2 Ass., CEH, OSCP
Wie ben ik? Jordy Kersten 26 jaar Communicatie Systemen HAN Arhnem Informatiekunde RU Nijmegen Security Consultant
Index SecCerts 101 Waarom? Certificaten Instituten Certificeringen Ervaringen ISC2 (CISSP) Eccouncil (CEH) Offensive Security (OSCP) Vragen/Discussie
Waarom? Kennis Geld Status Werk Plain old fun?
Media Top 10 Security Certifications 2010 1. CISSP 2. CISM 3. GIAC 4. CISA 5. CSFA 6. CEH 7. CBCP 8. CPP 9. CCE 10. Vendor Certifications (Cisco / Microsoft) Bron: http://www.cccure.org/modules.php?name=news&file=article&sid=1431
Media Top 5 Security Certifications 2011 1. CISSP 2. CEH 3. CISM 4. GIAC 5. Vendor Certifications Bron: http://www.bankinfosecurity.com/articles.php?art_id=3222
Expertise General (IT) Security Ethical Hacking / Pentesting Forensics
General Security Breed onderwerp Weinig diepgang Niet technisch
General Security Security+ Comptia NSA: Network Security Administrator ECCouncil SSCP: Systems Security Certified Practitioner ISC2 CISSP: Certified Information Systems Security Professional ISC2 CISM: Certified Information Security Manager ISACA CISA: Certified Information Systems Auditor ISACA
Hacking / Pentesting Specifiek onderwerp Veel diepgang (Zeer) Technisch
Hacking / Pentesting CEH: Certified Ethical Hacker ECCouncil ECSA: Certified Security Analyst ECCouncil LPT: Licensed Penetration Tester ECCouncil OSCP: Offensive Security Certified Professional OffSec OSCE: Offensive Security Certified Expert OffSec ECPPT: Certified Professional Penetration Testing elearnsecurity GSEC: SANS Security Essentials SANS GCIH: Hacker Techniques, Exploits, Incident Handling SANS GPEN: Network Penetration Testing/Ethical Hacking SANS
Forensics Zeer specifiek Veel diepgang Zowel technisch als niet technisch Techniek Wet en regelgeving
Forensics CHFI: Computer Hacking Forensic Investigator ECCouncil CCE: Certified Computer Examinar ISFCE
Instituten ISC2 Eccouncil elearnsecurity OffSec GIAC/SANS
Type certificaat (theoretisch/hands-on) Eisen (ervaring vakgebied, voorkennis) Stof (diepgaand of oppervlakkig) Examen (multiple choice/open)
ISC2 The International Information Systems Security Certification Consortium, Inc., (ISC)², is the global leader in educating and certifying information security professionals throughout their careers.
ISC2 - SSCP SSCP - Systems Security Certified Practitioner Type Eisen Stof Examen Pre-CISSP
ISC2 - SSCP Access Controls Cryptography Malicious Code and Activity Monitoring and Analysis Networks and Communications Risk, Response and Recovery Security Operations and Administration
ISC2 - CISSP CISSP - Certified Information Systems Security Professional Type Eisen Stof Examen MVP
ISC2 - CISSP Access Control Application Development Security Business Continuity and Disaster Recovery Planning Cryptography Information Security Governance and Risk Management Legal, Regulations, Investigations and Compliance Operations Security Physical (Environmental) Security Security Architecture and Design Telecommunications and Network Security
The International Council of E-Commerce Consultants (EC-Council) is a memberbased organization that certifies individuals in various e-business and information security skills.
ECcouncil - CEH CEH: Certified Ethical Hacker Type Eisen Stof Examen Must Have
ECcouncil - CEH Introduction to Ethical Hacking Footprinting and Reconnaissance Scanning Networks Enumeration System Hacking Trojans and Backdoors Viruses and Worms Sniffers Social Engineering Denial of Service Session Hijacking Hacking Webservers Hacking Web Applications SQL Injection Hacking Wireless Networks Evading IDS, Firewalls and Honeypots Buffer Overflows Cryptography Penetration Testing
ECcouncil LTP/ECSA ECSA: Eccouncil Certified Security Analyst Type Eisen Stof Examen Stop Talking, Start Doing
Experience the industry's most realistic training on penetration testing as taught by the Offensive Security Training team.
OffSec - OSCP OSCP: Offensive Security Certified Professional Type Eisen Stof Examen Become the Hacker
OffSec - OSCE OSCE: Offensive Security Certified Expert Type Eisen Stof Examen Best of the Best
The Global Information Assurance Certification (GIAC) was founded in 1999 to validate the real-world skills of IT security professionals.
GIAC - GWAPT GIAC Web Application Penetration Tester (GWAPT) Type Eisen Stof Examen 100% web apps
GIAC - GWAPT AJAX Application Flow Charting and Session Analysis Automated Web Application Vulnerability Scanners Client Authentication Cross Site Scripting Flash Java Applets Javascript for Pen Testers PHP Probing and Other Mapping Python Scripting Basics Recon Using Public Information Session Tracking and SSL Spidering SQL Injection The HTTP Protocol Understanding the Web Web App Pen Test Methodology and Reporting Web Application Vulnerabilities and Manual Verification Techniques Web Services XSS Frameworks and Attack Limiting
GIAC - GPEN GIAC (GPEN) Type Eisen Stof Examen CEH enemy
GIAC - GPEN Advanced Hash Manipulation Command Shell vs. Terminal Access Enumerating Users Exploitation Fundamentals Injection Attacks Legal Issues Metasploit Moving Files with Exploits Obtaining and Passing Password Representations Overview of Passwords Pen-testing Foundations Pen-testing Process Pen-Testing via the Command Line Profiling the Target Reconnaissance Scanning for Targets Using a Proxy to Attack a Web Application Vulnerability Scanning Wireless Crypto and Client Attacks Wireless Fundamentals
To impact our students career through the most advanced IT Security courses and the best elearning methodologies
ecppt elearnsecurity Certified Professional Penetration Tester Type Eisen Stof Examen Rookie cert (but good)
ecppt System Security Topics Introduction to system security and environment installation Understanding Polymorphism, Metamorphism and latest malware techniques Writing trojans and keyloggers (3 source code examples) Cryptographic attacks and password cracking Finding buffer overflows Exploiting buffer overflows (3 source code examples) Writing remote code execution for a real world Windows application Writing shellcodes (3 source code examples) How rootkits work Writing rootkits for windows (3 source code examples) Basics of Windows drivers development
ecppt Network Security Topics Information gathering on target organization Using DNS, Whois, Maltego to collect information Fingerprinting remote OS, services and devices Advanced port scanning with nmap and unicornscan Passive and Active Sniffing techniques and tools Man in the middle attacks Enumerating resources and hosts through NetBIOS and SNMP Vulnerability assessment with Nessus Exploiting with Metasploit Using covert techniques for 100% blackbox testing: proxies, socks, Tor Social Engineering - SET
ecppt Web Application Security Topics Introduction to Pentesting web applications Gathering information on target Enumerating resources: dirs, files, usernames Vulnerability Assessment through Nikto and Nessus Building XSS advanced attacks (real world examples) Attacking remote users through BeeF Dumping remote data through advanced SQL Injection (real world examples) Getting root through remote SQL injection Building a real world CSRF exploits against Joomla Exploiting RFI/LFI and server misconfigurations Attacking Web 2.0 and Ajax frameworks (real world examples) Google hacking
Vragen/Discussie