My Certifications

Certifications are nice pieces of paper to prove that you cared enough about something to study for it and pay money. The harder the certificate, the more respect is earned (because it’s just as easy to give up on a certification as it is to never take it in the first place).

Why do I have the certifications I have? Because my college required certain certs for graduation. Otherwise I might have skipped them, but then again CompTIA certs are so cheap and easy that why not?

CompTIA Security+ ce

I got this as my first certification. I almost aced it. I had been working in security for several years by the time I took the cert, and also I majored in security. Easy as pie. Hardest part is the commonly known ports (because some are not so common these days) and details of the various encryption algorithms. You don’t get too in-depth on Diffie-Hellman key exchange, but you have to know more than just the name. Asymmetric vs symmetric encryption is good to know, too. Most of the rest is common sense you can learn by skimming a book.

CompTIA Linux+

This is a nice one because it’s 3-in-1. You get the CompTIA cert, a Linux Professional Institute cert, and a Suse cert. However this one is hard as shit. Nothing in Linux makes sense and you have to memorize so much nonsense. The first part of the test is 90% “what flag would you use with <command x> to do <action y>. Type the flag only without the command or full path:”. And you know for command X the flag for all is -a, but for command Y the flag for all is -m (m for “my god that’s a lot of info”). But then for the GNU programs, its ‘–give-me-too-much-info’.  The other 10% is the Linux filesystem, which is stupid. “How do you get to the root filesystem”? Do you mean \ or \root? Because there’s two fucking directories called root. And the root user home directory is not in \home, because that makes sense.

The second part of the test is log files, configurations, a small amount of Bash scripting, and iptables/routes. There’s also some SQL and subnetting thrown in because just because it’s a Linux test doesn’t mean we can’t throw in non-Linux questions as well! Seriously, subnetting is part of the Network+ and SQL is part of ‘no one cares about databases’+. Probably.

What I Don’t Want But Will Likely Get Anyway:

The Certified Information Systems Security Professional (CISSP) certification. My project manager has it, and he doesn’t know shit. He got it on a week-long brain dump with the test immediately afterwards, then forgot everything because it was a brain dump. It’s so highly regarded that people will do that. Now granted, people can do that for almost any multiple-choice exam, but the CISSP is so sought-after by management that those people cheapen the accomplishment. I do have a coworker who took the CISSP and is really good at what he does. So it varies, like any cert. It’s still no match for actual skills-based, hands-on tests though.

What I Want:

I really, really have my eyes on the Offensive Security Certified Professional (OSCP). Ooh that looks fun. Also looks hard. And expensive. And it’s a skills-based, hands-on certification.