Security Aegis

can you post your top favorite articles, forum top...

2009-02-09T17:17:00.000-08:00

can you post your top favorite articles, forum topics, and other types of content from the ethicalhacker.net forum?

<3!

2009-02-06T16:28:00.000-08:00

<3!

AppLocker id Win7 should bring some needed improve...

2009-02-05T03:07:00.000-08:00

AppLocker id Win7 should bring some needed improvements, lets hope =)

Friday – Day five was all about Windows sec. More ...

2009-02-03T14:27:00.000-08:00

Friday – Day five was all about Windows sec. More Windows active directory than I ever wanted to know about… well not quite, but close. No one ever told me most application whitelisting server software was just pretty front ends over AD! Should’ve guessed.
------------
Only if the application whitelisting was so easy. AD Software Restriction Policies have been around for the longest time but are practically unusable. I think the application whitelisting is much more than SRP. The technology needs to be able to operate without management overhead in large environments.

wow judging by the other people you interviewed I'...

2008-10-24T18:58:00.000-07:00

wow judging by the other people you interviewed I'm honored to be included.

so thanks!

As an update you may want to hit up Mike Murray he's really in tune to security careers and how they are affected by different events.

-CG

Great article, and thank you for offering me the o...

2008-10-24T05:56:00.000-07:00

Great article, and thank you for offering me the opportunity to contribute. I think we'll see some big changes down the road, and only time will tell what those are.

thanks for the comment Vince!I actually agree, i a...

2008-10-06T18:12:00.000-07:00

thanks for the comment Vince!

I actually agree, i am also enamored with it. Having the knowledge of the tools assumes knowledge of pre requisite security, and both these combined give a basis for a pentester. It's being on our side of the fence though, as most of the pentesters/infosec folks have a HUGE gripe with the CEH. I'm hoping that this revamped curriculum will change some minds.

I'm actually rather enamored with the CEH certific...

2008-10-06T14:09:00.000-07:00

I'm actually rather enamored with the CEH certification. I don't have one currently and I'm not even sure if it will end up being my career direction, but I really like the thought of it. The nicest thing is that most of the talent and skills required to do such a job are either there or not, which should quickly make it apparent when preparing for this cert whether one is cut out for it or not.

haha! good comments ntp!I will take all these into...

2008-09-29T10:49:00.000-07:00

haha! good comments ntp!

I will take all these into account. Email me sometime, i'd love to chat more about security =)

This is indeed a good model to go by. The reason ...

2008-09-29T10:45:00.000-07:00

This is indeed a good model to go by. The reason I love these pentest frameworks is that they provide a good reference. Entering the security field is daunting, and they provide a decent ground for the tools and structure a pentester or ethical hacker should be following. They are not best things since sliced bread, but they are handy and good to have bookmarked =)

Hello ntp!These two aren't really required for any...

2008-09-29T10:35:00.000-07:00

Hello ntp!

These two aren't really required for anyone, you are correct. My employer however will pay for them and has their own training for them. These are just stepping stones and adds to the resume, not anything I'm counting on =)

I'd be curious to see how Security Innovation fair...

2008-09-29T07:01:00.000-07:00

I'd be curious to see how Security Innovation fairs as they were not on your list

I understand CISSP and OSCP, but why would you eve...

2008-09-29T07:00:00.000-07:00

I understand CISSP and OSCP, but why would you even consider CPTS or CEH? Isn't CEH the certification program where 95% of instructors have 0% real-world pen-test experience (i.e. never have done one)? Why CPTS? Why CEH? Who's asking for them and what's the point?

A lot of this was pulled from other sources includ...

2008-09-29T06:57:00.000-07:00

A lot of this was pulled from other sources including the ISSAF and WirelessDefence.org.

Some of my friends like these sorts of pen-test frameworks, but I think they are not very real world.

I often view network pen-testing as
1) the ability to identify or get full-knowledge information on the actual pieces of the puzzle (footprint and fingerprint)
2) the ability to replicate that environment exactly, including as many original software artifacts as possible (especially code in the form of binaries or source)
3) the ability to test and inspect the replicated environment instead of the one that you'd rather not break (i.e. the production one)

since nobody else looks at it that way, i think that this industry is due for a revolution. even the OSSTMM 3.0 (the full version I'm talking about here) stands to take some concepts from the three point model that I just proposed

OSCP is the best technical certification program I...

2008-09-29T06:49:00.000-07:00

OSCP is the best technical certification program I have seen so far, especially to 2008/2009 standards. GSE just has insane requirements and a minimal set of people have met them (11 in 5 years?!).

OPST is very forwarding looking. This is only worthwhile if you have mastered the technical focus of your career and want to postulate what is possible on the strategic process side. It could also become a dominant measure of tactical technical ability, but in 2008/2009 it is not quite there yet.

CISSP and all ISC2 certifications are on their way out, regardless of the promises, the re-certification, and the continual education processes. However, many venues will continue to worship them for an unknown reason.

One of the major institutions requiring certification is the US military and government information assurance programs. The DODI 8570.01M is the manual that anyone interested in certification should read (please don't read just the SANS version, they are very biased).

SCNP/SCNA is a very good path to take for the IAT track - the material is good and widely available. SANS and ISC2 pretty much own all of the other track paths, although the CERT CSIH and ISACA CISA keep the program somewhat vendor neutral.

I have never considered ISC2 or SANS to be vendor neutral (they are vendors in my mind). However I have some nice things to say about SANS, but they are hit or miss and will have to wait for another time.

OSCP is certainly worth everyone's time and energy. While there is more depth to CWSP, I think OSWP is more relevant today. I do not like the OSWP reliance on Backtrack tools, even though right now they happen to be the most complete.

OSWP is going to be both important and popular soon. The training and certification are cheap, consistent, and timely. This is a serious win. Although the syllabus for OSWP is awesome -- the SANS Wireless Ethical Hacking Pen-Test course appears to be even better if you check out Days 1-6 in detail. I would recommend both to those who want to specialize in WiFi/WEP assessments. Woops I just said something nice about SANS training, although you should note that it is incredibly expensive and taking 6 days out of your work life might be a pretty big deal.

OffSec101 gets a 6 out of 10 (and improving). Wir...

2008-09-29T06:31:00.000-07:00

OffSec101 gets a 6 out of 10 (and improving). Wireshark University I give a 3 out of 10 (but also improving despite the low mark).

SANS is hit or miss. Most of these others that I have seen are 2 out of 10 at best, but I haven't seen a lot of the ones that you've listed.