An example: Matasano (I have no affiliation) is a well-respected security company. Their hiring process involves (or involved) taking applications from interested people with interesting resumes, sending them a textbook, and asking them to come back when they felt qualified.

I've seen this sort of outlook (usually without the textbook) across the board. Either a company will train people from scratch, or they want to see applicants with actual records of working security, finding and reporting vulnerabilities, or patching holes in OSS.

"Have a certificate" is nowhere on that list. It probably can't hurt for a candidate, but I certainly don't think it will bridge the gap from inexperienced to experienced the way an actual work record would.

I cofounded Matasano, for whatever it's worth.

Having a certificate actually can hurt you, for elite jobs (it's not really going to hurt you if you're just breaking into the field).

Now there's an irony, I had no idea.

The timing never worked out, but applying to Matasano was tied to the start of my interest in security. It was one of the most welcoming and positive interview processes I've ever seen.

Thanks! I'm looking forward to reproducing it this year at Latacora. :)

Hi Thomas, I'm interested to hear what the elite jobs are you speak of and in what respect having a cert would hurt one in them?

It's a lack-of-clue signal.

I'm not saying it should be. If you're hiring exploit developers, your process should begin and end at having candidates build model exploits. But almost nobody hires like this; most organizations have tea-leaf-reading hiring processes, and proudly advertising that you have a CISSP or CEH is one of the tea leaves they read.

On the trading floor we called them girl/boy scouts: more interested in collecting "merit badges" than getting dirty.

For what it's worth, Troy's perspective is colored by living in Australia.

My experience is that the Australian tech scene (I don't live there anymore) is in many ways similar to the 1990s in the U.S. Customers and recruiters ask about certificates. Hell, you typically have to go through a professional recruiter in order to get a job; it is often not possible to apply directly to companies.

I am generalizing and also talking about my experience in Australia about 8 years ago. Maybe everything has changed.

While the tech scene in Australia may be behind the times in a few ways (possibly security as well), Troy's view here is in no way affected by living here. This material was created because PluralSight wanted CEH-related material, as their viewers (world-wide) were asking for it. Full stop.

Blog posts like that are designed to steer traffic towards course views and "time watching the content", without which PluralSight authors don't get paid.

As per linkregister's comment, I feel this is regional. Indeed, the big news here in Australia is a disappointing push for a national certification plan[1]. I've been in several conversations with people that have stated they hope this goes ahead, so they "know who to hire".

The most common mandate I currently see is "CCNP Security", which shows up as a hard requirement regularly, even in non-Cisco shops. I could never bring myself to invest time for such a thing - feeling it largely conflates "security" with "buy firewalls".

While I'm talking to you, thank you for the cryptopal challenges. They were a very good departure from the compliance based security I usually have to deal with.

[1] http://www.itnews.com.au/news/should-aussie-cyber-security-p...

The notion of a national certification plan is being laughed at by anyone who is in the industry for the right reasons. Those involved in the classic commoditised scan-and-bang assessments will love it as it'll continue to keep the cash flow churning.

Some have even suggestion "cyber conscription" to force people to do government work if they're capable. This, and the recent articles indicating that the government wants people to "volunteer" their time goes to show that they want people for the lowest possible price.

The problem in Australia here is no different to overseas: the focus is on useless certifications and compliance, cheap resources, and security theatre. CEH and CISSP are alive and kicking because of this.

All of the above is beside the point. Troy made CEH PluralSight content because PluralSight's people wanted it. It's really that simple. The blog post is just marketing for that content.

> The notion of a national certification plan is being laughed at by anyone who is in the industry for the right reasons

Yes but the majority of enterprises are not in the industry. These stupid certifications are being pushed by our largest accounting firms (where Arno Brok is connected), and these are influential to business leaders.

> Troy made CEH PluralSight content because PluralSight's people wanted it

I hadn't considered that. Good point.

>the focus is on useless certifications and compliance

It's hard to explain to people in "real" security just how hopeless the current "compliance security" situation really is. Consider this situation. A user goes on holidays for two weeks. Before leaving, they turn off their laptop and lock it in a cupboard.

I've just described a critical incident. I can expect to be writing up incident reports, and reporting to management on "root cause" and how we can avoid this incident recurring. Can anyone in "real security" even see the problem?

Why, after two weeks, their desktop antivirus is out of date.

Agreed. The cross pollination required to get security into organisations correctly isn't there. Orgs see security as a pain in the ass, and not an investment/insurance policy.

I feel your pain in those latter points.

I do not find this to be entirely accurate. I work as a penetration tester/run the offensive security practice at a small security firm, and I used to spend a fair amount of time performing malware forensics (and taught it a bit at a local University for graduating students who were interested in a two day crash course... free of course), and I can say with fair amount of certainty that the industry does recognize and sometimes require certificates. I am not saying a certificate will get you the job, or even that they are a good way to spend your time, but they can certainly get you an interview. For instance, I run a team of about 6 penetration testers, and my time is pretty limited because we always have so much on the go. When I am hiring, I usually ask that someone have the OSCP, OSCE, or GXPN if they are going to apply. In the case of the OSCP and OSCE, they are not cost prohibitive, even for someone covering the costs themselves, and they test one's ability to perform actual penetration testing and report writing. You have a certain amount of time (24 hours OSCP and 48 hours OSCE) to hack into some servers and show your technical chops, and then report on what you did and how you did it. In the case of the OSCE, I will know if you passed that you understand disassemblers, debuggers, exploit code writing, and assembly. That gets you in for the interview, and I can further check out your programming skills, security chops etc. I am not saying that if someone has a particularly interesting resume, I won't look at them. But when time is limited, and you aren't a fortune 500, its a good way to filter out some of the candidates. I will say that certs like the CEH and CISSP don't matter in the slightest bit to me. I could care less about how you do on a multiple choice exam, the only exception being the GXPN because that course is actually relatively grueling.

What firm do you work for? Prior to my career as a professional Internet message board commenter, I cofounded Matasano, ran recruiting for Matasano, and then, after they acquired us, ran recruiting for NCC Group --- which is I believe the largest pentest firm in the US. I've got friends at most of the other big firms, and this is a topic of conversation that comes up a lot.

I'm pretty confident in my answer here.

If you want to know whether someone understands disassemblers, debuggers, exploit code writing, and assembly, have them do tasks that involve disassemblers, debuggers, exploit code writing, and assembly. We had that problem, and we built Microcorruption to address it. But you don't need anything that elaborate.

I get that most firms don't hire this way yet (all of them will within the next 10 years). But so far as I know, none of the reputable firms rely on certifications. Of the top, say, 20 "offensive security" people I know, not one of them has any of these certifications.

If there's a major firm that outsources this stuff to certification programs, that would be surprising news for me.

Like I said, its a small firm (also not in the US so I don't have anywhere near the pool to pull from that you have I am sure). I also don't disagree with you like I said, I am just pointing out that it can be a legitimate way for some people to get a foot in the door at a smaller firm, or less 'reputable' one, before moving somewhere else. You need to pay your bills while you wait for other opportunities, or develop your skills.

I am slowly working towards moving us into a position where we have more practical methods of finding out if candidates understand the above, but it takes time for me to develop testing methods etc. while simultaneously completing everything that needs to be completed.

If you have any recommendations, I'm more than open!

In fact, I do: https://sockpuppet.org/blog/2015/03/06/the-hiring-post/

Thank you for this! I'll read through it!

I'm easy to track down if you have questions about it.

Care to elaborate why programming skills are so important in the field of security? Genuinely curious. I have always wanted to take my skills to the next level but have never actually gotten started. This might be the time for me to start.

It's of varying importance depending on what field of security you're talking about, but generally it's the chasm that separates entry-level security folks from the rest.

Using systems administration as an analog, there exists a class of sysadmins who can't write even basic scripts. Their ability to troubleshoot or problem solve are limited to using predefined tools. Whole categories of tasks will be infeasible for them to accomplish (mostly because of the amount of time it would take to do them manually, not necessarily because they are technically impossible).

Lacking the ability to do any programming limits their job prospects to the bottom of the sysadmin barrel. That being said, programming isn't necessarily a prerequisite for their job, it's just a ceiling.

Going back to security, most tasks benefit from the ability to automate some part of them. I come from application security, where that frequently manifests in having to quickly piece together tools for interfacing with a specific protocol or API. Application consulting exacerbates that even more, because you'll usually have to do all of this in a very short amount of time, so that you can spend the allotted assessment time actually doing the assessment, and not trying to get your tools to work with the environment.

A lot of security boils down to bugs in software. If you don't have any programming skills, how do you expect to quickly and accurately find bugs in software? Sure you can go around banging on things and you might get lucky with the easy cases, but you will struggle to exploit and pivot out of the difficult cases.

the cryptocat challenges which I think were you guys were and still are awesome!

Crypto-pals. Pals. Not cats. Cats, in my experience, are really bad at practical cryptography.

But: thank you!