Ask HN: Are Certifications Useful in Infosec?

Re:Ask HN: Are Certifications Useful in Infosec? by appsecengthrow on Sunday June 13, 2021 @02:38PM (#27495067)

I believe that certifications that don't have a practical aspect to them are totally worthless. I work in appsec and recently completed OSWE. The coursework was ok, nothing groundbreaking, learned a cute trick here and there.

Would I recommend it? Yes, especially if the company pays for it.

Company that I work for allows people to spend weeks of their working time preparing for top CTF contests and that is valuable because it is something practical. Just don't waste your time memorizing answers to exam questions.

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @02:47PM (#27495147)

Why would you recommend OSWE? What's an example of a specific benefit you'd get in appsec (also my specialization!) by holding that certification?

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by Techbrunch on Sunday June 13, 2021 @03:11PM (#27495353)

An example would be to be able to read source code in different languages (Java, PHP, JavaScript, C#) and be able to identify, chain vulnerabilities and write an exploit script to automate everything.

You can find the syllabus here: https://www.offensive-security.com/awae-oswe/

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @03:14PM (#27495384)

You're suggesting you might consider getting OSWE in order to learn appsec?

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by Techbrunch on Sunday June 13, 2021 @03:25PM (#27495488)

I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics.

Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities.

If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by tptacek on Sunday June 13, 2021 @03:28PM (#27495512)

PortSwigger is great. Certifications, on the other hand, are not a good way to learn appsec.

[ Parent | on HN ]

Re:Ask HN: Are Certifications Useful in Infosec? by appsecengthrow on Sunday June 13, 2021 @06:42PM (#27497262)

No specific benefit or skill.

Just that I would recommend it because I felt good going through the challenges and that someone took the time to set up VMs and writeups for me.

In conclusion, it was more of a consumption thing than an investment.

[ Parent | on HN ]