Re:Ask HN: Are Certifications Useful in Infosec?
by tptacek on Sunday June 13, 2021 @02:47PM
(#27495147)
Why would you recommend OSWE? What's an example of a specific benefit you'd get in appsec (also my specialization!) by holding that certification?
[ Parent
| on HN ]
Re:Ask HN: Are Certifications Useful in Infosec?
by Techbrunch on Sunday June 13, 2021 @03:11PM
(#27495353)
An example would be to be able to read source code in different languages (Java, PHP, JavaScript, C#) and be able to identify, chain vulnerabilities and write an exploit script to automate everything.
You can find the syllabus here: https://www.offensive-security.com/awae-oswe/
Re:Ask HN: Are Certifications Useful in Infosec?
by tptacek on Sunday June 13, 2021 @03:14PM
(#27495384)
You're suggesting you might consider getting OSWE in order to learn appsec?
Re:Ask HN: Are Certifications Useful in Infosec?
by Techbrunch on Sunday June 13, 2021 @03:25PM
(#27495488)
I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics.
Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities.
If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security
Re:Ask HN: Are Certifications Useful in Infosec?
by tptacek on Sunday June 13, 2021 @03:28PM
(#27495512)
PortSwigger is great. Certifications, on the other hand, are not a good way to learn appsec.
Re:Ask HN: Are Certifications Useful in Infosec?
by appsecengthrow on Sunday June 13, 2021 @06:42PM
(#27497262)
No specific benefit or skill.
Just that I would recommend it because I felt good going through the challenges and that someone took the time to set up VMs and writeups for me.
In conclusion, it was more of a consumption thing than an investment.