3 ms·

Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and st

Study first for the Security+ exam. That is the entry level security certification. It is much harder now than it used to be. You can find a lot of books and study material about it online. The gold standard is still CISSP for the corporate world. It is more of a managerial standard. The best study guide is the official course book: https://www.amazon.com/Certified-Information-Security-Professional-Official-ebook/dp/B07CG86947/ref=mp_s_a_1_4?dchild=1&keywords=cissp+coursebook&qid=1619696728&sr=8-4 https://www.amazon.com/Certified-Information-Security-Profes... https://en.m.wikipedia.org/wiki/Certified_Information_Systems_Security_Professional https://en.m.wikipedia.org/wiki/Certified_Information_System... The standard most prized by government and security researchers is GIAC from Sans. https://en.m.wikipedia.org/wiki/Global_Information_Assurance_Certification https://en.m.wikipedia.org/wiki/Global_Information_Assurance... To take the CISSP you have to apply for the exam because there are prerequisite criteria and the exam costs $700. Even still it only has around a 60% pass rate. The GIAC tests are supposed to be much harder and are extremely expensive. I passed the CISSP but have never taken any of the GIAC tests.

mhluongo 6y ago
They asked for learning resources, not paid certifications most of us ignore on CVs.
- austincheney 6y ago
  That’s because you are a developer and not a security manager.
  - not1ofU 6y ago
    https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
  - bawolff 6y ago
    CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
    - austincheney 6y ago
      The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
  - mhluongo 6y ago
    The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.

mhluongo 6y ago

They asked for learning resources, not paid certifications most of us ignore on CVs.

austincheney 6y ago
That’s because you are a developer and not a security manager.
- not1ofU 6y ago
  https://www.youtube.com/watch?v=ZdGrC9S4PYA https://www.youtube.com/watch?v=ZdGrC9S4PYA
- bawolff 6y ago
  CISSP has a somewhat positive reputation, but lots of the other certs are basically negative signal on a resume. There's lots of different types of security stuff. If you're interested in the more risk management corporate side, looking at study material for certs like CISSP can be useful (but use it as a starting point of things to learn, dont follow blindly). If you want to learn crypto, that's not the path i would reccomend.
  - austincheney 6y ago
    The software industry does not value certifications... at all. The networking and security industries, on the other hand, require them. Attaining those jobs/skills from the perspective of writing software is the surest way to waste your time and accomplish nothing.
- mhluongo 6y ago
  The ask was "secure engineering", yeah? The auditors and pentesters we hire have never presented me with their certificates ¯\_(ツ)_/¯ > That’s because you are a developer and not a security manager These days, I'm neither.. but I am a founder in a security-critical space.