4 ms·

I believe that certifications that don't have a practical aspect to them are totally worthless. I work in appsec and recently completed OSWE. The coursework was

I believe that certifications that don't have a practical aspect to them are totally worthless. I work in appsec and recently completed OSWE. The coursework was ok, nothing groundbreaking, learned a cute trick here and there. Would I recommend it? Yes, especially if the company pays for it. Company that I work for allows people to spend weeks of their working time preparing for top CTF contests and that is valuable because it is something practical. Just don't waste your time memorizing answers to exam questions.

tptacek 5y ago
Why would you recommend OSWE? What's an example of a specific benefit you'd get in appsec (also my specialization!) by holding that certification?
- Techbrunch 5y ago
  An example would be to be able to read source code in different languages (Java, PHP, JavaScript, C#) and be able to identify, chain vulnerabilities and write an exploit script to automate everything. You can find the syllabus here: https://www.offensive-security.com/awae-oswe/ https://www.offensive-security.com/awae-oswe/
  - tptacek 5y ago
    You're suggesting you might consider getting OSWE in order to learn appsec?
    - Techbrunch 5y ago
      I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics. Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities. If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security https://portswigger.net/web-security
      - tptacek 5y ago
        PortSwigger is great. Certifications, on the other hand, are not a good way to learn appsec.
- appsecengthrow 5y ago
  No specific benefit or skill. Just that I would recommend it because I felt good going through the challenges and that someone took the time to set up VMs and writeups for me. In conclusion, it was more of a consumption thing than an investment.

tptacek 5y ago

Why would you recommend OSWE? What's an example of a specific benefit you'd get in appsec (also my specialization!) by holding that certification?

Techbrunch 5y ago
An example would be to be able to read source code in different languages (Java, PHP, JavaScript, C#) and be able to identify, chain vulnerabilities and write an exploit script to automate everything. You can find the syllabus here: https://www.offensive-security.com/awae-oswe/ https://www.offensive-security.com/awae-oswe/
- tptacek 5y ago
  You're suggesting you might consider getting OSWE in order to learn appsec?
  - Techbrunch 5y ago
    I would not recommend OSWE to learn appsec since it is teaching "Advanced Web Attacks" and assume that you know the basics. Something that is really interesting I think is the whitebox approach that some people in infosec might be missing if they don't come from a developer background and never botherered looking at the code introducing the vulnerabilities. If you want to learn appsec I recommend Web Security Academy: https://portswigger.net/web-security https://portswigger.net/web-security
    - tptacek 5y ago
      PortSwigger is great. Certifications, on the other hand, are not a good way to learn appsec.
appsecengthrow 5y ago
No specific benefit or skill. Just that I would recommend it because I felt good going through the challenges and that someone took the time to set up VMs and writeups for me. In conclusion, it was more of a consumption thing than an investment.