Forensics or Ofensive Security?

[Pquesadaz]

After some technical vendor specific certifications like Cisco, I am ready to start studying for another certification. Forensics calls my attention but I have been hearing a lot about offensive security opportunities too. I know this is more taste related but I would like to hear opinions about tendencies and what is more required in the market nowadays. Forensics certifications or offensive security?

Whatever your recommendation or point of view is, would you please indicate which certifications are better to start with any of these paths?

Thanks.

Pablo.

[CraginS]

---

@Pquesadaz wrote:

After some technical vendor specific certifications like Cisco, I am ready to start studying for another certification. Forensics calls my attention but I have been hearing a lot about offensive security opportunities too. I know this is more taste related but I would like to hear opinions about tendencies and what is more required in the market nowadays. Forensics certifications or offensive security?

Whatever your recommendation or point of view is, would you please indicate which certifications are better to start with any of these paths?

Thanks.

Pablo.

---

Pablo,

If you wish to focus on the better market for job opportunities, I recommend making the forensics path. Many infosec shops in both government and corporate worlds need strong forensics specialists. In contrast, "offensive security," more colloquially referred to as hack back, is severely restricted to government agencies and limited authorized use by major corporations, such as Microsoft, only when working with law enforcement agencies. 

Thus, I'd recommend studying for the forensics work heavily, and keeping hack back skills development as a personal hobby, unless you are aware of a government enforcement position you aspire to.

[OS22783]

I would agree with @CraginS but I will also add that the Offensive Security training and certification is one of the most valuable ways to understand what and why we are doing what we do. The 24 hour exam is one of the toughest because it is hands-on you aren't just reading a book and then regurgitating the information then forgetting it. 

So that being said, do what you really enjoy doing, if you think you will be doing more of the red/blue team / InfoSec analyst and engineering or pen-testing then either will help but the Offensive Security is a great choice. If you will be doing the forensics and analysis type of work then go that way and don't beat yourself up with certifications you won't necessarily need

[rslade]

I'd have to say (wouldn't I) offensive security (as long as you're not too offensive  🙂 is a promising field, but I think that "promising" is the operative word at the moment.  It's going to be a while before too many companies are really ready to pursue it ...

[Pquesadaz]

Thanks Cragin. I am not considering to work on any government position since I am not in US, so makes no sense at this time. Would you recommend any forensics certification path based on your experience?

Thanks,

Pablo.

[Pquesadaz]

haha, yeah I am not pretending to be a black hat hacker. Both fields call my attention but I want to start studying something that will open more doors for my next move. Thanks for your feedback.

[CraginS]

---

@Pquesadaz wrote:

Thanks Cragin. I am not considering to work on any government position since I am not in US, so makes no sense at this time. Would you recommend any forensics certification path based on your experience?

Thanks,

Pablo.

---

Pablo,

I do not have experience in forensics, but I have completed several courses from SANS, and have the highest regard for their courses. Their courses are excellent at combining textbook knowledge with actual hands-on skills development. I recommend you link to their site and search on the word forensics. You will find several courses in that field in their section on Digital Forensics and Incident Response. 

Good luck!

[Lac]

I think it all depends on what interests you. Personally I have OSCP(Offensive Security Certified Professional) and can say that it is a real brain twister. Their mantra "try harder" is meaningful. It is a hands-on training with 24 hours exam at the end so need to think over if you are ready for dedicating significant amount of your time. I can say it worth every minute. I think it is advisable to build up some basic knowledge before enrolling for OSCP course. In order to know several terminology I suggest to do a "preparation step" like doing a certification ends with test-based exam (ex.: like some SANS courses or CEH). They help to put the offensive security in its proper context in the security era.(thinking that we are the good guys)

There are lots of debate about which certification is better then the other but I think that all of them has its role in the security industry, has its audience and can serve to build up the knowledge base of the individual.