What's the Best Certification? I

Granted by CompTIA. It’s a beginner exam.
It is designed for novice candidates who want to "pursue an IT security career." As its main page says, obtaining the certificate validates that the candidate has the necessary base "to perform core security functions." In addition to being introductory, it is a mandatory certificate to fulfill the "DoD 8570 compliance." The certificate expires every three years, which is why people with experience in this type of exam usually repeat it. It is a recommended exam to demonstrate essential cybersecurity knowledge. Each participant will be asked to "perform basic security tasks, including configuring, managing and troubleshooting networks." Threat identification skills, pentesting and intrusion detections are fundamental in obtaining this certification. The exam lasts ninety minutes and is based on multiple choice and performance-based activities.

Granted by EC-Council. Another beginner certificate.
It is perfect for people who want to make their way into penetration exams. The preparation level that a candidate must have is practically the same as that required to achieve CompTIA Security+. However, unlike the latter, it is not based on multiple-choice questions but has practical tests. In this sense, it is expected that the tester can put into practice technical skills and not only theoretical. Unlike Security+, CEH holders attempt to attack systems with the ultimate purpose of anticipating cybercriminal attacks and fixing those security breaches. Another difference between Security+ and CEH is that you have two options to take the second exam. You can take the course before submitting the exam, or you can demonstrate two years of experience. If you don’t have that experience and don’t want to take the course, you should consider Security+ first.

In this sense, it could be considered that CEH is slightly more complex than Security+ since it asks for experience or preparation that the other does not. In addition, it could be regarded as a much more specialized certification as people interested in obtaining it must be professionals working in ethical hacking. Security+ is, in this respect, much more general, as it "provides a broad base of knowledge suitable to multiple environments." Both must be renewed three years after being issued.

Granted by Practical DevSecOps.
It is a beginner-intermediate certification. If most certificates are focused on pentesters who want to be part of a red team, the CDP is designed for developers to strengthen their techniques, especially those related with Development Security Operations (DevSecOps). The exam to obtain it requires basic knowledge of Linux commands and an understanding of security practices such as those of the OWASP Top 10. The exam lasts 12 hours. Upon completion, the candidates "should be able to implement the real DevSecOps approach in the CI/CD pipeline and doing security tasks at scale."

Granted by Offensive Security.
It is an intermediate level certification and is focused on practical skills. It certifies that the candidate "demonstrates a comprehensive mastery and practical understanding of pentesting." To obtain it, you must pass a completely hands-on exam. In order to achieve it, it is mandatory to take the Penetration Testing with Kali Linux (PWK/PEN-200) course. It is designed for people who want to strengthen their skills as pentesters. In this sense, it is recommended to take it after having obtained the CEH. The exam takes 24 hours of practice tests and 24 hours of writing a report. That makes it a good candidate for those interested in being prepared before submitting the longest and most difficult exams. Those usually last 48 hours.

Granted by Pentester Academy.
It is an intermediate level certification. In fact, the CRTP is very close to the OSCP in the level of complexity. To obtain it, candidates must do an intermediate-level exam that requires to "compromise several machines in a fully patched environment and produce a well thought out report including mitigations." This test lasts 24 hours, followed by 48 hours available to write a report on what has been done. As required by the OSCP, this certificate is entirely hands-on and focuses on assessing security on Active Directory. Like Security+ and CEH, it is an exam that expires after three years. With the OSCP and CEH, CRTP is considered the last certification of the triad needed to start a career within a red team.

Granted by Offensive Security.
It is a beginner-intermediate exam. It is usually accomplished after the CEH and is designed for people who want to consolidate their careers as security analysts or network administrators. It is an exam that begins with lots of information and reports of theoretical training. The exam focuses on auditing and testing the security of wireless devices. This makes it different from other certifications we have reviewed because it is the only one focused on wireless. Here testers will identify vulnerabilities in those systems and exploit them for attacks. The exam is limited to four hours and verifies practical skills.

Granted by Pentester Academy.
In a past blog post, we interviewed Daniel Yepes about his experience obtaining this certificate. It is an intermediate-advanced certificate. It usually follows the OSCP, so it is common for them to be compared. If the OSCP gave you the fundamental tools to become a pentester, the CRTE takes that and gets you to the next level. It is usually considered a "more realistic" test for keeping up with what a true pentester would do in his day-to-day life. Similar to the CRTP, the CRTE is focused on Active Directory infrastructure networks. In this sense, both (CRTP and CRTE) differ from the OSCP because they can give a more general look at how to exploit vulnerabilities. The examination is 24 hours in length plus 24 hours to the writing exam.

Let’s stop here for today. Until now, we have reviewed almost every beginner or intermediate certification we have gotten. In the next post, we will take a look at the most advanced certifications. Hopefully, we will be continuing to accomplish more certificates because we in Fluid Attacks are committed to constantly improving our Red Team.

At Fluid Attacks, we are specialized in cybersecurity through Pentesting and Ethical Hacking. For more information, don’t hesitate to Contact us!